Privacy policy

Last updated: October 26, 2026

FedReady is owned and operated by ZohaDigital LLC (“we,” “us”). This policy explains what we collect when you use FedReady, what we do with it, and the choices you have.

What we collect

If you create an account, we collect:

Your name and email address.
Your password, which we store only in a scrambled (hashed) form that can't be turned back into the password.
Anything you add to your business profile, such as your company name, UEI, CAGE code, state, NAICS codes, certifications, and the kinds of work you do.
If you look up your UEI, the registration details SAM.gov publishes for it, including your registration status and expiration date, so we can remind you before it lapses.
What you do in FedReady: the opportunities you save (with their stage, notes, bid/no-bid checklist answers, and decision), the ones you mark “Not interested”, the searches you save, and your alert settings.
Documents you keep in FedReady: files you upload, and work you save from our tools, such as capability statements and sources sought responses.
Your past performance library: the projects you enter, including customer names, contract values, and any reference contacts you add.
If you use the size check, the average annual receipts and number of employees you enter for your business.
Your outreach tracker: the people and offices you add (such as agency small business offices, contracting officers, and prime contractors, with the work contact details you enter), your notes, follow-up dates, and the log of your contacts with them. Add only work contact details you're free to use, such as those in a public notice or on a business card.
Your public profile settings, if you create one.
The share links and calendar link you create, and which onboarding and reminder emails we've sent you, so we don't send one twice.
Security records: when you signed in, and short-lived counts of recent sign-in attempts (kept for about a day) so we can block password guessing.
The FedReady page you came from when you signed up, so we know which pages are useful.

You can also track a contract notice or a SAM.gov registration by email without an account. Then we keep that email address, what you're tracking, the page you started from, and which updates we've sent. We email you only after you confirm with the link we send, and only about what you're tracking. Every email has a link to stop. If you later confirm a FedReady account with the same address, the notices you were tracking are saved to My opportunities.

For a SAM.gov registration (“Remind me” on the SAM registration status check), we keep the email address and the registration's UEI, and email you 60, 30 and 7 days before the registration expires, and once if it lapses. If the same address has a FedReady account with that UEI on its business profile, the account's reminders replace these, so you don't get both.

The same goes for the weekly contracts email (no account needed), which sends new contracts for a kind of work and state: we keep the address, the kind of work and state you picked, the page you signed up on, when we last emailed you and which notices we sent, so none repeat. Nothing is sent until you confirm, and every email has a link to stop.

If you use Report a mistake (no account needed), we keep what you chose is wrong, your note, the page and the notice, award or contractor it's about, your account if you're signed in, and your email address if you leave one. We use the email only to write back about that report. Please don't put personal details in the note. We keep a report for up to a year after we've checked it, so we can see which mistakes come back, and you can ask us to delete it sooner. To limit abuse, we keep a short-lived count of reports from each internet address (kept for about a day, stored scrambled so it can't be read back).

Before accounts opened, we ran a waitlist. If you joined it, we kept the email address you gave us.

Cookies and browser storage

We set one sign-in cookie, and partner links and analytics set others, all described here. The sign-in cookie keeps you signed in and holds a random code, not your personal information. If you arrive through a link a partner shared, such as an APEX Accelerator, we also keep that link's short tag (like “apex-co”) in a cookie for 30 days, so we can count the accounts those links bring. It names the link, not you. We don't use advertising cookies. Google Analytics and Microsoft Clarity set their own cookies, described next.

We count visits with Vercel Web Analytics and Google Analytics. They record the page you viewed, the site that referred you, and your general location, browser, and device type, so we can see how many people use FedReady and which pages help. Google Analytics sets its own cookies to tell a returning visitor from a new one. We've turned off Google's advertising features, so this data isn't used to show you ads, and we strip anything private from the web address (like a password reset link) before it's sent. Links in our alert and update emails carry a short tag naming the kind of email (like “alerts”), so we can count the visits they bring; it names the email, not you. You can opt out with Google's opt-out add-on.

We also use Microsoft Clarity to see how people use our pages, so we can fix the confusing parts. Clarity records how you move through a page: scrolling, clicks and taps, and the page as it looked. It never records what you type into a form, and inside your account it records only the layout, with all the words blanked out. It doesn't record pages whose web address holds a private link, like a password reset or a shared bid. Clarity sets its own cookies to group the pages of one visit and to tell a returning visitor from a new one. Microsoft handles this data under the Microsoft Privacy Statement.

When a contract search finds five results or fewer, we count the words searched and the filters used, so we can teach the search the words people use for their work. We keep only the words, the filters, and how many times a day they were searched: no account, email address, IP address, or other way to tell who searched. We delete these counts after 180 days.

When you're signed in, we keep a record of what you do in your account, such as running a search, opening or saving a notice, finishing setup, or using an AI feature, so we can see which parts of FedReady help and fix the ones that don't. Each entry holds what kind of action it was, when, and a few details like the notice or the number of results. It never holds what you typed, like your search words, notes, or documents. These records are deleted with your account.

Some tools keep your working draft in your browser's storage, on your own device, so you don't lose it between visits: the capability statement and sources sought drafts, for example. We don't receive a draft until you save it to Documents or publish it. Clearing your browser data removes it from that device.

How we use it

We use your information to run your account, to find and rank opportunities that fit your business, and to email you about your account (for example, password reset links). We don't sell or rent your information to anyone, and we don't send your profile to SAM.gov or any government agency.

We send these emails:

An alert email (weekly, or daily if you choose it on Pro) when there are new opportunities matching your profile or saved searches, or changes to opportunities you've saved. If you haven't signed in for 3 weeks, daily alerts slow to weekly; after 45 days we pause them and ask once whether you still want them.
In your first few weeks, a few getting-started emails: a reminder to finish setting up or to add a NAICS code, your top matches, and contracts in your field coming up for recompete. Each is sent once, and never on a day you got an alert email.
Reminders 60, 30 and 7 days before your SAM.gov registration expires, and if it lapses, once we've found your registration from your UEI.
Account notices: 3 days before your Pro trial ends, and before each yearly renewal.

You can make alerts weekly, or turn alerts and the getting-started emails off, under Email alerts or with the unsubscribe link in any of them. SAM.gov registration reminders and account notices still come after that, because they're about your account, as do email confirmations and the password resets you ask for. To stop them too, delete your account.

We keep a record of each email we send for 180 days: which kind of email it was, its subject, when it went, and whether our email provider reported it bounced or marked as spam. Your address is stored in that record only in scrambled (hashed) form. If an address reports our email as spam or bounces for good, we stop emailing it, except for email confirmations, password resets and renewal notices.

We never email the people in your outreach tracker. Intro emails open in your own email app, and you send them yourself.

A share link lets anyone who has it see the opportunity you shared, and your notes and bid assessment only if you chose to include them. Your calendar link lets anyone who has it see the deadlines of the opportunities you've saved. Keep them private. You can turn off a share link, or reset your calendar link, at any time.

If you publish a public profile, anyone can see the capability statement you chose at its web address, including any contact details on it. We add your SAM.gov registration status only when the UEI on the statement matches the registration we checked for you. If you let search engines list it, we include it in our sitemap and it may appear in search results. Search engines and others may keep copies for a while after you take it down, which we can't control. You can unpublish it, or stop search engines from listing it, at any time under Public profile.

Who else handles it

We use service providers to host the website (Vercel), store our database and the files you upload (Supabase), and deliver email (Resend). They process your information only on our behalf. Uploaded files are kept in private storage, and we hand out download links only to your account, as short-lived links that expire. Our security page lists these providers and how we protect your information.

If you subscribe to a paid plan, Stripe processes your payment. You enter your card on Stripe's own page, so we never see or store your full card number. From Stripe we keep your customer and subscription IDs, your plan, its status, and when it renews or ends. Stripe handles your payment details under its own privacy policy.

For AI features (notice summaries, fit checks, proposal drafts, and profile drafts from your website), we send the content each one needs to Anthropic, which runs the Claude AI models. That can include the notice and its attachments, your business profile and past performance, the proposal you're working on, or the website you give us. Anthropic processes it to produce the result for us and, under its commercial terms, doesn't use it to train its models.

To look things up, we send search terms to public government services: your UEI to SAM.gov when you ask us to look it up, and NAICS codes, agency names, or the company names and UEIs you search for to USAspending.gov for market research. We never send your name or email address with them.

Our short videos are hosted on YouTube. Video pages embed YouTube's player in its privacy-enhanced mode (youtube-nocookie.com). Google says that mode doesn't store information about visitors unless they play the video, but loading the player does contact Google's servers. The home page loads the player only when you click play. YouTube handles those requests under Google's own privacy policy.

How long we keep it, and where

We keep your information while your account is open, so FedReady keeps working for you. When you delete your account, we remove your information from our live database and delete your uploaded files right away. Our database provider keeps a daily backup for 7 days, so a deleted account is gone from the backups within 7 days. Our database and your files are stored in the United States.

Some of our providers keep a copy under their own policies. Stripe keeps payment records for as long as financial laws require. Anthropic deletes what we send it for AI features within 30 days, unless its safety systems flag it for breaking Anthropic's usage policy, in which case it can keep it for up to 2 years. Our hosting and email providers keep short-lived technical logs.

Your choices and rights

You can see and change most of your information yourself in your account, and delete your account at any time from Account settings. Deleting it permanently removes your account and your business profile, saved opportunities and bid workspaces (notes, checklists and drafts), capability statements, documents and uploaded files, past performance library, outreach contacts, saved searches and alert settings, share links and calendar link, and your public profile page.

You can also email hello@fedready.us to get a copy of your information, to correct or delete something you can't change yourself, or to be removed from the waitlist. We reply within 2 business days, and send a full copy of your information within 7 days. You can also download your files and saved drafts yourself at any time from Documents. We may ask you to write from the email address on your account so we know the request is yours.

If there's a security breach

If we learn of a security breach that affects your information, we'll email you within 72 hours of confirming it. We'll say what happened, what information was involved, and what you can do. Our security page explains how we protect your information.

Businesses and government contacts we show

FedReady also shows information about businesses and government staff who haven't signed up, all from public sources. Our contractor pages are built from SAM.gov registrations: a company's legal name, UEI, CAGE code, website, location, NAICS codes and certifications, with its federal contract history from USAspending.gov. Notice pages show the contracting contacts an agency lists on its public SAM.gov notice, which can include a name, work email address and phone number. To ask us to remove a contractor page, or to correct or remove a contact detail, email hello@fedready.us and tell us which page. For a contractor page, write from an address at the company.

Government data

FedReady is an independent company and is not affiliated with SAM.gov or any government agency. Contract opportunity, past award, subcontract, and business registration information shown in FedReady comes from public data the U.S. government publishes on SAM.gov and USAspending.gov.

Changes

If we change this policy in a way that matters, we'll update this page and email account holders.

Contact

Questions? Email hello@fedready.us, or write to ZohaDigital LLC, 4755 Hedgemore Dr, Charlotte, NC 28209.