Privacy

launchpat is made by Setpat Technologies, Unipessoal Lda (Portugal). Questions and requests: support@setpat.com.

Last updated 2026-11-04.

What information we collect

This section summarises what user information launchpat accesses, collects, stores and otherwise uses, including API Data relating to users. Each item is described in more detail in the section named after it below.

Account information: your email address, a password held by Supabase Auth (we never see or store it), and the products, settings and content you create in the app.
Billing information: your Stripe customer and subscription identifiers, your plan and usage counters. Card details go directly to Stripe and never reach our servers.
Personal access tokens: stored as SHA-256 hashes only.
Connected social accounts: where you connect one (for example X), the OAuth tokens for that connection, encrypted at rest.
Support correspondence: your messages, your address and our replies.
Questions you ask the assistant: each question and its answer, with email addresses, handles, phone numbers and keys removed on a best-effort basis, kept 90 days.
Public content we process for your products: public posts, product facts and platform metadata gathered from the sources you configure.
YouTube API Data: for videos and channels relevant to your product: the video id, title, a short description excerpt, channel name, publish date and public engagement counts at fetch time. Where a channel is one of your product's own sources we also keep a channel snapshot: the channel handle and id, its subscriber and video counts, and the titles and view counts of its recent uploads. This is public data retrieved with a server-side API key. Our YouTube integration never requests, receives or stores Google account credentials or OAuth tokens, so we hold no Authorized Data and no per-user YouTube account access.
Google sign-in (only if you use it): the name, email address and profile picture Google shares when you choose Continue with Google; see Sign in with Google.
Usage and device information: entries we keep in your browser's local and session storage, product-analytics events, the user-agent string recorded when you click a link in a product email, and server logs. See Cookies and device storage.

Your account

To operate your account we process your email address and a password (handled by Supabase Auth; we never see or store your password itself), plus the products, settings and content you create in the app. Sign-in state is kept in your browser's local storage. Legal basis: contract performance (GDPR Art. 6(1)(b)). Your data is stored with Supabase in the EU, on servers we operate in the EU (Germany/Finland). To have your account and its data deleted, write to support@setpat.com; see Deleting your data and revoking access below.

Connected social accounts

If you connect a social account (for example X) so launchpat can publish replies you approve or read your own post metrics, we store the OAuth tokens for that connection encrypted at rest. Tokens are used only to act on your explicit instructions (nothing is ever posted without your approval), and disconnecting the account invalidates them. Legal basis: contract performance (Art. 6(1)(b)).

Billing

Payments are processed by Stripe; your card details go directly to Stripe and never touch our servers. We store only your Stripe customer and subscription identifiers, your plan, and usage counters needed to meter the service. Invoices and VAT handling follow EU rules. Legal basis: contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for accounting records.

Checkout runs on Stripe's pages. If you choose PayPal or Revolut Pay there, you also share your payment details with PayPal (Europe) S.à r.l. et Cie, S.C.A. or Revolut Bank UAB. They act as independent controllers under their own privacy terms.

Transactional email

Service email (signup confirmations, daily product emails, billing and support replies) is delivered via Resend as our email processor. We do not send marketing email without a separate opt-in.

Support

When you email support, we store your message, address and our replies to resolve your request, and may use AI models to classify and route the message. Support history follows our general log-retention posture. Legal basis: contract performance (Art. 6(1)(b)).

Questions you ask the assistant

When you ask the in-app assistant a question, we keep the question and its answer, with the product and page you asked from and technical details of the answer (which AI model answered, which tools it used, how long it took). We use them to find where launchpat is confusing and to check that a change to the assistant makes its answers better before it ships. That can mean replaying a question against a test version of the assistant, which sends it to our AI model providers again.

Before saving, we automatically strip email addresses, social handles, phone numbers and strings that look like access keys or tokens, and cut links down to the site they point to (links to launchpat keep their page). The filter can miss some formats, so please do not paste passwords or other secrets into the assistant. Saved questions stay with us and the processors below: never shown to other users or copied into anyone else's answers, and never sold.

Controller: Launchpat (Setpat Technologies, Unipessoal Lda.)
Processors: Supabase (storage) and our AI model providers (see How we use and share your information)
Purpose: finding where the product confuses people; testing assistant changes before they ship
Legal basis: legitimate interest in a working, improving assistant (GDPR Art. 6(1)(f))
Retention: deleted after 90 days, or sooner with your account or the product
Your rights: object, see them, or ask us to erase them sooner: support@setpat.com

API keys

Personal access tokens you create are stored as SHA-256 hashes only. The token itself is shown once and cannot be recovered by us. Revoke any token at any time in the app.

Session recording

With your consent, we record your session (clicks and navigation) using PostHog, with data stored in the EU, to find bugs and improve the product. Your typing and personal information are masked. We do not record the admin console.

Consent is optional: declining does not affect your access to the product. You can withdraw consent at any time from Account settings → Session recording. Recording stops immediately when you withdraw.

Controller: Launchpat
Processor: PostHog (EU region)
Purpose: debugging and product improvement
Legal basis: consent (GDPR Art. 6(1)(a))
Your rights: withdraw consent, access, erasure: contact support@setpat.com

The daily product email

Each product you add can send you a daily product email: a summary of that product's signals, drafts and results, delivered to your account's email address. It is part of the service you signed up for.

When you click a link in one of these emails, we record the click (which kind of link, when, for which product, and your browser's user-agent string) to learn which parts of the email are useful. We use no open-tracking pixels. Click records are deleted after 90 days.

Controller: Launchpat (Setpat Technologies, Unipessoal Lda.)
Processor: Resend (email delivery)
Purpose: delivering the daily product email; improving it via click measurement
Legal basis: contract performance (GDPR Art. 6(1)(b))
Opt out: every email carries an unsubscribe link (one-click in supporting mail clients) and a per-product toggle in the app; unsubscribing takes effect before the next send

Public product facts

To ground drafts, daily emails and strategy on accurate information, we collect and cache publicly available facts about the products you add: your public website content, your public store and channel listings (for example Steam, the App Store, YouTube). When two products point at the same public website or channel, we compute this snapshot once and share the cached copy between them, so it stays fresher and we scrape the public web less.

These cached facts describe the product's public presence, never you: no private account data, no personal information beyond what the public page itself shows. They are used only to generate your launch content and intelligence, never for advertising or profiling.

Purpose: product intelligence (grounding your tasks, drafts, daily emails and strategy)
Legal basis: legitimate interest (GDPR Art. 6(1)(f)): processing information the product's own public pages already publish
Your rights: object, access, erasure: contact support@setpat.com. Deleting a product removes its private brain data; cached facts about a public website or channel persist only while some product still references it.

Public social content we process

launchpat helps product makers find public conversations where their product might genuinely help. To do that, we process a limited amount of publicly posted content from platforms such as Reddit, X, Bluesky, Hacker News, YouTube, Steam, GitHub and public app-store reviews: the post's title or a short excerpt, the posting account's public username, a link to the original post, when it was posted, and public engagement counts. We only access content that is publicly visible without logging in.

What we never do: we do not access private or protected content or direct messages; we do not build profiles of people; we do not link identities across platforms; we do not collect contact details, follower lists or friend graphs; we do not sell or export this data; and no reply is ever sent automatically; any response a launchpat customer sends is written or approved by a human and posted under that customer's own account on the platform itself.

Purpose: surfacing public conversations to the one customer whose product they may concern
Legal basis: legitimate interest (GDPR Art. 6(1)(f)): assessment documented and reviewed
Retention: the full technical copy of a post is deleted after 90 days; the short display record after at most 400 days. Posts deleted on their platform stop displaying when we detect that (we re-check periodically).
Processors: platform-official APIs (e.g. YouTube Data API, Bluesky), xAI (X search), Apify (collection infrastructure for public Reddit listings), Supabase (EU database hosting), and AI model providers used only to judge relevance; we record which provider fetched every stored post.
Your rights: if a public post of yours appears in launchpat and you object (Art. 21) or want it removed (Art. 17), email support@setpat.com with a link to the post; we remove its content from our systems for all customers.

If you choose Continue with Google, Google shares your name, email address and profile picture with us. We use them only to create your launchpat account and sign you in. We ask Google for no other access: we can't read your Gmail, Drive, YouTube or contacts, and we can't post for you. We don't receive your Google password and we don't keep Google access tokens. You can remove launchpat's access at any time at myaccount.google.com/permissions. launchpat's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Sign-in is separate from our YouTube integration, which works as described below.

YouTube API Services

launchpat's YouTube features use YouTube API Services. By using them you also agree to the YouTube Terms of Service; Google's handling of data is described in the Google Privacy Policy.

What we store from YouTube: the video id, title, a short description excerpt, channel name, publish date and public engagement counts (views, likes, comments) at fetch time. Where a channel is one of your product's own sources we also keep a channel snapshot: its handle and id, subscriber and video counts, and the titles and view counts of recent uploads. Everything we hold from the YouTube Data API is deleted or refreshed within 30 days, as the YouTube API Services Developer Policies require for data retrieved without a Google account authorisation: a video item is re-fetched from YouTube before it is 30 days old and its stored title, description excerpt, channel name, publish date and engagement counts are replaced with the current values; a video YouTube no longer returns is deleted in full, and so is any item we could not refresh within 30 days. Other platforms keep their 90-day and 400-day windows. A channel snapshot is replaced by a fresh one on a recurring sweep and removed outright if it has not been refreshed within 30 days, and YouTube entries in your brief archive are refreshed the same way and removed when the video is no longer available or could not be refreshed within 30 days. We never download, re-host or re-publish video or audio content; every card links out to youtube.com.

Our YouTube integration is server-side and reads only public data: we do not ask for, receive or store Google account credentials or OAuth tokens, so there is no per-user YouTube account access to revoke. A customer can remove a connected channel from their product's sources at any time, which stops its fetches; stored YouTube data is deleted on request via support@setpat.com (see "Your rights").

Community intelligence (opt-in)

Optionally, each of your products can contribute anonymized learnings to community intelligence: aggregated playbooks about what works in a niche (for example "indie roguelikes"), shared with other makers building similar products. This is off by default and controlled per product from the Product brain card.

Before anything is shared, contributions pass a sanitization step that strips product names, links and any identifying details, and an aggregate is only published when at least three different accounts contribute to it; your individual data is never exposed. Turning the toggle off, or deleting the product, removes your contribution from the next daily rebuild of the aggregates.

Purpose: product intelligence only; shared learnings are never used for advertising or profiling
Legal basis: consent (GDPR Art. 6(1)(a)), withdrawable at any time per product
Your rights: withdraw consent (the toggle), access, erasure: contact support@setpat.com

We use the information above to operate your account, to gather and score signals for your products, to generate drafts, strategy and product emails, to meter and bill the service, to answer support requests, to keep the service secure and prevent abuse, and to fix bugs and improve the product. We do not sell personal information, and we do not use it for advertising, ad targeting or building advertising profiles.

Internal parties. Setpat Technologies, Unipessoal Lda personnel access your information only where it is necessary to operate, support or secure the service.

External parties. We share information with the following categories of service providers, who process it on our instructions:

Hosting and database: Supabase (EU) and servers we operate in the EU (Germany and Finland).
Payments: Stripe.
Email delivery: Resend.
Product analytics and session recording: PostHog (EU region). Analytics events reach PostHog through a proxy on our own domain; session recording runs only with your consent.
Visitor statistics on public pages: Umami, an open-source analytics tool we run on our own servers. For each page view it records the page address (without its query string), the page title, the site you came from, your browser and operating system, screen size and language, and an approximate location (country, region, city) worked out from your IP address, plus the sign-up steps you take (scan started, result shown, the plan button you clicked on the pricing page, "Create my account" or "Create a free account" clicked, sign-up form sent, the inbox or "Continue" button used, email confirmed, Continue with Google clicked and finished). It sets no cookies, stores nothing on your device and does not keep your IP address; we look at totals, not people. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) in knowing which pages people use and whether sign-up works. Umami records are deleted after 13 months; our database backups of them are kept for 7 days.
Network, CDN and bot protection: Cloudflare (including Turnstile on public pages) and jsDelivr for script delivery.
AI model providers: we send product content and the public content we collect, which can include YouTube video metadata, to AI model providers so it can be scored, summarised and turned into drafts. Providers we use include Anthropic, DeepSeek, xAI and Google.
Data source APIs and collection providers: the platform APIs you configure as sources, including the YouTube Data API, and collection providers such as Apify and Firecrawl.

We also disclose information where the law requires it, and to professional advisers where necessary to meet our accounting and tax obligations.

Ad measurement (Meta, Reddit and Google, opt-in)

On some public pages (the home page, pricing, the free scan and the free tools) we may ask whether we can measure which ads bring people to launchpat. One answer covers three ad tags: Meta Pixel, Reddit Pixel and the Google tag (Google Analytics). Nothing from Meta, Reddit or Google loads until you press Allow. If you press No thanks, or never see the question, all three stay off. They never run on the sign-in, sign-up or password pages, or inside the app.

If you allow it, the tags set cookies (Meta: _fbp; Reddit: _rdt_uuid; Google: _ga, _ga_ plus our measurement id, and _gcl_ cookies when you arrive from a Google ad) and send each company the page you are on (without its query string, apart from ad campaign tags), the page you came from (same treatment), your IP address and browser details, and two events: that you viewed the page and that you started a scan. Pages whose address carries anything else, such as a scan result link, send nothing. Google gets no data for ad personalisation, and Google signals are off.

Sign-ups. If you allowed it in this browser and then create an account, our server tells Meta that an account was created: your IP address and browser details, the _fbp and _fbc cookie values, the ad click id from your campaign tags, and a scrambled (hashed) form of your account number. Reddit gets the same kind of report, with its _rdt_uuid cookie value and Reddit's ad click id. Google gets the ids from its _ga and _ga_ cookies (your browser and your current visit, so the sign-up counts toward the ad that brought you) and that an account was created, nothing else. We do not send your email address, hashed or otherwise. The sign-up page itself still loads nothing from Meta, Reddit or Google.

Purchases. If you allowed it in this browser and then buy a plan or a one-off package and are charged for it, our server tells Meta and Reddit what kind of purchase it was and the amount and currency charged, with the same device details as for sign-ups and the same scrambled account number, and tells Google the same purchase details with the ids from its _ga and _ga_ cookies. A checkout that charges nothing sends nothing. We do not send your email address, name or card details.

Joint controllers: Launchpat with Meta Platforms Ireland Ltd., with Reddit, Inc. and with Google Ireland Limited, each for collecting and sending this data to that company; each company alone for what it does with it afterwards, under its own privacy policy
Purpose: measuring which ads lead to visits, scans, sign-ups and purchases
Legal basis: consent (GDPR Art. 6(1)(a) and the ePrivacy rules on device storage)
Transfers: Meta, Reddit and Google may process the data in the United States under the EU-US Data Privacy Framework
Your choice: kept in your browser's local storage until you change it. Withdrawing removes the three tags' cookies, stops them from loading again (and stops a Google tag already loaded on the page from sending anything more) and stops sign-up and purchase reports for anything you start in this browser afterwards. A checkout you had already opened is still reported once it is paid.

Campaign tags. If you allow it and arrived through one of our ad or campaign links, your browser also keeps that link's campaign tags (utm_*, Meta's fbclid, Google's gclid and Reddit's rdt_cid) and the page you landed on, for up to 90 days (older tags are deleted the next time you open one of these pages). If you then create an account, they are saved with it so we know which campaigns bring sign-ups. A sign-up page opened straight from such a link sends its own tags with the form, with nothing stored in your browser (legal basis: our legitimate interest in knowing which campaigns work). Withdrawing deletes the tags kept in your browser; ask us and we delete the ones saved with your account.

Cookies and device storage

We set no advertising or cross-site tracking cookies unless you opt in to ad measurement, which lets Meta Pixel, Reddit Pixel and the Google tag set theirs. Our own JavaScript sets no other cookies. We do store and read information on your device, and some of our providers do so as well.

Our own browser storage: in your browser's local and session storage we keep your sign-in state (Supabase Auth), interface preferences such as the theme, collapsed panels, hidden tiles and the product you last opened, one-time flags recording that you have seen a tour or tutorial, and short-lived state for the admin console.
Cloudflare: places security and bot-management cookies at the network edge and runs Turnstile on our public scan pages.
PostHog: stores analytics identifiers in local storage on app pages. Autocapture is off; session recording starts only after you grant consent.
Stripe: if you start a checkout, Stripe stores information on its own pages under its own policy.

You can clear this storage at any time in your browser, refuse or withdraw consent for session recording in Account settings and for ad measurement above, and control cookies through your browser settings.

Generated media

Images launchpat generates for a product, and any video clips it generated earlier, are stored in our storage bucket under your account. Links you copy from the app are signed and expire after 7 days. When you attach generated media to a post and confirm it, launchpat sends that media to the platform you post to, in the same way it sends the post text.

Deleting your data and revoking access

Deleting stored data. To have your account deleted, write to support@setpat.com from the address the account uses. We remove your products and their data, including any YouTube API Data held for them, without undue delay and in any event within 30 days. YouTube API Data is deleted within seven calendar days of receiving the request, as the YouTube API Services Terms require. You can also ask us to delete specific data at any time at the same address. You can remove a product yourself in the app at any time: Move to trash keeps it recoverable for 30 days, and Permanently delete erases it and its data. Beyond that, data expires on its own: the full technical copy of a platform item after 90 days and its short display record after 400 days; YouTube data is deleted in full after 30 days (see YouTube API Services). Email click records are deleted after 90 days.

Copies outside the database. Short-lived caches that hold a copy clear within 24 hours; when we erase a public post on request, we clear the caches built from it at the same time. Records of finished background jobs, which can hold a fetched post, are deleted after about a day. Email we have already sent, such as a daily brief that mentioned a post, is in the recipient's mailbox, and we cannot recall it.

Stopping collection. Removing a channel or account from a product's sources stops the scheduled fetches for it; if that channel is also the product's primary URL, change or remove the URL as well, since a product is always monitored at its primary URL. Disconnecting a connected social account disables launchpat's use of it and we ask the provider to revoke the stored token.

Revoking access to your Google account. Our YouTube integration reads only public YouTube data, using a server-side API key, and never requests, receives or stores Google account credentials or OAuth tokens, so it holds no authorization against your Google account. If you use Continue with Google, Google lists launchpat among the apps you sign in to; removing it there stops signing in to launchpat with Google (see Sign in with Google). You can review and revoke any third party's access to your Google account at any time on the Google security settings page at https://myaccount.google.com/connections?filters=3,4&hl=en. To have YouTube data we have already stored deleted, write to support@setpat.com. Deleting the copy we hold does not delete anything from YouTube itself. To remove a video, a comment or a channel from YouTube you must delete it on YouTube, signed in to the Google account that owns it; the YouTube Help Centre explains how.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent: write to support@setpat.com. You can also complain to a supervisory authority; ours is the CNPD (Portugal).