Privacy Policy

Upvotecast (upvotecast.app) is operated by Robin Champsaur, [Company / address], France. For the personal data described here, we are the data controller under the EU General Data Protection Regulation (GDPR).

Questions or requests about your data: contact@upvotecast.app.

• Account data. When you sign in with Google, we receive your name, email address, Google account identifier and profile picture URL. We never see your Google password.
• What you type into Upvotecast. Product descriptions you enter in Discover, the subreddits you analyze, and the posts you write, check, fix or save as drafts.
• Usage. How many analyses, Discover scans, post checks and fixes you use each month, with timestamps, so we can apply your plan's quotas.
• Billing. If you subscribe: your plan, billing period, subscription status and Stripe customer ID. Card details go straight to Stripe; we never see or store them.
• Reddit connection (optional). If you connect Reddit, your Reddit username and the OAuth access and refresh tokens Reddit gives us. We use them only to read your own profile (karma, account age) and your recent submitted posts for your dashboard. Upvotecast never posts, comments, votes or sends messages on Reddit for you.
• Technical data. IP address, browser type and request logs, kept by our hosting providers for security and debugging.

We don't need, and ask you not to enter, sensitive data (health, political opinions and the like) in your briefs or posts.

• To provide the service (sign-in, analyses, Discover, post checks, Apply fixes, drafts, quotas, billing): performance of our contract with you (GDPR art. 6(1)(b)).
• Your optional Reddit stats: your consent, given when you connect Reddit (art. 6(1)(a)). You can withdraw it anytime by disconnecting.
• Security, abuse prevention, rate limits and aggregate site analytics: our legitimate interest in running a safe, working service (art. 6(1)(f)).
• Invoices and accounting records: legal obligation (art. 6(1)(c)).

Analyses, Discover verdicts, post checks and Apply fixes use AI models from Anthropic. To produce them, we send Anthropic the relevant text: public Reddit data about the subreddit and, depending on the feature, your product description or your post's title and body. We don't send your name or email address.

Anthropic processes this data as our service provider. Under its commercial terms, data sent through its API is not used to train its models. See Anthropic's privacy policy.

AI output can be wrong. We don't make automated decisions about you that have legal or similar effects.

We use these providers, each under a data processing agreement:

• Supabase: Google sign-in and our database (account, plan, drafts, Reddit connection).
• Google: sign-in (as an identity provider).
• Anthropic: AI analysis of the text described above.
• Stripe: payments, invoices and the billing portal. Stripe is also a controller for some payment data under its own privacy policy.
• Upstash: a Redis cache, mostly of public Reddit data and analysis results, plus your monthly usage counters and rate-limit counters keyed on your account ID or IP address. Entries expire automatically.
• Sentry: error reports from our API (technical details of the failing request, without your name or email).
• Vercel and Koyeb: hosting of the website and of our API.
• Vercel Web Analytics and DataFast: aggregate website analytics (pages viewed, referrers, country, device type).
• Reddit: we read public subreddit data through Reddit's API, and your own profile and posts if you connect your account.

Some of these providers are in the United States or process data there. Transfers are covered by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. We don't sell your data and don't share it for advertising.

Your browser's local storage keeps your sign-in session, your theme choice (white or black), and, briefly, the page to open after you sign in. These are needed for the site to work.

Vercel Web Analytics works without cookies. DataFast may set a first-party cookie to count unique visitors. We don't use advertising or cross-site tracking cookies.

• Account data, drafts and usage history: as long as you have an account.
• Reddit tokens: until you disconnect Reddit or delete your account. After a disconnect we stop using them; you can also revoke access anytime in your Reddit app settings.
• Server and security logs: a short period, typically up to 30 days.
• Cached public Reddit data: until its cache entry expires (hours to days).
• Invoices and accounting records: 10 years, as French law requires (kept with Stripe and in our books).

You can delete your account yourself on your account page. This deletes your account data, drafts, usage history and Reddit connection, and cancels an active subscription. Stripe keeps its customer record and invoices, as accounting law requires. Backups roll over within 30 days. Records we must keep by law (invoices) are kept for the legal period.

Under the GDPR you can:

• access the personal data we hold about you and get a copy of it;
• have it corrected if it's wrong;
• have it erased (see Deleting your account);
• restrict or object to its processing, including processing based on our legitimate interests;
• receive it in a portable format;
• withdraw your consent at any time (for the Reddit connection: disconnect it).

Write to contact@upvotecast.app and we'll answer within one month. You can also complain to the French data protection authority, the CNIL, or to the authority where you live.

Data travels over HTTPS. Access to our database and providers is limited to what running Upvotecast requires and protected by strong authentication. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.

Upvotecast isn't meant for anyone under 16, and we don't knowingly collect their data.

If we change this policy in a way that matters, we'll update the date above and tell signed-in users by email or in the app before the change applies.