Privacy Policy

We collect the minimum we need to make the Service work: your email, the product details you give us (like your website URL), the channels you add, the work you log, and the public stats from accounts you choose to connect read-only. We don't sell your data. We don't read your DMs. We don't scrape other users.

Account data.Your email address and, if you sign in with Google, a few profile fields Google sends us (name, picture). We don't store your Google password.

Product data.Your website URL and the brief we generate from it (what you make, who it's for, your goal), which you can edit. To build that brief, we send your public website content to OpenAI for analysis.

Channels and work. The channels you add to your map, the handles you enter, your goals, and the work you mark shipped.

Connected account data. If you connect an account (Instagram, Google Search Console, or Reddit), we store a read-only access token and the public stats those services report, like follower counts, search clicks, and karma. We do not receive DMs, friend lists, or content from other users. Disconnecting deletes the tokens immediately.

Browser extension data. If you use our optional legacy extension, it observes the actions you take on supported platforms inside your own browser session and writes the counts to your account. It does not read DMs, friend lists, or content from other users.

Operational data. Standard server logs and analytics on the marketing site (page views, anonymized referrer) so we can tell what works.

• Your private messages or DMs on any platform.
• Lists of other users you interact with.
• Content from other people's accounts.
• Your passwords for third-party platforms. We never see them.

• To show you your map, your stats, and your goals.
• To process your subscription via Polar.
• To send transactional emails (sign-in confirmations, billing receipts, important account notices).
• To improve the product. We may look at aggregated, anonymized usage to decide what to build next.

We use a small number of trusted vendors to run the Service:

• Supabase: database, authentication, file storage.
• Vercel: hosting and request logs.
• Polar: payments and billing.
• OpenAI: analyzes your public website content to build your growth plan.
• Google: if you sign in with Google or connect Google Search Console.
• Resend (or our equivalent transactional email provider): account emails.

Each of these has its own privacy practices. We share only what they need to do their job.

We use a small number of cookies for things that are required to make the app work, like keeping you logged in and remembering your last tab. We don't use third-party advertising cookies.

You can:

• Export or delete your data anytime from Settings.
• Email us at hi@controloutput.com to request a copy of your data, correct it, or delete your account.
• Withdraw consent or object to processing where required by your local laws (e.g., GDPR/UK GDPR/CCPA).

When you delete your account, we delete your accounts and daily logs immediately and remove backups within 30 days, except where retention is required by law (e.g., billing records).

The Service isn't intended for children under 13. If you believe a child is using the Service, contact us and we'll delete the account.

We use industry-standard practices: encrypted connections, hashed credentials, scoped access. No system is perfectly secure, so if we're ever aware of a breach affecting your data, we'll notify you promptly.

Our vendors operate globally; your data may be stored or processed in the United States or the European Union. By using the Service, you consent to those transfers.

We'll update this page when our practices change. Material changes will trigger an email or an in-app notice. The date at the top of this page tells you when it was last updated.

Privacy questions? Email hi@controloutput.com.