Privacy

This page describes what the Cnario app and website actually do today, not a template. It gets updated whenever that changes.

What's collected

If you sign in, your email address — used only for magic-link authentication (Supabase Auth).

If you use the dashboard signed in, the scenarios you save: model, inputs, calculation options and results, stored server-side and readable only by your account. This is real server-side storage today, not local-only — the local-first architecture described elsewhere on this site currently applies to the anonymous /try flow, not to signed-in scenarios.

If you use /try without signing in, a random session id generated in your browser plus coarse event, segment and model labels (which onboarding step you reached, which business model you picked) — no financial figures, no email, nothing else you type.

Marketing pages only, and only after you say yes

This homepage, and only this homepage, can load Google Analytics and a session-recording tool (webvisor.xyz) — and only after you accept the cookie banner. Decline, or don't answer, and neither loads. Neither one ever loads on /try or /dashboard, regardless of that choice: nothing about how you use the calculator is sent to either tool.

Where it's stored

Supabase Inc. infrastructure. Region: Frankfurt, Germany (AWS eu-central-1).

Why we're allowed to

Account and scenario storage: performing the contract you sign in for, or our legitimate interest in running the service. Landing-page analytics and session recording: your consent, and only your consent — withdraw it any time by clearing the banner's choice in your browser. Anonymous /try funnel events: legitimate interest in understanding an aggregate, unidentifiable flow — no cookies, no personal data, no consent required for this one specifically.

How long we keep it

Until you delete it, or ask us to. There is no automatic expiry job today, so none is claimed here.

Deleting it

Individual scenarios: delete them yourself from the dashboard, any time. Your whole account: there is no self-service option for this yet. Email hi@cnario.me and we'll handle it by hand.

Who else touches it

Supabase (database and authentication), Vercel (hosting), and — on marketing pages, after consent only — Google Analytics and webvisor.xyz. webvisor.xyz's domain doesn't match Yandex's real tracker domain, so we can't yet confirm who actually operates it or what data-processing terms apply; we're disclosing that plainly rather than implying a vendor relationship we haven't verified.