Privacy Policy

1. What We Collect

Styx collects only the data you provide directly:

• Account information: email address, optional display name, and password (hashed, never stored in plain text).
• Planning data: checklist entries, contacts, assets, documents, and notes you create within the app.
• Cookies: authentication tokens (httpOnly, not accessible to JavaScript) and an optional guest-mode preference cookie. No analytics or tracking cookies are used.

2. How Your Data Is Stored

• Guest mode (no account):all data stays in your browser's local storage. Nothing is sent to our servers. You can optionally encrypt local data with a PIN using AES-256-GCM encryption.
• Authenticated mode: data is synced to our servers and stored in a PostgreSQL database. 22 personally identifiable fields (names, addresses, account numbers, etc.) are encrypted at rest using field-level encryption (Fernet/AES).
• Passwordsare hashed using Django's default PBKDF2 algorithm and are never stored or transmitted in plain text.

3. Who Can Access Your Data

Only you can access your planning data. All API requests are scoped to your account — one user cannot see another user's data. Styx administrators have read-only access to the database for operational purposes but cannot decrypt your encrypted fields without the encryption key.

4. Third-Party Services

Styx uses the following third-party services to operate:

• Railway — hosts the backend API and PostgreSQL database.
• Vercel — hosts the frontend application.
• Resend — delivers transactional emails (magic link login). Only your email address is shared with Resend for this purpose.

We do not sell, share, or provide your data to any other third parties. We do not use analytics or advertising services.

5. Data Retention

Your data is retained for as long as your account exists. If you delete your account (available on your Account page), all associated data — your plan, checklist entries, contacts, assets, and documents — is permanently and irreversibly deleted from our servers.

6. Your Rights

• Export: you can download all your data as a portable backup file at any time from the Settings page, and load it back in later. You can also ask us to email you a copy when you delete your account.
• Delete: you can delete your entire account from your Account page. Your plan, checklist entries, contacts, assets, documents, and reminders are permanently and irreversibly removed from our servers. Deletion happens as soon as you confirm it — except for accounts that sign in without a password, where we first email you a confirmation link and delete nothing until you open it. Two things outlive the account: records of any payment you made, which we keep for financial recordkeeping, and — if someone invited you to view their plan — your email address on their invitation record.
• Local-only use: you can use Styx in guest mode without creating an account. No data leaves your browser.

7. Security Measures

• All connections use HTTPS/TLS encryption in transit.
• Authentication tokens are stored in httpOnly, Secure, SameSite=Strict cookies.
• Access tokens expire after 15 minutes; refresh tokens after 3 days.
• Rate limiting is enforced on all authentication endpoints.
• Content Security Policy, X-Frame-Options, and Referrer-Policy headers are set on all responses.

8. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of Styx after changes constitutes acceptance of the updated policy.

9. Contact

If you have questions about this privacy policy or your data, please open an issue on our GitHub repository.