Privacy Policy

Last updated: August 21, 2026

This policy explains what data we collect when you use Side Hustle Garden (the "Service"), why we collect it, who we share it with, and what choices you have. Throughout this policy, "we," "us," and "our" refer to Jen Built It LLC.

1. What we collect

• Account data. Your email address and a salted PBKDF2 hash of your password (100,000 iterations, per-user random salt, SHA-256). We never store your password in plain text and never see it again after you set it. We also store when your account was created, when you last signed in, and whether your email has been verified.
• Bills. The bills you plant in your garden (name, amount, type, whether it repeats, whether it is archived, the month it starts), plus any month-specific amount you override for a given bill.
• Payments. The side income you record (source name, amount, the month it belongs to, the pay date, and which bills you watered with it).
• Settings. Your monthly income goal.
• Session data. The identifier of any session you have signed out of, so a revoked session cannot be replayed.
• Security data. A bounded record of failed login attempts and rate-limit counters, keyed by IP address or email address, used solely to throttle abuse. Password-reset and email-verification tokens are stored as SHA-256 hashes so a database snapshot leak cannot directly compromise a pending reset.
• Cross-app Pro status. If you upgrade to Pro on Jen's App Hub, this Service receives a signed token from App Hub that confirms your Pro status and your email. We do not receive your Stripe payment details. Card numbers, CVV, and other payment data stay with Stripe and App Hub.
• Newsletter consent. Side Hustle Garden does not offer a newsletter sign-up and we do not send marketing email. Your account record can carry a newsletter-consent flag, but it stays off unless you explicitly opt in somewhere that we add one in the future.

We do not run analytics on your income and bill data, and we do not read it for any purpose other than showing it back to you.

2. Why we collect it

• To create and secure your account (legal basis: contract).
• To store the bills, payments, and goals you ask us to store (legal basis: contract).
• To recognize you across the Jen Built It app family when you have a Pro subscription (legal basis: contract).
• To prevent brute-force login, credential stuffing, and abuse (legal basis: legitimate interest).
• To send you transactional emails (email verification, password reset) (legal basis: contract).

3. Who we share it with (processors)

We use a small set of vendors to operate the Service. Each vendor only receives the minimum data they need.

• Cloudflare hosts the Service and our database (Cloudflare Workers + D1).
• Resend sends transactional email: email verification and password reset.
• Jen's App Hub issues a signed Pro entitlement token that this Service checks with App Hub to grant Pro features. App Hub itself uses Stripe for payment processing; Stripe never communicates directly with Side Hustle Garden.
• Our own n8n automation server (self-hosted, operated by Jen Built It LLC) receives three things: a signup notification carrying your email address and your newsletter-consent flag, used by Jen to track signups and, only if you consented, to add you to the newsletter list (the endpoint is authenticated with a shared secret); server-error beacons, which contain only the request path, HTTP method, status code, and error message and never any account data; and, if you ask us for a progress recap by email, a read-only summary of your totals for the period you requested.
• Feedback button: if you use the in-app Feedback button, your message, the page you were on, your browser's user-agent string and, if you choose to enter it, your email address are sent to that same n8n server and emailed to Jen. Nothing is sent unless you press Send.

We do not sell your personal data. We do not share your data with advertisers. We do not transfer your data to third parties for their own marketing.

4. How long we keep your data

• Account, bills, payments, and settings: as long as your account exists. When you delete your account, we delete every row tied to your user ID (user, bills, monthly amounts, payments, settings, revoked sessions, reset tokens, email-verification tokens, and your failed-login record) immediately and irrevocably.
• Security data (failed-login counters, rate-limit rows): purged automatically once the window they belong to has passed.

5. Cookies and local storage

We use a token in browser localStorage to keep you logged in, plus a Pro entitlement token and a short-lived cached copy of your Pro status if you have Pro. We also store small interface flags in your browser, such as whether you have seen the welcome screen. We do not use advertising cookies, third-party tracking pixels, or cross-site analytics.

6. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to:

• Access the personal data we hold about you. Sign in, open the Privacy Policy panel in the app, and use Download my data to get a JSON file with every bill, payment, monthly amount, and setting on your account. A CSV export is also available from the app.
• Correct inaccurate data (edit your bills, payments, goal, or email).
• Delete your account and all your data (Account settings → Delete my account). You will be asked for your current password, or for App Hub re-verification if your account signs in through the hub. Deletion is immediate and we cannot undo it.
• Lodge a complaint with your local data protection authority.

For anything that requires our help (CCPA right-to-know, GDPR Article 15 statement, dispute over a deletion), email privacy@jenbuiltit.com from the address tied to your account. We respond within 30 days (45 days for California requests).

7. Security

We protect your data using TLS in transit (HSTS), salted PBKDF2 password hashing, parameterized SQL with per-user row filtering, signed JWT sessions with server-side revocation, throttling after repeated failed logins, request body size caps, per-IP and per-account rate limiting, and a strict Content Security Policy. No system is perfectly secure, but if we detect a breach affecting your data we will notify you and the appropriate authorities as required by law.

8. Affiliate links

The Service shows occasional tips and resources, and some of those links are affiliate links, labeled as such where they appear. If you follow one and sign up, Jen Built It LLC may earn a commission at no extra cost to you. Following an affiliate link takes you to a third party's site, where that party's own privacy policy and cookies apply. We do not send your account data to those sites, and we do not receive personal data back from them.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has created an account, email privacy@jenbuiltit.com and we will delete it.

10. International users

The Service is operated from the United States. By using the Service from outside the US, you consent to the transfer of your data to the US. We rely on Standard Contractual Clauses or equivalent safeguards with our sub-processors where required.

11. California residents

If you are a California resident, you have the rights described in Section 6 above (right to know, delete, correct) under the CCPA/CPRA. You also have the right to opt out of the sale or sharing of your personal information. We do not sell or share personal information for cross-context behavioral advertising; see our Do Not Sell or Share My Personal Information page for the formal statement.

12. Cross-app Pro verification

If you have a Pro subscription on Jen's App Hub, this Service receives a signed JWT containing only your email and your Pro expiration date. We check that token with App Hub's verification endpoint; the signing secret never lives on this Service. No payment details, no profile data beyond email, and no usage data from other Jen Built It apps is shared with this Service.

13. Changes to this policy

If we update this policy in a way that materially changes how we handle your data, we will notify you by email and post a notice on the Service. The "Last updated" date at the top will always reflect the current version.

14. Contact

Questions about this policy or your data:

Jen Built It LLC
10800 S Lloyd Drive
Worth, IL 60482
USA
privacy@jenbuiltit.com

Terms of Service · Accessibility · Do Not Sell My Info · Become an affiliate