Privacy Policy

1. Information We Collect

• Personal Information: Email address (from Stripe checkout or email updates signup), IP address (via Stripe), X/Bluesky handles, API tokens, engagement data (e.g., interactions, metrics), user-generated content (e.g., posts, preferences), and browser fingerprinting (for bot prevention).
• Non-Personal / Analytics Information: Usage metrics, device type, browser info, and event data collected via PostHog analytics (e.g., how you interact with the service).
• Automatically Collected: Via session cookies and PostHog tracking for sessions, preferences, and analytics.

We limit collection to what is necessary under PIPEDA's limiting collection principle. PostHog data is used only for product analytics and improvement.

2. How We Collect Information

Directly during signup (email/password), via Stripe for payments, through OAuth integrations for X data, atproto integrations for Bluesky data, or connected apps/APIs. PostHog collects analytics events automatically when you use the service. Collection of social data is strictly for providing insights within the application.

3. Purposes for Collection and Use

To provide the service (e.g., user authentication, growth opportunities, insights via social data), process payments, prevent bots, analyze usage (via PostHog), improve features, and send updates (with opt-out). We limit use to these purposes.

4. Legal Basis

Under PIPEDA, we obtain meaningful consent (express for sensitive data like social handles or engagement metrics). For GDPR, bases include consent, contract necessity, and legitimate interests.

5. Sharing and Disclosure

We share with third parties like Stripe (payments; PIPEDA-compliant) and PostHog (analytics; acts as our subprocessor). PostHog processes data only to provide analytics services and does not sell it. No sharing for marketing without consent. May disclose for legal reasons.

6. Data Retention

Kept until you delete your account or request deletion, then securely erased (subject to legal holds).

7. Security Measures

Data is protected with industry-standard measures, including at-rest encryption and HTTPS for transmissions. We conduct security audits as needed. PostHog follows its own robust security practices as our subprocessor.

8. Your Rights

Request access, correction, deletion, or withdrawal of consent (e.g., remove from mailing list or opt out of analytics). Contact me; responses within 30 days under PIPEDA.

9. Cookies and Tracking

We use session cookies for sessions and preferences. PostHog may use first-party cookies (or cookieless tracking options) for analytics. You can manage via browser settings or a cookie banner (where required). Some are essential for the service to function.

10. International Transfers

Your data may be transferred to PostHog servers, which could be located in the United States (default) or Germany (EU hosting option). Transfers outside Canada are protected by frameworks such as the EU-U.S. Data Privacy Framework (DPF), UK Extension, Swiss-U.S. DPF, and Standard Contractual Clauses (SCCs) to ensure equivalent protection under PIPEDA.

11. Children's Privacy

The service is restricted to users at or above the age of consent in their jurisdiction (e.g., 13 under COPPA in the US, 16 under GDPR in some EU countries). Users under these ages must not sign up. If discovered, accounts will be terminated, and data deleted. Children's data is treated as sensitive under PIPEDA.

12. Changes

The latest version is always on the site. Significant changes emailed with 7 days' notice.

13. Contact

Tom Turcotte, Sault Ste. Marie, Ontario, Canada. Email: tom@xgrowthengine.com.