Draft, pending counsel review. This page describes how Dry Run Ready works today and may change after legal review.
Legal
Privacy Policy
Last updated
01Who we are
Airworthy Advisory LLC operates Dry Run Ready and is responsible for the personal data described here. Contact: dryrun@airworthyadvisory.com. This policy is a draft pending review by counsel.
02What we collect and where it is kept
Everything below is stored in the Dry Run Ready database on Lovable Cloud, which runs on Supabase, unless the row says otherwise. Nothing is deleted automatically; "until you ask" means until you delete it in the app where a control exists, or email us.
| Data | Where it is stored | How long |
|---|---|---|
| Account: email address, password (hashed by the authentication service), sign-in times | Supabase Auth | Until you ask us to close the account |
| Profile: first and last name, if you enter them | profiles table | Until you change or remove them, or close the account |
| Organization: name, size, industry, description, plan, next exercise date, report brand name, consultant name and firm, logo file, Telegram chat ID, US zip code and the county, state and forecast zones derived from it, cached weather alerts | organizations table; the logo in a private storage bucket served by one-hour signed links | Until you edit or delete the organization, or close the account |
| Exercise: scenario, the organization details you typed, the full transcript (typed answers, and spoken answers as text), scores and rationales, readiness score, playbook and its later editions, corrective actions, language, jurisdiction, timings | drills, playbook_versions and improvement_actions tables | Until you ask. Exercises started without an account are addressed by their link and are kept the same way |
| A SHA-256 hash of your network address when a drill starts, used to limit drills to ten per hour | drills table | Kept with the drill; the plain address is never stored |
| Email you give for a report: the address, when the report and reminder were sent, an unsubscribe token | drills table | Until you unsubscribe or ask. A reminder is sent 90 days after the exercise only if you asked for one |
| Email addresses you invite as organization viewers or drill participants, and their role labels | organization_shares and drill_participants tables | Until you remove them |
| Public report links: a random token for one exercise | report_links table | Until you revoke the link |
| Plan interest: organization name, email, plan, message | plan_interest table | Until deleted on request |
| Voice drill: a record that a voice session happened (your account and the drill) and a trial counter; no audio is stored, the spoken words go into the transcript as text | voice_sessions and voice_trial_usage tables | Kept with the drill |
| Library assistant: your questions, the answers, citations, which sources were retrieved, response times | guide_conversations and guide_messages tables | Until you delete the conversation |
| Private scenarios you write in the studio, and review requests | scenario_drafts table | Until you delete them |
| Telegram delivery and test records for an organization | drill_notifications and organization_notification_tests tables | Kept with the organization |
| Operator log of failed jobs and rejected inputs (a short description of the error, not your content) | job_runs table | Operational log; no scheduled purge yet |
In your browser: the sign-in session token (until you sign out), the id of the organization you last viewed, and the list of weather alerts you dismissed, all in local storage with no expiry; and one cookie, dryrun_voice_guest, a random id that counts the free voice trial for visitors who are not signed in (HttpOnly, one year). Nothing else. No analytics, advertising or tracking scripts run on Dry Run Ready.
Browser errors: if the app crashes in your browser, the error message and stack trace are reported to Lovable, our hosting platform, so we can fix it. Reports do not include your answers or transcript.
03How we use it
Only to provide and secure the service, and to answer you. We do not sell personal data, use it for advertising, or share it for those purposes. We take no payments today, so nothing is used for billing.
04AI processing
AI requests leave Dry Run Ready through Lovable's AI gateway to the model that does the work:
- Facilitating, scoring and playbooks (OpenAI model): the scenario text, your answers, the organization name, industry and description you provided, and the jurisdiction. The facilitator never receives the scoring rubric.
- Voice drills (OpenAI live model): your microphone audio for the length of the session, and the facilitator's spoken replies. Audio is not stored by us; the transcript is.
- Library assistant (OpenAI model, with a Google embedding model for retrieval): your question and the retrieved library passages. Retrieved text is sent as data and the model is told to treat it as untrusted.
- Scenario studio "Improve with AI" (OpenAI model): the draft scenario you ask it to improve.
We do not train models on your content, and we have no agreement that lets a provider do so. We have not yet published here the providers' own statements on how long they hold request data; until we do, treat that as unconfirmed and do not put into an exercise anything you would not send to a third-party AI service.
05Who we share it with
The service providers below, only to run Dry Run Ready.
| Provider | Purpose | What it receives |
|---|---|---|
| Lovable (Lovable Cloud) | Hosting, database, authentication, file storage, AI gateway, email sending, browser error reports | Everything the app stores and sends; see the tables above |
| Supabase | The database, authentication and storage platform under Lovable Cloud | The same data |
| OpenAI, through the gateway | Facilitator, scoring, playbooks, assistant answers, voice | Scenario text, your answers and organization details, assistant questions and retrieved passages, voice audio during a session |
| Google, through the gateway | Embeddings for library retrieval | The text of your assistant question |
| Resend, through Lovable Emails | Report, reminder and account emails | Your email address and the email content, including the playbook when you request a report |
| Telegram | Drill-completion alerts, only if an organization owner saved a chat ID | Organization name, scenario title, readiness score, a scorecard link |
| Zippopotam and the US National Weather Service | Weather alerts, only if an organization owner saved a zip code | The zip code, then the county and forecast zone derived from it |
| CISA | Known Exploited Vulnerabilities feed | Nothing about you; we download their public list |
06Legal bases
For users in the UK and EU: performing our contract with you; our legitimate interest in running and securing the service; your consent where we ask for it; and legal obligations.
07International transfers
Our providers may process data in the United States and other countries. Where the law requires, transfers rely on standard contractual clauses or an equivalent safeguard.
08Where your data is
Stored data lives on the Lovable Cloud database for this project, which Supabase operates. We have not yet confirmed the physical region with the platform and will name it here when we have. The AI providers, Telegram, the weather service and the email service process requests in the United States and wherever they operate.
09Retention
We keep exercises, organizations, conversations and account data until you delete them or ask us to; there is no automatic deletion. Report links stay valid until you revoke them. Report and reminder emails stop as soon as you use the unsubscribe link or the email provider tells us you complained. Operator logs of failed jobs have no scheduled purge yet. Hosting and database platform logs are kept by Lovable and Supabase on their own schedules, which we have not verified.
10Your rights
You can ask to access, correct, delete or export your personal data, and object to or restrict its use. We honour these requests for all users, wherever they live, and respond within 30 days.
How: in the app you can edit or delete organizations, remove viewers and participants, revoke report links, delete assistant conversations and stop exercise emails from the link in every email. For anything else, including closing your account or deleting exercises, email dryrun@airworthyadvisory.com from the account's address. You can also complain to your data protection authority.
11Children
Dry Run Ready is not for anyone under 16, and we do not knowingly collect their data.
12Cookies and local storage
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
sb-…-auth-token | Local storage | Keeps you signed in | Until you sign out |
drr-active-org | Local storage | Remembers which organization you last viewed, so weather alerts match it | No expiry |
drr-weather-dismissed | Local storage | Remembers which weather alerts you dismissed | No expiry |
dryrun_voice_guest | Cookie, HttpOnly | Counts the free voice trial for visitors who are not signed in | One year |
We use only what is needed to run Dry Run Ready, so there is no consent banner. If that changes we will update this section and ask for consent first.
Dry Run Ready does no cross-site tracking, so signals such as Global Privacy Control and Do Not Track need no action from us: nothing is tracked either way.
13Security
Connections use HTTPS. Database rows are protected by row-level security so an account reads only its own organizations, exercises and conversations; tables that hold other people's data (invitations, report links, plan interest, logs) are reachable only through server code. Secrets stay in the hosting platform's configuration, never in the browser. Logos are in a private bucket and served by links that expire after an hour. Operators who can see the admin dashboard are named individually in a database table. More on the Security & Trust page.
14Security incidents
If a security incident affects your personal data, we will tell you, and the authorities where the law requires, without undue delay.
15Changes
The date above shows the current version. For material changes we will give account holders at least 14 days' notice.