Your data, plainly.

Data we collect

Only what we need to deliver the product:

• Account information. Email, name, and password (or your Google account identity when you sign in with Google). Google sign-in gives us your verified email, name, profile picture, and Google account ID — nothing else.
• Profile information you provide. Company name, SAM.gov UEI, NAICS codes you bid on, certifications, agencies you've worked with, states you service, and similar bid-fit details. Used to tailor recommendations.
• Documents you upload. Past proposals, capability statements, and similar materials. We extract text and themes to improve your proposal drafts. Files stay in your account; we do not train shared AI models on them.
• Application data. When you apply for the founder trial via /apply, we collect your answers plus a snapshot of your SAM.gov entity record at the time of submit.
• Usage data. Pages visited, features used, request timestamps, IP address, browser user-agent. Used to debug issues and prioritize improvements.
• Cookies. Authentication session cookies (required to keep you signed in), and a referral attribution cookie (fr_ref, 90-day TTL, set only when you arrive via a referral link). We do not use third-party advertising cookies or sell tracking access.

We do not collect government-issued IDs, financial account numbers, social security numbers, or biometric data. FedRange is not directed at children; we do not knowingly collect data from anyone under 18.

How we use it

• Deliver the service. Authenticate you, run the analyzer against your bid-fit profile, generate proposal drafts that reference your past performance, send transactional emails (sign-in links, alerts you've subscribed to).
• Improve the product. Aggregate, anonymized usage data informs what we build next. Individual feedback you send via the in-app feedback button is read by the founder personally.
• Support and communications. Reply when you write in. Send infrequent product updates you can unsubscribe from at any time.
• Security and abuse prevention. Detect and block scraping, credential stuffing, and other abuse against the service.

We do not sell your personal data. We do not share it with advertisers. We do not use your uploaded documents or profile data to train shared AI models that other users would benefit from.

Service providers and third parties

We use a small number of vendors to run the product. Each receives only the data they need to perform their function:

• Supabase — database, authentication, file storage. Hosted on AWS US regions.
• Vercel — application hosting and request routing.
• Google — if you choose to sign in with Google. Google receives sign-in events; we receive your verified email, name, and Google account ID. Subject to Google's own privacy policy.
• Sentry — application error monitoring. Receives error stack traces and anonymized session metadata.
• Email delivery providers. Send transactional emails (sign-in links, alerts, founder approval notices). Receive your email address and the email body.
• Inngest — background job orchestration (data refresh, enrichment).
• Stripe — payment processing. Only active when paid plans launch; not in use during the current founder trial. Receives billing details you provide at checkout.

We also query public government APIs (SAM.gov, USASpending.gov) on your behalf. Those queries are made server-side from our infrastructure; the government APIs do not receive your personal data.

We will disclose data when required by law (subpoena, court order, or other lawful process) and where necessary to protect against fraud or imminent harm.

How long we keep it

• Account and profile data — kept until you delete your account or ask us to delete it.
• Uploaded documents — kept until you delete them or your account.
• Application records — kept indefinitely for program-history purposes. You can request deletion of these.
• Server logs — kept for up to 90 days for debugging and abuse prevention, then rotated.

Your rights

Regardless of where you live, you can:

• Access the data we hold about you.
• Correct inaccuracies in your profile (most fields are editable in your account settings).
• Delete your account and associated data. Email us; we acknowledge within 7 days and complete deletion within 30.
• Export your data in a portable format on request.
• Object or restrict certain processing (e.g., product update emails — every one has an unsubscribe link).

To exercise any of these, email founder@fedrange.com from the address on file. California, Colorado, and EU residents have additional rights under applicable laws (CCPA/CPRA, CPA, GDPR) — we honor them.

Security

Connections are TLS-encrypted end-to-end. Database access is gated by row-level security tied to your authenticated identity. Passwords are stored using the bcrypt-style hashing Supabase Auth provides.

No system is perfectly secure. If you suspect your account is compromised, email founder@fedrange.com immediately.

Changes to this policy

Material changes will be announced by email to account holders at least 14 days before they take effect. The effective date at the top of this page always reflects the current version.

Contact

Questions, complaints, or requests: founder@fedrange.com. Mailing address available on request.