What TackleSplit stores
TackleSplit stores an authentication identifier, your chosen display name, trip configuration, crew membership, boats, gear targets and commitment states so the shared plan can work. Saved kits include gear, quantities and optional usual-person hints. Smart Check stores your dismissed suggestions and addition history so choices and undo work.
The alpha does not ask for exact coordinates, age, medical details or dietary information. Do not put sensitive information in trip or item text.
Invites and identity
You can create or join with an anonymous browser identity. The raw invite token is exchanged and removed from the address bar; only a cryptographic hash is stored in the database. Losing an anonymous browser session can mean losing access until email recovery is available and configured.
Email and billing
If you choose to confirm an email for Pro, Supabase stores that email with your account. TackleSplit sends your confirmed email and a checkout reference to Lemon Squeezy to open its hosted checkout. Trip contents, crew names and saved kits are not sent in that request.
TackleSplit stores checkout, customer, order and subscription identifiers, subscription status and access dates to verify paid access. Its billing tables do not store card numbers or complete payment notification payloads. Checkout and billing portal data are handled by Lemon Squeezy under its privacy policy.
Lemon Squeezy handles real payments as merchant of record. Payment details are entered on its hosted checkout.
Minimal product analytics
If configured, the alpha sends only allowlisted event names and coarse properties such as fishing mode, quantity or action type. It does not send names, trip titles, invite tokens, email, location, notes, URLs or item text. Analytics is personless: no vendor SDK, autocapture, session replay or analytics cookie is loaded. Browser Do Not Track and Global Privacy Control signals disable it.
Providers and retention
TackleSplit uses Netlify and Vercel for hosting, Supabase for authentication and data, Cloudflare Turnstile for browser verification, and Lemon Squeezy for checkout and billing management. PostHog may be configured for personless analytics. Infrastructure logs and backups can have provider retention periods. Deleting a trip should make it inaccessible immediately; hard-deletion timing will be documented before public launch.
Your choices
You can release commitments or leave a trip. The owner can revoke an invite and remove the trip data once deletion ships. Privacy requests can be sent to tacklesplitapp@proton.me.