Privacy Policy for Bid as Filed

Last Updated: October 2, 2026

This Privacy Policy explains what information RAINIER CAPITAL LLC ("we," "us," or "our") collects when you use Bid as Filed at https://bidasfiled.com (the "Service"), how we use it, who we share it with, and what choices you have. By using the Service you agree to this Policy.

1. Information We Collect

We collect the minimum information needed to run the Service.

1.1 Information you give us
- Account profile. When you sign in with Google, we receive your name, email address, and profile image from Google. When you sign in with a magic-link email, we record the email address you provide so we can send the link and identify your account on subsequent sign-ins. We store this in our database to identify your account.
- Pilot profile. Your seniority percentile (per base and fleet) and the scoring preferences, saved presets, selections, and notes you create inside the Service.
- Assistant messages. If you use the in-app bid assistant, we receive the questions you type and a small snapshot of the trip you are looking at (fleet/month, selected or hovered pairing, slider names, and Cascade status). We do not send the full scoring matrix or application source code.
- Payment information. When you start a subscription, our payment processor, Stripe, collects your billing details and card data directly. We do not see or store your full card number. We do store the Stripe customer ID and the Stripe price/subscription ID associated with your account so we can grant access and open the billing portal for you.
- Support correspondence. If you email support@bidasfiled.com, we keep that message and our response so we can help you.

1.2 Information collected automatically
- Cookies and local storage. We use a small number of first-party cookies and browser localStorage entries. These are used to keep you signed in (the NextAuth session cookie), remember UI preferences (for example, which side panels are open, which scoring preset was last active per base/fleet/month, and the last position of the bid-assistant window), and to remember a referral code if you arrived from a referral link. A random browser id (baf_vid) and, when you arrive from an ad or post link, the campaign parameters (baf_utm) are stored for 30 days so homepage and referral counts can tell the same browser apart from a different one. Those cookies do not contain your name or email.
- Advertising and measurement cookies. We use the Meta Pixel to measure the effectiveness of advertising campaigns. The pixel sets two first-party cookies on bidasfiled.com -- "_fbp" (a random per-browser identifier) and "_fbc" (the click ID from a Meta ad you arrived from). These cookies do not contain your name, email, or any directly identifying information. We also send a server-to-server event to Meta when you take key actions (visit the landing page, click a trial CTA, sign up, start a trial, or convert from trial to a paid subscription) so that ad blockers do not break our attribution. The data sent server-to-server includes a SHA-256 hash of your email and a SHA-256 hash of your account ID, your IP address, your user-agent, and the cookie values above. Hashing is irreversible -- Meta cannot recover your email or account ID from these hashes; they are used only to match you to a prior ad interaction.
- Referral attribution. If you visit the site with a "?ref=" code in the URL, or you open a referral short link at /r/CODE, we store that code in a first-party cookie for 30 days so we can credit the referring user if you later start a trial. We also store the code when you create an account, so a signup that does not enter a card is still counted.
- Server logs. Our hosting provider keeps standard request logs (IP address, user agent, timestamp, URL) for debugging and abuse prevention. We do not use these logs to profile you.
- Tour progress. If you start a tour, we store how far that walk got (the step id, and whether it finished or was skipped). Signed-out walks are not tied to a name or email. Signed-in walks are stored with your account id so we can tell them apart from signed-out walks. We use this only to see if the tour is useful.
- Feature use. We record whether you moved a scoring slider, saved or reloaded a scoring engine, marked a day off, added a Prefer Off, selected a trip, opened Selected Trips, opened the emulator, opened Print, printed, set seniority, opened a reasons report, looked at another reasons line, turned on Multiple Bids, or ran Optimize Order. Counts are grouped by bid month. Signed-out counts are not tied to a name or email. Signed-in counts are stored with your account id so the same person is counted once per month.
- Homepage funnel. We count homepage visits, sign-in page visits, clicks on the homepage trial, tutorial, tour, login, and tutorials controls, and opens of a referral short link (/r/CODE). Counts use the random browser id above, not your name. If that browser later creates an account or starts a trial, we store the account id on those later counts. Campaign parameters from the link you followed (utm_source, utm_medium, utm_campaign) are stored with the visit. These counts stay in our database and are not sent to Meta. An aggregate copy of the event name, the button, and the campaign parameter is also sent to Vercel Web Analytics. The referral code itself is not sent to Vercel.
- Assistant questions. The question text you type to the bid assistant is stored. Signed-in questions are stored with your account id and may be reviewed to see what is confusing. Signed-out questions are stored without a name or email. These questions are not sent to advertising tools.

2. How We Use Your Information

We use your information only to:
- authenticate you and keep you signed in;
- provide the Service (rank trips, save presets, print your bid, etc.);
- generate a reply from the bid assistant when you ask a question;
- process payments, manage subscriptions, and apply referral credits;
- respond to support requests you send us;
- detect, prevent, and address fraud, abuse, or security issues;
- see how far tours get, so we can tell if that walkthrough is worth keeping;
- see which features get used, and review assistant questions, so we can tell what is confusing;
- see which homepage actions and referral links lead to an account or a trial;
- comply with legal obligations.

We do not use your data to train machine-learning models, and we do not allow the bid-assistant provider to train on your assistant traffic. We do not sell or rent your personal information to anyone.

3. Who We Share Information With

We share information only with service providers that help us run the Service, and only as needed for them to perform their job. These sub-processors are:
- Google (sign-in / OAuth). When you choose to sign in with Google, Google authenticates you and provides your basic profile to us.
- Stripe, Inc. (payments). Collects and stores your payment method, charges your card, manages subscriptions, and receives referral metadata so we can credit the right user.
- MongoDB Atlas (database). Stores your account profile, preferences, subscription state, and homepage funnel counts on our behalf.
- Vercel (hosting and analytics). Hosts the website and runs our server code; receives request logs. Vercel Web Analytics also receives page views plus the homepage funnel event names described in section 1.2 (which button, which campaign parameter). It does not receive your referral code or email.
- Resend (transactional email). Sends magic-link sign-in emails and other account-related emails on our behalf.
- Meta Platforms, Inc. (advertising measurement). Receives the hashed-email, hashed-account-ID, IP address, user-agent, and pixel cookies described in section 1.2 when you visit the landing page, click a trial CTA, sign up, start a trial, or convert from trial to a paid subscription. Used solely to measure ad campaign effectiveness.
- xAI (bid assistant). When you send a message to the assistant, we send that message plus the workspace snapshot described in section 1.1 to xAI so it can generate a reply. xAI is instructed not to use API traffic to train its models. We do not enable xAI web search, X search, or code interpreter.

We may also disclose information if we are legally required to (for example, in response to a valid subpoena), or to protect the rights, property, or safety of our users or the public.

4. Where Data Is Stored

Data is stored in the United States by our cloud providers. If you access the Service from outside the United States, you understand that your data will be processed in the United States.

5. How Long We Keep It

We keep your account data for as long as your account exists. If you delete your account, we remove your profile and preferences within 30 days, except where we must retain certain records (for example, invoice and tax records associated with paid subscriptions) to comply with the law. Stripe retains payment records according to its own retention policy.

6. Your Choices and Rights

- You can view and edit most of your information inside the Service.
- You can cancel your subscription at any time through the billing portal linked on your account page.
- You can request account deletion, a copy of your data, or correction of your data by emailing support@bidasfiled.com. We aim to respond within 30 days.
- You can clear site cookies and localStorage from your browser at any time; the Service may stop working correctly until you sign in again.
- You can opt out of personalized advertising by adjusting your settings in Meta's Ad Preferences (https://www.facebook.com/adpreferences), by clearing the "_fbp" and "_fbc" cookies in your browser, or by using browser-level Do Not Track / tracking-protection features. Opting out does not turn off the Service.
- Depending on where you live, you may have additional rights under laws like the CCPA (California) or GDPR (EU/UK). We will honor valid requests under those laws. Email support@bidasfiled.com to exercise them.

7. Security

We use reasonable administrative and technical safeguards: encrypted connections (HTTPS everywhere), role-based access to production data, and industry-standard hosting providers. No system is perfectly secure, and we cannot guarantee absolute security, but we work to keep your data safe.

8. Children

The Service is for professional pilots and not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact support@bidasfiled.com and we will delete it.

9. Third-Party Links

The Service may contain links to third-party sites (for example, Stripe's billing portal). This Policy does not cover those sites. Please review their policies before providing them any information.

10. Changes to This Policy

If we make a material change to this Policy, we will post the updated Policy at https://bidasfiled.com/privacy-policy and update the "Last Updated" date above. For significant changes, we will also notify you by email.

11. Contact

Questions, requests, or complaints about this Policy or your data? Email support@bidasfiled.com.

RAINIER CAPITAL LLC
Washington, USA