SAMWELL

1. Introduction

Samwell ("we," "us," or "our") is a mobile application designed to help freelancers, independent contractors, and gig workers organize their tax-related information year-round. This Privacy Policy explains exactly how we collect, use, store, and protect your personal information when you use the Samwell app.

By creating an account or using the App, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the App. This App is intended for use by adults aged 18 and older in the United States.

2. Information We Collect

2.1 Account Information

When you create an account we collect only two pieces of information: your email address and your password. Your password is never stored by Samwell — it is hashed server-side by our authentication provider (Supabase) using bcrypt and we never have access to it. Supabase's infrastructure also receives your IP address and device user-agent as part of the HTTP authentication request.

2.2 Profile Information

Once you create an account you may optionally provide a display name, filing status, home office square footage, and tax year preference. This information is stored in your profile and used to personalize your experience.

2.3 Survey Responses

When you complete the Samwell onboarding survey, we store two things derived from your answers. First, your individual yes or no response to each survey question is stored, keyed by question identifier. No free-text input is collected — all survey questions are yes/no only. Second, a set of boolean tags derived from your answers (for example is_1099: true or has_home_office: true) is stored in your profile. These tags are used exclusively to personalize your checklist tasks, deduction estimates, and tax overview within the App.

2.4 Tax Estimates

Based on your survey responses we calculate and store estimated deduction amounts organized by category: home office, travel, equipment, software and technology, and a combined other category covering health insurance, retirement contributions, dependent care, charitable giving, medical expenses, education, and student loan interest. We also store your total estimated deductions, a potential savings estimate (calculated as total deductions multiplied by a flat 22% marginal rate), and an IRS readiness score (a count of deductions you said yes to). These are estimates only and are not precise tax calculations.

2.5 What Stays On Your Device vs What Goes to the Cloud

Samwell is designed with a local-first approach for sensitive financial data. The following never leaves your device: receipt images and photographs, in-progress survey state, and all UI and animation state. The following is synced to our secure cloud servers solely to enable your experience across app sessions: your account credentials (email, hashed password), profile preferences, survey yes/no responses and derived tags, estimated deduction totals by category, and checklist completion records. We do not sync raw financial account data, income figures, or any sensitive personally identifiable financial information beyond what is described in this policy.

2.6 Receipt Metadata

When you log a receipt in the Shoebox feature we collect the expense category, a rounded dollar amount (whole dollars only), an optional short description of up to 100 characters, and an optional receipt date.

2.7 Checklist Completion Records

When you check off a task in the monthly checklist we immediately store a record keyed by your user ID, tax year, month, and task identifier. This allows the App to restore your progress when you reopen it.

2.8 Session Data

When you sign in, a session token is stored on your device using local storage. This token contains your user ID, email address, account role, and token expiry timestamp. It is used solely to maintain your login session between app opens and is automatically cleared when you sign out.

2.9 What We Do NOT Collect

We explicitly do not collect, store, or process any of the following:

• Social Security Numbers or Taxpayer Identification Numbers
• Bank account numbers, routing numbers, or credit/debit card numbers
• Actual income amounts or precise financial account balances
• Receipt images or photographs — these never leave your device
• Location data — we do not collect or track your location
• Biometric data of any kind
• Device advertising identifiers
• Any data from or about children under the age of 13
• Microphone, contacts, calendar, or health data

3. How We Use Your Information

We use the information we collect solely to provide and improve the Samwell App:

• To create and manage your account and authenticate your identity
• To personalize your deduction estimates, checklist tasks, and tax overview based on your survey responses
• To restore your checklist progress and receipt history when you reopen the App
• To send account-related emails such as email verification and password reset messages
• To display your tax organization data within the App

We do not use your information for targeted advertising. We do not sell, rent, or share your personal information with any third party for marketing purposes.

4. Tax Summary Export

The App includes a Share Summary feature that generates a plain-text summary of your estimated deductions and logged receipt totals. This summary is shared via your device's native share sheet and is generated entirely on your device. No data is transmitted to Samwell's servers during this process. The exported text contains your tax year, generation date, receipt totals by category, and individual receipt line items. It does not contain your email address, user ID, or any account credentials.

5. How We Store and Protect Your Information

5.1 Data Storage and Processor

Your data is stored on servers provided by Supabase, Inc., our sole data processor. Supabase operates infrastructure in the United States. By using Samwell, you consent to the transfer and storage of your data in the United States. Supabase's privacy practices are available at https://supabase.com/privacy.

5.2 Security Measures

• Row-Level Security (RLS) enforced at the database level — each user can only access their own data
• Transport Layer Security (TLS) — all data transmitted between the App and our servers is encrypted in transit
• Bcrypt password hashing — passwords are never stored in plaintext
• JWT session tokens — access tokens automatically refresh and expire within one hour
• No service-role database keys in the client — the App uses only a public anon key

5.3 Data Retention

We retain your personal data for as long as your account is active. If you delete your account, all of your data is permanently deleted from our active database. Because Supabase maintains automated infrastructure backups, residual data may persist in encrypted backups for up to 7 days following deletion before being purged.

6. Your Rights and Choices

6.1 Access and Correction

You can view and update your profile information directly within the App at any time. For a complete data export, contact us at hello@samwell.app.

6.2 Deletion

You can permanently delete your account and all associated data at any time directly within the App by going to Profile > Delete Account. This action is immediate and irreversible. Upon deletion, all your data including profile information, survey responses, tax estimates, receipts, and checklist records is permanently removed from our systems. You may also request deletion by emailing hello@samwell.app and we will process your request within 30 days.

6.3 Data Portability

You may request a copy of your data in a portable format by contacting us at hello@samwell.app. We will respond within 30 days.

6.4 California Residents (CCPA)

California residents have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising privacy rights. Contact us at hello@samwell.app to exercise these rights.

7. Third-Party Services

Samwell uses two third-party services. Supabase, Inc. provides our database, authentication, and backend infrastructure. No other third-party services are used for data storage or processing. Resend, Inc. provides email delivery services and is used solely to send transactional emails such as account verification and password reset messages. No personal data beyond your email address is shared with Resend for this purpose. We do not use analytics tools, advertising networks, crash reporting services, or any tracking SDKs. The only outbound network traffic from the App goes to Supabase and Resend. Supabase's privacy practices are available at https://supabase.com/privacy. Resend's privacy practices are available at https://resend.com/privacy..

8. Children's Privacy

Samwell is intended for use by adults aged 18 and older. The App is not directed to children under the age of 13 and we do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will delete it immediately. Contact us at hello@samwell.app if you believe a child under 13 has used the App.

9. Not Financial or Tax Advice

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the Effective Date and notify you via email or in-app notification. Continued use after notice constitutes acceptance.

11. Contact Us