Privacy Policy
Last updated: 17 July 2026
Starting draft: review (and ideally have counsel check) before public launch. Set a real contact address and legal entity name where marked.
Geomaxxing (“we”, “us”) is a data-driven relocation research tool. This policy explains what we collect, why, how long we keep it, and who we share it with. We collect the minimum needed to run the service and improve it — nothing sold, no ad networks.
What we collect
| Data | Why | How long |
|---|---|---|
| Email address (via Google sign-in or magic link) | Create your account and grant your one-time “Pro” unlock | While your account/unlock exists |
| Sign-in cookies (session, OAuth state, admin) — HttpOnly | Keep you signed in securely | Session token up to 30 days; short-lived state cookies |
Pricing-experiment cookie (geo_ab) | Show you a consistent price during an A/B test | Up to 90 days |
| Attribution & usage events — campaign/referral source, a coarse IP (network prefix only, host portion removed), browser user-agent, timestamps | Understand which channels bring visitors and where they drop off | Raw event log expires after 90 days; checkout attribution after 45 days; aggregate per-campaign counts are non-identifying and retained |
| Mailing-list record — your email, plus what you consented to, when, the page you signed up from, a coarse IP and user-agent | Send you the updates you opted in to, and prove that opt-in if asked | Until you unsubscribe; the record is then marked unsubscribed and kept as proof of the request |
| Payment records (Stripe session/customer ids, amount, status) | Fulfil and support your purchase | As required for accounting/records |
| Aggregate web analytics (page views, referrers, country) via Cloudflare Web Analytics | Measure traffic and performance | Cookieless and aggregated — not tied to your identity |
We do not collect or store your card details. Card entry happens entirely on Stripe’s hosted checkout.
Signing in is not signing up. Creating an account or buying Pro never adds you to the mailing list — that only happens if you tick the consent box on a signup form. Every list email carries a one-click unsubscribe that works without signing in, and unsubscribing takes effect immediately.
Who we share it with (processors)
- Google — “Sign in with Google” authentication.
- Stripe — payment processing (their privacy policy).
- Resend — delivering sign-in emails and, if you opted in, list updates.
- Cloudflare — hosting and privacy-first, cookieless web analytics.
- Cloudflare Turnstile — bot verification on the sign-in, feedback and mailing-list forms. Turnstile receives your full IP address and browser signals in order to score the request. This is the one place the IP is not coarsened, because the check requires the real address.
These providers process data on our behalf to deliver the service. We do not sell personal data or share it for advertising.
Legal basis & your choices
We process account and payment data to provide a service you request, and attribution/analytics data for our legitimate interest in understanding and improving the product (kept minimal and time-limited).
You can request access to, correction of, or deletion of your personal data — including your account and unlock record — by contacting us. Deleting your account removes your email and entitlement; anonymised aggregate counts may remain.
Cookies
We use only first-party, functional cookies: authentication (keep you signed in), OAuth state (sign-in security), and the pricing-experiment cookie. We use no third-party advertising or cross-site tracking cookies. Our analytics are cookieless.
Children
Geomaxxing is not directed to children under 16, and we do not knowingly collect their data.
Changes
We may update this policy; material changes will be reflected in the “last updated” date above.
Contact
Questions or data requests: [email protected].