1. Privacy summary
CredBounce is local-first by default. Storm And Me LLC does not need to centrally store the contents of your private comeback profile, imported credit reports, locally extracted report text, evidence files, dispute drafts, pasted response text, Debt Autopilot balances, payoff history, or local payoff projections. If you explicitly choose CredBounce Send for one specific dispute, your browser assembles the final packet you reviewed and transmits that packet plus sender/recipient mailing addresses through CredBounce’s secure delivery gateway to the mailing provider for that mailing. The gateway is designed to process the submission without retaining the packet or addresses; the mailing provider may retain order, address, document-preview, production, and tracking information under its own terms and privacy practices. Three site forms intentionally send limited information to CredBounce: the Contact form, the UPSHIFT+ early-access form, and the Debt Autopilot+ Level 2 activation-interest form. UPSHIFT+ membership checkout is a separate Stripe-hosted payment flow.
Do not enter a full Social Security number, bank password, credit-bureau password, security answers, or other login credentials anywhere in the beta.
2. Information stored locally on your device
The app uses localStorage for structured application state such as your private profile, setup progress, goals, dispute metadata, letter drafts, and case timelines. It uses IndexedDB for files such as an imported credit report, locally extracted report text, or evidence document. In the current public beta, this content — including Debt Autopilot starting balances, current balances, strategy settings, locally recorded payment history, and payoff-cycle tracking — is intended to stay inside the browser profile on the device where you use the app.
Storm And Me LLC does not centrally store uploaded report or evidence contents by default. If you authorize CredBounce Send for a specific dispute, copies of only the evidence attached to that dispute may be merged into the final packet and transmitted with the packet for mailing. The CredBounce gateway is designed not to retain the packet or mailing addresses after the request is processed.
3. Information you submit through forms
The Contact form sends the name, email address, selected topic, message, and a source label that you provide. The UPSHIFT+ early-access form sends your email address and a source label. The Debt Autopilot+ activation-interest form sends your email address plus non-sensitive source/interest labels indicating interest in Level 2. These submissions are stored server-side in CredBounce’s private lead inbox so the team can review and respond to beta interest or support requests. The Level 2 form does not collect a funding account, creditor login, payment destination, account number, Social Security number, or payment authorization.
Do not submit Social Security numbers, bank or bureau passwords, full credit reports, identity documents, or evidence files through these forms.
4. UPSHIFT+ membership checkout
Optional CredBounce membership sign-in is handled by Supabase Auth. The membership backend stores your account identifier, email address, Stripe customer and subscription identifiers, membership status, and limited billing event records so paid access can be assigned to your verified login. Supabase handles your login credentials; CredBounce does not store plaintext passwords. Membership sign-in does not upload your browser-local credit reports, evidence, or debt-planning balances. To request account-data deletion, contact support; cancel any active Stripe subscription separately first. Some billing records may be retained where required.
UPSHIFT+ membership checkout is hosted and processed by Stripe. When you choose to purchase UPSHIFT+, Stripe may collect information required to process and administer the recurring subscription, such as your name, email address, billing information, payment method, transaction details, and subscription status under Stripe’s own terms and privacy practices.
CredBounce does not ask you to type raw payment-card data into its local financial workspace or Level 2 activation-interest form. A successful $9.99/month UPSHIFT+ membership purchase is not a bank-funding authorization or creditor-payment mandate.
5. Information a hosting provider may process
Like most websites, the hosting and network providers needed to deliver the site may process basic technical request information such as IP address, request time, browser/user-agent information, requested path, and security/operational logs. CredBounce uses Google Analytics 4 to measure page visits and limited site interactions, such as opening the free planner and successful support or interest-form submissions. Google may process page addresses, browser and device information, approximate location derived from IP addresses, and cookies or similar identifiers under its privacy terms. We do not intentionally include names, email addresses, bank or bureau credentials, imported credit reports, individual debt balances, payoff projections, evidence, or dispute drafts in analytics events. Certain public pages may also use a separate Google Ads tag for advertising measurement; these tags are not part of the private browser-local financial records.
6. Third-party services and links
When you follow a link to an outside site, you leave CredBounce. The destination site may collect information under its own privacy policy. If CredBounce Send is activated and you authorize a mailing, the selected packet and mailing addresses are transmitted to the configured print-and-mail provider so the provider can create, print, mail, and track that order. Review applicable provider terms and privacy practices before authorizing transmission.
7. Retention and deletion
Because the private workspace is stored locally by default, you control much of its retention. The Dispute Center includes an “Erase local dispute data” control for reports, evidence, dispute drafts, response text, delivery metadata, and dispute timeline data; Start Here includes a separate profile-clear control. Clearing the site/browser data can erase the broader localStorage and IndexedDB workspace. Deletion from your browser does not delete copies you independently downloaded, printed, emailed, mailed, or stored elsewhere, and it does not automatically delete an already-authorized mailing order or records retained by a mailing provider.
Contact, early-access, and Debt Autopilot+ activation-interest submissions are stored separately in the private project lead inbox and are not removed by the browser’s local erase control. If you want one of those submitted records reviewed for deletion, use the Contact page and identify the email address used for that submission.
8. Security limitations
Local browser storage reduces centralized collection risk, but it is not the same as an encrypted document vault with a dedicated authentication system. Anyone with access to your unlocked browser profile or device may be able to access local data. Keep your device secured, keep original records, and avoid using a shared/public computer for sensitive work.
9. Children
CredBounce is not intended for children. The U.S.-focused beta is intended for adults age 18 or older.
10. Policy changes and contact
This policy may change as the architecture changes, especially if account sync, centralized storage, analytics, live creditor payments, identity verification, additional mailing providers, or regulated/specialized financial partners are introduced later. CredBounce Send uses a separate, explicit per-mailing authorization and does not authorize future disputes automatically. UPSHIFT+ membership checkout is active through Stripe, but Debt Autopilot+ creditor-payment execution remains separately gated and the current beta does not collect live creditor-payment authorization. Material changes will be reflected in a revised effective date. Contact Storm And Me LLC through the Contact page.