Privacy Policy
Last updated: October 2026
1. What we collect
When you create an account we collect:
- Email address — required to authenticate you and send account-related emails.
- Password — stored as a bcrypt hash by Supabase; we never see the plaintext.
- Google profile — if you choose to sign in with Google, we receive your name and email from Google. No additional Google data is stored.
When you use the service:
- Keywords you search — stored in your search history and a credit ledger entry.
- Credit balance and transactions — each credit spend, grant, or refund is logged with a reason and timestamp.
- Subscription state — plan name, billing period, cancellation flag.
- Feedback you submit — free-text message; email is optional and only collected if you provide it.
IP addresses — your IP address is seen by our hosting provider (Vercel) on every request and is used by our rate-limiting service (Upstash Redis) for abuse prevention. IP addresses in rate-limit counters auto-expire within 24 hours.
2. How we use your data
- To authenticate you and keep your session secure.
- To run the credit system — reserve, commit, and refund credits for each keyword search.
- To display your search history and balance.
- To send transactional emails: email confirmation, password reset, and billing receipts from Polar.sh. These are not marketing emails.
- To detect and prevent abuse (rate limiting by IP and user ID).
- To improve the service via aggregated, anonymised error reports.
We do not sell your data to third parties. We do not use your keyword searches to train AI models.
3. Third-party processors
CashHook uses these third-party services to operate. We share only the minimum data each service needs for its purpose.
- Supabase — database and authentication. Stores your email, hashed password, search history, credit ledger, and subscription state. Data may reside in EU or US regions. Privacy policy
- Vercel — hosting and edge functions. Receives all HTTP requests including IP addresses and request paths. Does not receive database row contents. Privacy policy
- Polar.sh — payment processing. Your payment method, billing address, and email are handled by Polar. We send Polar only your internal user ID (not your email) to link your subscription. We never store card numbers. Privacy policy
- Upstash Redis — rate limiting. Stores counters keyed by your user ID or IP address to prevent abuse. All counters auto-expire within 24 hours. Privacy policy
- Sentry — error monitoring. We automatically strip personal data (email, IP, username) from error reports before they are sent to Sentry. Privacy policy
- SerpApi — Google Search data. When you analyze a keyword, that keyword is sent to SerpApi to retrieve search results. Your email and user ID are never sent. Privacy policy
- CreatorCrawl — TikTok video data. Your keyword is sent to retrieve top TikTok videos for that keyword. Your email and user ID are never sent.
- Google AI (Gemini) / OpenAI — AI hook generation. When generating your action plan, your keyword and publicly available TikTok video titles are sent to one of these providers. Your email and user ID are never sent. Keywords are not used to train their models under our API terms. Google AI Terms / OpenAI Privacy Policy
4. Retention periods
- Account data (email, profile, subscription) — kept for as long as your account is active.
- Search history — automatically deleted after 90 days.
- Credit ledger — kept indefinitely for accounting accuracy, but anonymised when your account is deleted (your user ID and the keyword are removed; the transaction amounts and dates remain).
- Keyword cache — deleted after 25 hours (shared between all users; contains no personal data).
- Feedback submissions — automatically deleted after 12 months.
- Rate-limit counters — auto-expire within 24 hours in Upstash Redis.
When you delete your account, all of the above personal data is removed or anonymised within minutes.
6. Your rights
Depending on your jurisdiction, you may have the right to:
- Access and portability — export a JSON file of all your personal data from the Subscription page.
- Deletion (right to erasure) — delete your account and all personal data from the Subscription page. Active subscriptions are cancelled automatically.
- Correction — update your email via account settings or email support@cashhook.io.
- Restriction or objection — email support@cashhook.io.
We will respond to rights requests within 30 days.
7. Email and marketing
We currently send only transactional emails: email confirmation, OTP codes, password reset links, and billing receipts from Polar.sh. These are sent by Supabase Auth and Polar on our behalf and do not require an unsubscribe option.
If we introduce a marketing newsletter in the future, we will obtain explicit opt-in consent, include a clear unsubscribe link in every email, and comply with applicable email regulations (CAN-SPAM, CASL, GDPR). We will update this policy before sending any marketing email.
8. Security
All data is transmitted over HTTPS with HSTS preload. Passwords are hashed by Supabase (bcrypt). API keys and secrets are stored only in server-side environment variables and never exposed to browsers. Personal data is stripped from error reports before they reach Sentry. We conduct periodic security reviews (see HARDENING_REGISTER.md for detail).
9. Changes to this policy
We may update this policy. We will notify registered users by email of any material changes at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact
Questions about this policy or data subject rights requests: support@cashhook.io