The short version
- We collect what we need to run accounts, launches, votes and fair rankings, and little else.
- We don't show ads, and we don't sell or rent your data to anyone.
- We never store IP addresses in our database, only one-way hashes of them, used to count unique visitors and spot abuse.
- Who voted for what is never shown publicly; only vote totals are.
- Our analytics run without cookies, and we don't record your screen or what you type.
What we collect
When you create an account
You sign in through Clerk, our sign-in provider, using an account like Google. We receive and store your name, email address and profile picture, and your X (Twitter) username if you sign in with X. We also keep when you joined.
When you launch a product
Everything you enter in the submission form: the product's name, website, tagline, description, logo, category and pricing, and the maker name and X username you choose to show.
When you vote or report
- Votes: which products you upvoted and when, plus a one-way hash of your IP address and your browser's user-agent string (the browser and device type it reports). These help us detect vote rings and bots.
- Reports: the reason, any note you add, and your account, so we can follow up.
When you browse
When you open a product page or click through to a product's website, we record a one-way hash made from your IP address, browser and the date, so each person is counted once per day. We also keep the domain of the site that sent you (for example "x.com", never the full link) and which part of LaunchHeat a click came from. These records aren't linked to your account, and known bots are ignored.
These hashes can't be turned back into an IP address, but they are pseudonymous rather than anonymous: the same address always produces the same hash, which is what lets us spot many accounts voting from one network.
Analytics
We use PostHog to understand how LaunchHeat is used, for example how many people visit, which pages they view, and how many launches get shared and clicked. It runs in a cookieless mode: nothing is stored in your browser, and visitors are counted with a hash that PostHog computes from your IP address and browser and changes every day, so we can't recognise you across days. PostHog also uses your IP address to estimate your country.
We also record a few key actions from our own servers: submitting a product, a product being approved, sharing a launch, voting, and clicking through to a product's website. If you're signed in, these are linked to your account ID so we can see, for example, whether founders share their launch after approval. If you aren't, they're linked only to the daily visitor hash described above. We don't record session replays, keystrokes or the content of forms.
Technical data
Like most websites, our hosting provider keeps standard server logs (such as IP address, time and page requested) for a short time, for security and to keep the service running.
How we use it
- to run your account and show you your dashboard;
- to review, publish and rank launches, and show votes, visitors and clicks;
- to prevent spam, vote manipulation and abuse, including rate limiting;
- to understand how LaunchHeat is used and improve it, using the analytics described above;
- to answer you when you contact us, and to tell you about changes that affect you;
- to meet legal obligations.
We rely on what's needed to provide the service you signed up for, and on our legitimate interest in keeping LaunchHeat fair and secure. We don't use your data for advertising or profiling.
What's public
Live product listings are public: everything in the listing, including the maker name and X username you chose to show, along with vote totals, visitor and click counts, and rank. Your email address, who you voted for, and anything you put in a report are never shown publicly. A maker's dashboard shows totals and referring sites for their own product, never who visited or voted.
Cookies and storage
- Sign-in cookies set by Clerk keep you signed in. They're necessary for the service to work.
- Local storage in your browser remembers small things, such as which launch checklist steps you ticked. It stays on your device.
We don't use advertising or tracking cookies, and our analytics don't use cookies or local storage at all.
Service providers
We use a small number of providers to run LaunchHeat. They process data only on our behalf, under their own security and privacy commitments:
- Clerk: Sign-in and account management
- Google: Sign-in, if you choose “Continue with Google”
- Vercel: Hosting and delivering the website
- Neon: Our database
- Upstash: Short-lived rate-limit counters
- Cloudinary: Storing and serving product logos
- PostHog: Cookieless product analytics
Some of these providers process data in the United States and other countries. Where the law requires it, we rely on their standard safeguards for international transfers. We may also share data if the law requires it, or to protect people or the service from harm.
How long we keep it
- Your account stays until you ask us to delete it. Deleting it removes your account, your votes and your products. Reports you filed are kept for moderation records, with your account removed from them.
- Hashed visit and click records are kept to show each product's stats over time.
- Rate-limit counters expire automatically within 24 hours.
- Analytics events are kept in PostHog for as long as our PostHog plan retains them, and are deleted with your account on request.
Your choices and rights
You can ask us to show you the data we hold about you, correct it, delete it, or export it, and you can object to how we use it. Depending on where you live, laws such as the GDPR or the UK GDPR give you these rights, and you can also complain to your local data protection authority. To make a request, email [to be added: contact email]. We'll reply within 30 days, and we may need to confirm it's really you.
You can change your name, email and profile picture at any time from the account menu (your picture, top right), after signing in.
Children
LaunchHeat isn't meant for anyone under 16, and we don't knowingly collect their data. If you think a child has created an account, contact us and we'll delete it.
Security
We use encrypted connections (https), store IP addresses only as hashes made with a secret key, and limit who can access our systems. No system is perfectly secure, but we'll tell affected users promptly if a breach puts their data at risk.
Changes
If we change this policy we'll update the date above, and tell you on the site if the change is significant. See also our terms of service.
Contact
Privacy questions and requests: [to be added: contact email].