Privacy Policy
Version 2026-11-01. Effective Nov 1, 2026. Top Performer LLC, doing business as you vs..
Short version: we collect as little as we can, we never sell your data, and we share nothing for advertising. The first name you type on this site stays on your device.
Who we are
Top Performer LLC, doing business as you vs., is the controller of your personal data. Contact: help@topperformer.ai.
What we collect and why
| Data | Why | How long |
|---|---|---|
| Email you type into the optional "email me when it opens" box | To send one note when paid access opens | Until that note is sent plus 30 days, or until you unsubscribe |
| Email and login identifiers (once accounts open) | Sign-in, receipts, account recovery | Until you delete your account |
| First name (optional), exam dates, chosen exams (in the app) | Personalizing the app and your study plan | Until you delete your account |
| Drill answers, timings, miss tags, belts, streaks (in the app) | Scheduling reviews and showing progress | Until you delete your account |
| Purchase records (pass, amount, tax, payment ids) | Fulfillment, tax and chargeback records | 7 years; unlinked from you when you delete your account |
| Score-report screenshot for a promise claim (blacked out on your device first) | Checking the claim | Deleted when we decide, always within 7 days |
| Your network address, salted and hashed (never the raw IP address) | Limiting how often one network can use the email box, to stop abuse | Deleted within 2 days; the hash changes every day |
| Product analytics events | Understanding which pages and drills work | Per PostHog plan; deleted with your account |
| Error reports | Fixing crashes | 30 days |
Not collected: date of birth, SSN, CRD numbers, employer, precise location, contacts or advertising ids.
On this device only
The free demo stores a few things in your browser's local storage. They never reach our servers:
youvs.name: the first name you typed, so the page can say your name.youvs.themeandyouvs.sound: your theme and sound choices.yv_first_touch: for 30 days, which link or campaign first brought you here (no id, no name).
Analytics
We use PostHog Cloud (US) for product analytics through a proxy run on Cloudflare. On public pages it sets no cookies and writes no local storage, and builds no profile of you. We send events like "started the demo" or "answered a question". We never send your name, email, anything you type, or question text. The free demo may record masked session replays (every input is hidden) to help us fix confusing screens. Your browser's Global Privacy Control signal turns analytics off. There are no ad pixels and no cookie banner, because there is no tracking to consent to.
Who processes data for us
| Company | Purpose | Data |
|---|---|---|
| Vercel | Hosting | Requests, IP address (transient) |
| Supabase | Database, login, file storage | Account and study data, claim screenshots (7 days max) |
| Stripe | Payments and sales tax | Payment and billing details |
| Apple | App Store purchases and Sign in with Apple (iOS app only) | Transaction ids, Apple user id, relay or real email; no card data reaches us |
| Resend | Login codes, receipts, product emails | Email address |
| PostHog | Product analytics | Pseudonymous events, user id in the app, masked session replays of the free demo |
| Cloudflare | Runs PostHog's managed proxy; stores our encrypted database backups | Requests in transit; encrypted backups |
| Sentry | Error reports | Error details, opaque user id |
No sale, no ad sharing
We do not sell personal data and do not share it for targeted advertising.
Your choices
- Every email we send has a one-click unsubscribe link that works without signing in.
- You can ask to see, export, correct or delete your data, wherever you live.
- Once accounts open, Settings has "Download my data" and "Delete account". You can also email us from your account address; we act only after you prove you control that address.
What we keep after deletion
Purchase and tax records and the record that you accepted our terms (unlinked from you), and a hashed record of the deletion so a backup restore cannot bring your data back. Backups roll off within 30 days.
Security and breaches
Data is protected with row-level access rules, encrypted connections and multi-factor sign-in on every admin account. If a breach affects you, we will tell you as fast as we can and within 30 days, as Florida law requires.
Children
The service is for people 18 and older. If we learn a user is under 13, we delete the account.
Changes
We will post changes here with a new version date and tell account holders about material changes. See also our Terms.