Privacy Policy

Last updated: July 18, 2026

This policy explains what information OttieBox ("we", "us") collects when you use ottiebox.com and the OttieBox learning app, and what we do with it. OttieBox is an educational product for adults learning about money. It is not financial advice.

The short version: we collect very little, we never sell or rent your data, we honor the Global Privacy Control signal, and you can ask us to delete everything at any time.

What we collect

Account info. When you save your progress, we store your email address and a user ID. You can start learning without an account; we create an anonymous account so your first lessons are saved on your device.
Learning activity. Lessons completed, experience points, streaks, and practice-simulator activity (all using fake, simulated money) so we can save and show your progress.
Payment info. If you subscribe, payments are processed by Stripe. We do not see or store your full card number. We store a Stripe customer ID and your subscription status.
Usage analytics. We use analytics to understand which pages and lessons people use. This includes a cookie or device identifier, approximate location from your IP address, pages viewed, and how you found us (such as the referring site or ad campaign).

We do not collect your Social Security number, your bank or brokerage logins, your account balances, or any real financial account information. OttieBox teaches with simulated money, so we never need it.

How we use it

To run the product: save your progress, manage your account and subscription, and provide the practice simulator.
To improve the product: understand what learners find useful and where they get stuck.
To communicate with you: send account and product emails you have asked for. You can unsubscribe from non-essential emails at any time.
To measure our advertising: understand which ads bring people to OttieBox so we don't waste money on ones that don't.

Service providers we share data with

We do not sell or rent your personal information. We use trusted third parties to run OttieBox, and each only receives the data needed to do its job:

Supabase: database and account storage.
Vercel: website and app hosting.
Stripe: payment processing and billing.
Resend: sending account and lesson emails.
Google Analytics and Google Ads: usage measurement and advertising measurement.
Mixpanel: product analytics, so we can see which lessons help.
Reddit and Meta advertising pixels: to measure and improve the ads that bring people here.
Alpaca: market price data used to power the practice simulator. No trades are ever placed and no real money is involved.

We may also disclose information if the law requires it, or to protect the rights and safety of OttieBox and its users. If OttieBox is ever acquired, your information may transfer as part of that, and this policy would continue to govern it.

Cookies, analytics, and ads

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure usage and advertising through the providers above. Some of these help advertising platforms measure whether their ads worked. You can control cookies through your browser settings, and opt out of personalized ads through each ad platform's own controls. We honor the Global Privacy Control (GPC) signal, and we do not use session-recording or screen-replay tools.

How long we keep it

We keep your account and progress while your account is active. If you ask us to delete your account, or if it stays inactive for an extended period, we remove your personal data, except the minimum we are required to keep for legal, tax, or fraud-prevention reasons. We do not keep your data indefinitely.

How we protect it

Your data is encrypted in transit and at rest by our hosting and database providers, and every data table is protected by row-level security so accounts cannot read each other's information. Because we hold no real financial account data, the stakes here are low by design. No system is perfectly secure, but we keep the surface small on purpose.

Your choices and rights

You can ask us to access, correct, or delete your personal data, and you can close your account at any time. To make a request, email hello@ottiebox.com. If your browser sends a Global Privacy Control signal, we honor it. Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR.

Children

OttieBox is a general-audience service made for adults. It is not directed to children, and you must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us their information, email us and we will delete it.

Changes

We may update this policy. If we make a material change, we will update the date above and, where appropriate, let you know.

Contact

Questions about privacy, or want your data deleted? Email hello@ottiebox.com.