Privacy Policy

Last updated: April 13, 2026

1. What We Collect

Information you provide

• Account info: Email address, password (hashed), and authentication tokens
• Competitor handles: Instagram/TikTok usernames you choose to track
• Payment info: Processed by Stripe — we never see or store your full card number

Information we collect automatically

• Usage data: Digest open times, streak tracking, feature usage
• Device info: Browser type and IP address (via server logs)

Information we collect from third parties

• Social media posts: Publicly available posts, captions, engagement metrics, and media URLs from competitor accounts you designate. We only access public data.
• Google OAuth: If you sign in with Google, we receive your email address and name from Google.

2. How We Use Your Data

Data	Purpose
Email	Account authentication, digest delivery, service communications
Competitor handles	Scraping public posts to build your weekly digest
Post engagement data	AI-powered analysis and insight generation
Payment info	Processing subscriptions via Stripe
Usage data	Improving the service, streak tracking, product analytics

3. Third-Party Services

We use the following third-party services that process your data:

Service	Purpose	Data shared
Supabase	Database & authentication	Email, account data
Stripe	Payment processing	Email, payment method
Apify	Social media data collection	Competitor handles (public)
Anthropic (Claude)	AI digest generation	Anonymized post data
Resend	Email delivery	Email address
Railway	Application hosting	Server logs

4. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Competitor post data: Retained for up to 12 months for historical digest access.
• Payment records: Retained as required by tax law (typically 7 years).
• Server logs: Automatically deleted after 30 days.

5. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a machine-readable format
• Opt out of marketing communications

To exercise any of these rights, email hello@letslurk.com.

6. Cookies and Local Storage

We use browser localStorage to maintain your authentication session. We do not use tracking cookies, advertising pixels, or third-party analytics that track you across sites. See our Cookie Policy for details.

7. Security

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords, and row-level security on our database. Payment processing is handled entirely by Stripe, which is PCI DSS compliant.

8. Children's Privacy

Lurk is not intended for users under 18. We do not knowingly collect data from minors.

9. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email at least 30 days before taking effect.

10. Contact

Questions about your privacy? Email us at hello@letslurk.com.