Privacy Policy

Scope and contact

Money Pitfalls operates from Sweden. This policy covers the store, booklet and interest forms, optional live sessions, one-time checkout, invite-only courses, accounts, and support. Send privacy questions or requests to support@moneypitfalls.app.

Free bookings and future updates

The updates form stores only your normalized email, language and consent evidence in Firestore. Booking forms additionally store your name, description and optional LinkedIn profile. Bookings also store the chosen UTC time, your timezone, calendar reference and confirmation delivery state. Google Calendar/Meet handles invitations and calls; Resend sends booking confirmations to you and Hamid. Booking does not subscribe you to marketing. The separate email signup records your request for future product and newsletter emails. Duplicate signups are kept as one contact and do not notify Hamid repeatedly. You can request correction, deletion or withdrawal by emailing support@moneypitfalls.app from your signup address; no account is needed. Booking details are removed from this app 90 days after the session, unless a support request needs them longer; Google Calendar retains the event until removed separately. We keep the updates contact until you withdraw or it is no longer needed.

Data we collect

We collect the minimum data needed to provide and secure the service.

• Contact data, such as your normalized email, preferred language, the specific resource or waitlist you requested, where the request came from, and delivery status.
• Account data, such as Firebase user ID, email, display name, role, product access, and account timestamps.
• One-time purchase and session data, such as the offer, amount, currency, payment and refund references, checkout email, scheduling choice, and fulfilment status.
• Course data, such as course and purchase references, checkout or invited email, preferred language, access source and status, invitation attempts and delivery state, Firebase user ID after first access, and last course access time. Raw passwordless links and Stream playback tokens are not stored.
• Security and operational data, such as App Check results, rate-limit identifiers, error metadata, and admin or privacy audit records.

How we use data

We use data to run the store, send a resource you requested, remember a specific interest, process one-time payments and refunds, arrange sessions, grant and secure course access, answer support, prevent abuse, and meet accounting or legal duties. We do not sell personal data.

Email and consent

Entering your email for the booklet is a one-field request to receive that booklet; it does not subscribe you to a newsletter. The future-updates form has a separate explicit signup for future product updates and the newsletter. Money Pitfalls is the contact source of truth. The separate Utils app may capture an email inside an Instagram DM workflow, but it forwards only the email, language, named purpose, consent time, and an idempotency key. Resend handles delivery and any future consented broadcasts. Provider opt-outs are respected and not silently reversed.

Payments, sessions, and course access

Stripe processes one-time checkout and payment information. Money Pitfalls does not offer recurring subscriptions. If you buy a session, scheduling may use Google Calendar and Google Meet. Invite-only courses use Firebase passwordless authentication to verify the enrolled email and Cloudflare Stream to process and securely deliver video. Stream receives technical playback requests such as IP address, device/browser data, requested video, and timing according to its service operation and policies.

Providers and international transfers

Current providers may include Firebase and Google Cloud for hosting, authentication, database, security and storage; Cloudflare Stream for course video processing and delivery; Stripe for one-time payments and refunds; Resend for email; and Google Calendar or Meet for enabled sessions. The internal Money Pitfalls Utils app keeps Instagram workflow diagnostics in its own Firebase project. Some providers process data outside Sweden or the EU/EEA using their applicable safeguards.

Retention

We keep a contact while its requested delivery, interest, consent, suppression, customer relationship, or rights obligation still needs it. Course enrollment is kept while access is active and for a documented support, refund, dispute, or legal period afterward; raw invitation links and playback tokens are not retained. Short-lived delivery links and unpaid session holds expire. Purchase records may remain longer for accounting, tax, refunds, disputes, fraud prevention, or legal claims. Historical personal data from retired features remains covered by account export and deletion while its retention is reviewed.

Your controls and rights

If you have an account, Profile can export or delete matching app data, including the audience contact and course enrollments for the same email. If you only used the booklet form or Instagram DM, email support@moneypitfalls.app from the address concerned. You may ask for access, correction, deletion, portability, restriction, objection, or consent withdrawal, and may complain to a regulator such as Sweden's IMY. Limited payment, legal, security, or suppression records may need to remain.

Security, children, and changes

We use authentication, server-side authorization, Firestore rules, App Check where configured, rate limits, minimized logs, and provider encryption. No internet service is risk-free. Money Pitfalls is not designed for children who cannot lawfully enter a service agreement. We will update this notice when products, providers, or legal requirements materially change.