Legal

Privacy Policy

Last updated: May 6, 2026

Short version: we collect the minimum we need to run the service, we don't sell your data to anyone, we don't train AI on your content, and you can delete your account by emailing us.

What we collect

When you create an account (via Clerk), we store:

Your email address
A stable user ID from Clerk
The date you joined

When you use the service, we additionally store:

Saved prompts — the prompt text, name, and which builder/tab it belongs to. Only saved when you click Save.
Favorites — which tools you've starred.
Placeholder history — recent values you've typed into placeholder fields, stored in your browser's localStorage (not on our server) so the autocomplete dropdown works.
Run audit log — for each AI run: builder used, model, input token count, output token count, status, timestamp. We do NOT store the prompt text or Claude's response in this log.
Monthly usage counter — number of AI runs this month, for quota enforcement.
Subscription state — your Stripe customer ID, subscription status, and current tier. Card details are held by Stripe; we never see them.

For the YouTube Analytics tool specifically, we additionally store:

Your YouTube Data API v3 key — the one you generate and paste during setup. Stored as plaintext in our database; you can rotate or revoke it any time from Google Cloud Console.
Your YouTube channel ID, handle, and title.
A cached payload of your channel's public video data (titles, view counts, like counts, descriptions, tags). Refreshed only when you click Sync.
The most recent AI insights analysis text (only one at a time — each new run overwrites the prior).

How we use it

We use the data above to:

Identify you across visits and devices.
Show you your saved prompts, favorites, and recent activity.
Enforce the monthly AI run quota fairly across users.
Process payments and grant the right tier of access via Stripe.
Run the YouTube Data API on your behalf when you click Sync or Run analysis.
Debug issues and detect abuse (e.g., spotting an account that's hammering the API).

We do not:

Sell or rent any data to third parties.
Train AI models on your prompts, outputs, saves, or channel data.
Send marketing emails. The only emails you get from us are transactional (subscription confirmation, payment failure) via Stripe.
Use ad-tech cookies, Google Analytics, Facebook Pixel, or similar tracking on the site.

Third-party services we use

The Service runs on top of a small number of providers. Each one sees only what it needs to do its job.

Provider	What they do	What they receive
Cloudflare	Hosting, CDN, database (D1), edge functions	Every request — IP, request URL, headers. Cloudflare may temporarily log request metadata for DDoS protection.
Clerk	Sign-in / sign-up / session management	Your email, password (which they hash), session cookies, and any social-login data you authorize.
Stripe	Subscription billing, payment processing, Customer Portal	Your name, billing email, billing address, payment method. We do not see card numbers.
Anthropic	The Claude API that powers Run with AI and AI insights	The prompt text you submit. Anthropic retains prompts for up to 30 days for abuse detection, then deletes them. They do not use API-customer prompts to train models.
Google (YouTube Data API)	YouTube channel + video data lookup for the YouTube Analytics tool	API requests made with your own API key. Subject to Google's YouTube API Services Terms.
EmailJS	Sending feedback emails when you submit a star rating	Your feedback text, star rating, the tool you rated, and a few user-agent details (browser, OS). Only invoked when you click Submit on a rating form.

Cookies and local storage

We use:

Clerk's session cookie — necessary to keep you signed in.
localStorage on your device for placeholder-field history, "have you been shown the rating popup yet" flags, and (for signed-out users) saved prompts. Cleared if you clear browser data.
sessionStorage for one-session-only flags (e.g., not showing the rating popup again this session).

No analytics cookies. No advertising cookies. No third-party tracking pixels.

Data retention

Account data, saved prompts, favorites, and run audit logs persist until you delete your account. Subscription records persist as required for tax/accounting purposes (typically 7 years in the US).

The YouTube Analytics cached payload and saved insight persist until you click Disconnect or delete your account.

Your rights

You can:

See what we have — most of it is visible on your dashboard. For anything else, email us.
Export saved prompts — we don't have a one-click export yet; email us and we'll send you your data as JSON within 7 days.
Delete your account — email dusrawling@gmail.com from your registered address. We'll delete your account row, saved prompts, favorites, run audit log, YouTube cache, and stored API key within 7 days. Stripe records are retained as required by law.
Cancel your subscription — anytime, via the Customer Portal (reachable from the upgrade modal in any prompt builder).

If you're in the EU/UK and want to invoke specific GDPR rights (access, rectification, erasure, portability, restriction, objection), email us and we'll respond within 30 days.

Children

The Service is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, email us and we'll delete it.

Security

We rely on Cloudflare for infrastructure security, Clerk for authentication security, and Stripe for payment security. Data in transit is encrypted via TLS. Data at rest is stored in Cloudflare D1 (SQLite on Cloudflare's infrastructure). No system is perfectly secure; if a breach affecting your data ever occurs, we'll notify you by email within 7 days.

Changes to this policy

If we update this policy, we'll change the "Last updated" date at the top. Material changes (new third-party providers, new data categories) will be announced by email or an in-app notice.

Contact

Privacy questions? Email dusrawling@gmail.com. We'll respond within 7 days.