Privacy Policy

Last updated: August 17, 2026

This Privacy Policy explains how ExpatWires (“we”, “us”, “our”) collects, uses, stores, and protects information when you use this website and its verified free Member accounts.

Information we collect

Member profile — when you register for a free Member account, we store your name, email address, email-verification status, signup source, and account timestamps. Member access requires email verification. We store a one-way password hash rather than your plain-text password.

Authentication and session metadata — we process credential-account identifiers, session tokens and expiry times, IP address, browser or user-agent information, and account and session timestamps so you can sign in securely. For email verification and password recovery, we store expiring, one-time challenge digests and status; redirect paths; security rate-limit digests and counters; and Contact Claim outcomes. Verification and recovery emails contain one-time links.

Subscriber and Sequence information — we store your email address, signup source, subscription or unsubscribe status, and welcome-email Sequence state and transition history. A verified account may be linked to a matching older Contact record only through the verified Contact Claim process.

Library saves — we store the guides, checklists, and other items you choose to save, together with when they were added and the Member account that owns them.

Tool results and interactions — when you save a City Match or another supported result, we store the answers or result data, scores, time, and Member or Contact link needed to show it to you. Some tools also send bounded interaction events such as the tool name, action, pseudonymous browser-session identifier, and event data so we can operate and improve the tools. A pseudonymous tool-session identifier may be kept in browser session storage.

Operational and security data — Cloudflare and our application may process request metadata such as IP address, browser type, requested pages, timestamps, security and rate-limit events, and generic application error or access-denial events. We use this data to deliver the site, prevent abuse, diagnose failures, protect accounts, and measure aggregate feature use.

We do not sell personal data. The production-free release does not ask for phone numbers or physical addresses and does not actively collect payment or social-media provider details through its enabled account flows.

How we use information

  • Provide and secure free accounts — register and verify Members, maintain sessions, support sign-in and password recovery, prevent abuse, and connect an eligible legacy Contact through verified Contact Claim.
  • Provide Member features — display your profile, Library saves, protected resources, and saved tool results.
  • Send requested and subscribed email — deliver verification and password-recovery messages, the welcome Sequence, quiz-related messages, and the newsletter. You can unsubscribe from marketing email at any time.
  • Operate and improve ExpatWires — troubleshoot failures, monitor security, understand aggregate use, and improve content and tools.
  • Meet applicable obligations — preserve limited records where needed for security, fraud prevention, compliance, or dispute handling.

Infrastructure and service providers

  • Cloudflare Workers hosts and runs the site at the edge and may process request and security metadata under Cloudflare’s Privacy Policy.
  • Cloudflare D1 is the active database for Member profiles, credential and session metadata, verification and recovery records, Contacts, email Sequence history, Library saves, saved tool results, tool interactions, and related operational records.
  • Cloudflare KV is bound as preserved runtime infrastructure, including compatibility aliases to the same production namespace. The production-free candidate’s active account, session, Library, and tool data model uses D1; we do not treat KV as the active source for those records. Preserved historical runtime entries may remain until their approved operational retention or disposition is completed.
  • Resend delivers account verification, password recovery, welcome-Sequence, quiz, and newsletter email. It processes recipients, audience and Sequence properties, delivery details, and message content needed for those services under Resend’s Privacy Policy.

Cloudflare and Resend may process data in locations outside your country as part of providing their services.

Cookies and browser storage

We use essential account cookies to maintain authenticated sessions. Some tools use browser session storage for a pseudonymous interaction identifier. We do not use third-party advertising cookies. Rejecting or clearing essential account storage may sign you out or prevent an account feature from working.

Retention and deletion

  • Member profiles, Library saves, and saved tool results are retained while your account remains active, subject to any shorter period below. They are deleted or anonymized within 30 days of a verified deletion request.
  • Individual quiz results are retained for up to 12 months, then deleted or anonymized.
  • Your email remains in the active subscriber audience until you unsubscribe. Unsubscribing removes you from active marketing mailings and records the unsubscribe so it can be honored; it does not by itself delete your Member account, Library, saved results, or every operational record.
  • Sessions, verification and password-recovery challenges, and security rate-limit records expire or are superseded as part of account and security operations. Operational and infrastructure logs are kept for limited periods appropriate to security, reliability, and troubleshooting.
  • Preserved historical or backup records are not used to reactivate disabled features. They are restricted and expire, are deleted, or are anonymized under the applicable preservation and backup lifecycle.

The deletion commitments above do not require us to erase records we are legally required to retain for security, fraud prevention, compliance, dispute handling, or other applicable legal obligations. We restrict retained exceptions to those purposes and remove or anonymize them when the obligation ends.

Your rights and requests

You may request access to, correction of, or deletion of personal data we hold about you. To make a request, email support@expatwires.com from the email address associated with your account or subscription and describe the request. If you cannot use that address, explain why and provide enough information for us to locate the record without sending a password or one-time link.

To protect Members and subscribers, we will verify that you control the account or email address before disclosing, changing, deleting, or exporting personal data. We may ask you to confirm through the associated inbox, an authenticated session, or other proportionate information. There is currently no automated deletion or export control in the Member interface; support handles these requests. We will respond within 30 days.

An unsubscribe link is available in marketing email. Unsubscribe is the correct request to stop marketing messages, but it is separate from an account or personal-data deletion request.

Features not active in the production-free release

The initial production-free release does not provide active paid membership, Stripe checkout or payment processing, Founders purchases, billing or subscriptions, organizations, Slack actions, Facebook join, or social-login providers. It does not create new records through those disabled surfaces, even if private source code, database tables, configuration, or historical records from earlier operation are preserved.

Historical paid, Stripe, Founders, billing, organization, Slack, provider, or related audit records may remain where preservation is required for security, fraud prevention, compliance, dispute handling, or applicable legal obligations. Their preservation does not mean those features are active, and we do not use them to claim an active paid service in this release.

Children

This site is not directed at children under 13. We do not knowingly collect personal data from children under 13.

Changes to this policy

We may update this policy periodically. Material changes will be noted with an updated “Last updated” date at the top of this page.

Contact

Questions or privacy requests: support@expatwires.com