# Privacy Policy

> How ScrollLaunch collects, uses, shares, and protects your personal data - plus your rights under GDPR, CCPA, and India's DPDP Act.

```yaml
url: "https://www.scrolllaunch.com/privacy"
last_updated: 2026-09-07
effective_date: 2026-09-07
operator: ScrollLaunch
jurisdiction: "Rajasthan, India"
governing_law: India
contact: "kalash@scrolllaunch.com"
```

## Summary

- We use **Google OAuth** (via NextAuth) for sign-in. We never see your password.
- We use **Datafa.st** and **Ahrefs Web Analytics** for cookie-free aggregate analytics.
- We use **Google Analytics 4** (Google LLC) for web traffic measurement - it may set first-party analytics cookies such as `_ga`.
- We use **Dodo Payments** for payments. Card details never touch our servers.
- Maker product content and comments (name, tagline, description, logo, website URL, discussion text) are **intentionally public** - that's the whole point of the Service.
- Comments may **not** contain links or URLs; we filter them to prevent spam and backlink abuse.
- We do **not** sell your personal data. Ever.

## Data controller

The data controller is ScrollLaunch, reachable at kalash@scrolllaunch.com. We respond to data-subject requests within 30 days.

## Data we collect

**Account data (from Google OAuth):** your name, email address, profile picture URL, and a stable Google account identifier.

**Maker profile:** display name, username, bio, headline, location, public country, company, social links. Public country defaults from a signup geo ISO code (hosting headers, not stored IP) and is editable after a live launch. Location (city / region) is stored for our records only and is not published; the public maker page shows public country.

**Product / launch data (you submit):** product name, tagline, description, logo, screenshots, video URL, website, social handles, categories, tags, pricing info, target audience, problem/solution copy, FAQ entries, alternative-to mentions, launch week.

**Engagement data:** upvotes you cast, comments and nested replies you write (body text, parent id, display name/image snapshot), signed-in product visits, badges, weekly rankings.

**Payment data (via Dodo Payments):** transaction IDs, amounts, currencies, status. We never see card numbers, CVVs, or banking credentials.

**Analytics data (via Datafa.st and Ahrefs Web Analytics):** anonymised pageviews, referrers, country (no IP storage, no cookies, no cross-site identifiers).

**Analytics data (via Google Analytics 4):** aggregate page views, session counts, referrer, approximate geography, device/browser category. Google may set first-party cookies (e.g. `_ga`) to distinguish sessions. Not used for advertising.

**Server logs:** request method/path, response code, user-agent, IP address (kept for ≤ 30 days for abuse and rate-limit enforcement). At signup we store an ISO country code from geo headers (not the raw IP). That signup country is not published.

## How we use your data

- Operate the Service: authenticate sessions, render the leaderboard, surface comments, send transactional emails.
- Moderate abuse: block URLs in comments, detect copy-pasted promo spam, analyse upvote/account signals; purge abusing accounts and delete associated products, comments, votes, visits, notifications, and sessions.
- Process payments and prevent fraud.
- Send you product-related emails (e.g. new comment/reply notifications, launch reminder, weekly digest if you opt in). Comment bodies in emails are plain text with URL-like spans stripped. You can unsubscribe at any time.
- Improve the Service (debugging, performance optimisation, abuse detection).
- Generate AI launch stories on your explicit request (Premium+ tier; uses OpenAI).

## Legal bases (GDPR)

- **Contract:** account creation, payment processing, delivery of paid features.
- **Legitimate interest:** abuse prevention, security logging, server analytics, the dofollow-backlink mechanic that constitutes our core value proposition.
- **Consent:** marketing emails (you opt in; you can withdraw anytime).
- **Legal obligation:** tax, accounting, responding to lawful legal process.

## Sharing

We share data only with the processors required to run the Service:

- **MongoDB Atlas** - primary database.
- **Vercel Inc.** - application hosting + CDN.
- **Cloudinary** - image hosting (logos, gallery).
- **Dodo Payments** - payment processing (PCI-DSS).
- **Datafa.st** - cookie-free analytics.
- **Ahrefs Web Analytics** (Ahrefs Pte. Ltd.) - cookie-free SEO and traffic analytics.
- **Google Analytics 4** (Google LLC) - web traffic measurement; may set first-party analytics cookies.
- **Affonso** - affiliate referral attribution via first-party `affonso_referral` cookie (30-day lifespan) when you arrive via a partner link, so commissions can be credited on Dodo Payments checkouts (Premium, Premium+, ads, directory plans). See [Affiliates](https://www.scrolllaunch.com/affiliates).
- **Google OAuth (via NextAuth)** - authentication.
- **OpenAI** - only when you trigger AI generation (Premium+).
- **Resend** - transactional email delivery.

We do not sell personal data, do not run ad networks, and do not share data with brokers.

## International transfers

ScrollLaunch operates from India; processors operate from the EU and the US. Where applicable we rely on Standard Contractual Clauses or equivalent safeguards.

## Retention

- Account data: kept while active. On self-serve deletion or moderation purge we delete the account and associated personal data we control (products, comments, votes, visits, notifications, sessions) from live systems promptly; backups purge within ~30 days, except tax/payment records and moderation audit logs as required.
- Product listings / comments: removed promptly when you delete them, when we moderate them, or when the author account is purged.
- Server logs: ≤ 30 days.
- Analytics: aggregated, no per-user retention.
- Payment records: kept as required by tax law (typically 7 years).
- Admin / moderation audit logs: retained as needed to investigate abuse.

## Your rights

Subject to your local law (GDPR, CCPA/CPRA, India's DPDP Act, etc.) you have the right to access, correct, delete, port, restrict, or object to processing of your personal data, and to withdraw consent at any time. You can delete your account from dashboard settings, or email kalash@scrolllaunch.com; we'll respond within 30 days. You may also lodge a complaint with your local data-protection authority.

## Cookies

We use strictly-necessary first-party cookies for authentication and CSRF, first-party measurement cookies via Google Analytics 4, and an optional Affonso referral cookie (`affonso_referral`) when you arrive via a partner link. Full list on the [Cookie Policy](https://www.scrolllaunch.com/cookies).

## Children

The Service is not directed at children under 13. If we learn we have inadvertently collected data from a child, we will delete it.

## Changes

We may update this policy. The "Last updated" date at the top reflects the latest revision. Material changes will be announced by email.

## Contact

kalash@scrolllaunch.com

_HTML version: https://www.scrolllaunch.com/privacy_