Privacy Policy

ScrollLaunch is a launchpad for indie makers and SaaS founders. We try to collect the least amount of personal data required to run the Service, we do not sell your data, and we use privacy-friendly analytics alongside standard web measurement.

• We use Google OAuth (via NextAuth) for sign-in - we never see your password.
• We use Datafa.st and Ahrefs Web Analytics for cookie-free aggregate analytics.
• We use Google Analytics 4 (Google LLC) for standard web traffic measurement - it may set first-party analytics cookies such as _ga.
• We use Dodo Payments for payments - card details never touch our servers.
• Product content, comments, and reviews you publish (name, tagline, description, logo, website URL, discussion text, star rating, and written review) are intentionally public - that is the whole point of the Service.
• Comments and reviews may not contain links or URLs; we filter them to prevent spam and backlink abuse.

The data controller is ScrollLaunch, reachable at kalash@scrolllaunch.com. For GDPR purposes you can use the same address for data-subject requests; we respond within 30 days.

Account data (from Google OAuth): your name, email address, profile picture URL, and a stable Google account identifier. We receive this from Google when you sign in; we do not receive your Google password.

Maker profile: display name, username, bio, headline, location, public country, company, and any social links you choose to add on your dashboard. Public country defaults to the ISO country we detected at signup (from hosting geo headers, not your IP) and can be changed after your first live launch. Optional city / region (location) is stored for our records only and is not shown on the public maker page; that page shows public country.

Product submissions: product name, tagline, description, logo, screenshots, website URL, categories, audience tags, launch week, FAQ, "alternative-to" fields, and any other fields you fill in at submission or edit time.

Engagement signals: upvotes you cast, products you submit, product pages you visit while signed in, comments or nested replies you leave (comment body text, parent comment id if any, and your display name / profile image snapshot at post time), and product reviews you publish (star rating, written review, and the same display snapshot). Upvotes, visits, comments, and reviews are tied to your account.

Billing data: when you purchase Premium, Premium, or an advertising placement, Dodo Payments processes the transaction and sends us a transaction ID, product ID, status, and billing email. Card numbers, CVV, and bank credentials are never received or stored by us.

Technical data: IP address, user-agent, timestamps, and pages requested - collected in server logs for security, abuse prevention, and debugging. Logs are retained for up to 30 days unless needed for an active investigation. At signup we store an ISO 3166-1 alpha-2 country code derived from the request geo headers (Vercel or Cloudflare). We do not store the raw IP for that fingerprint. That signup country is not published; your public country on the maker profile is the field you can edit after a live launch.

Analytics (aggregate only): Datafa.st and Ahrefs Web Analytics give us cookie-free, aggregated stats - page views, referrer, country, approximate device/browser. Google Analytics 4 (Google LLC) provides additional aggregate traffic measurement and may set first-party analytics cookies (e.g. _ga) to distinguish sessions. We do not use these services for advertising, cross-site tracking, or fingerprinting.

• Operate your account and authenticate you on return visits.
• Publish your product listings, leaderboards, and maker profile - a core, user-requested function.
• Rank, moderate, and feature products - including anti-fraud and anti-abuse checks. We analyse upvote patterns, comment and review text (for example, to block URLs and detect copy-pasted promotional spam), account signals, and email addresses (for example, to detect disposable / temporary "temp mail" domains, duplicate accounts, and coordinated or automated voting) to keep rankings, discussion, and star ratings honest and enforce our Terms. We may permanently purge an abusing account and delete associated products, comments, reviews, votes, visits, notifications, and sessions.
• Send transactional emails about activity on your products (for example, a new comment, reply, or review), subject to your notification preferences. Comment and review bodies in those emails are escaped as plain text and URL-like spans are stripped or neutralised.
• Process payments, grant access to paid features, and send transactional emails (purchase receipts, launch-day confirmations).
• Publish launch blog posts for Premium listings automatically once the product is live and its launch week has started.
• Send the weekly "launched this week" digest only to users who have opted in (you can unsubscribe from any issue).
• When you create a ScrollLaunch account, add your email to the operator's ScrollLaunch Substack newsletter so you receive maker and launch-tactics content. You can unsubscribe from Substack directly at any time.
• Measure aggregate performance of the Service (traffic, conversion, feature usage).
• Comply with legal obligations and enforce our Terms of Service.

• Contract (Art. 6(1)(b)): operating the account, publishing listings you submitted, processing payments.
• Legitimate interest (Art. 6(1)(f)): security, abuse prevention, aggregate analytics, product improvement.
• Consent (Art. 6(1)(a)): the weekly digest newsletter.
• Legal obligation (Art. 6(1)(c)): tax records, fraud investigations, lawful requests.

We share data with a small set of vetted processors. We do not sell personal data, we do not share it with ad networks, and we do not allow our processors to use your data for their own marketing.

• Vercel Inc. - hosting and edge delivery (served from global PoPs).
• MongoDB Atlas - primary database (MongoDB Atlas).
• Cloudinary - image and logo storage/CDN.
• Dodo Payments - payment processing; they are an independent controller for card data.
• Google (NextAuth) - OAuth sign-in.
• Datafa.st - cookie-free aggregate analytics.
• Ahrefs Web Analytics (Ahrefs Pte. Ltd.) - cookie-free SEO and traffic analytics.
• Google Analytics 4 (Google LLC) - web traffic measurement; may set first-party analytics cookies.
• Affonso - affiliate referral attribution. Sets a first-party affonso_referral cookie (30-day lifespan) when you arrive via a partner link, so commissions can be credited on Dodo Payments checkouts (Premium, ads, directory plans). See Affiliates.
• OpenAI - to write the included Premium launch blog (product details and the live website), and when you use AI form prefill.
• Substack - when you sign up for ScrollLaunch, we pass your email (and name, if provided by your sign-in provider) to the operator's ScrollLaunch newsletter on Substack so you receive that publication's emails. Substack processes subscription data under its own Privacy Policy.
• Law enforcement and courts - only when legally compelled, and we will challenge overbroad requests.
• Acquirer / successor - in the event of a merger, acquisition, or asset sale, your data may be transferred subject to equivalent protections.

Our processors operate globally, which means your data may be transferred to and processed in the United States, the European Union, and other jurisdictions. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.

• Account data: kept while your account is active. When you delete your account from the dashboard (or we purge it for Terms violations), we delete the account record and associated personal data we control - including products, comments, reviews, votes, signed-in product visits, notifications, directory submissions tied to you, and auth sessions - promptly from live systems. Residual backups purge within about 30 days, except where retention is required by law (e.g. tax / payment records for up to 7 years) or for security and moderation audit logs.
• Product listings: if you delete a single product (or we remove it for moderation), it is removed from live surfaces promptly; related votes, comments, and reviews on that product are cleaned up with it. Backups purge within about 30 days.
• Comments: stored while the comment remains on a live product page. Deleted with the comment, the parent thread (when cascade-deleted), the product, or the author's account.
• Product reviews: stored while the review remains published or hidden on /products/[slug]/reviews. Deleted with the review, the product, or the author's account. Hidden reviews stay in our systems for moderation until deleted.
• Server logs: 30 days, longer only for active security incidents.
• Billing records: retained for the period required by applicable tax and accounting law.
• Admin / moderation audit logs: retained as needed to investigate abuse and demonstrate enforcement of our Terms.
• Published launch blog posts: remain published unless you request removal or we remove them for Terms violations; the generation prompt/response pair is not retained once the post is stored. Posts tied to a purged product are removed with that product.

Depending on where you live (EU/UK, California, India, and many other jurisdictions), you have some or all of the following rights:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated personal data ("right to be forgotten") from dashboard settings, or by emailing us.
• Restrict or object to certain processing.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time for consent-based processing (e.g. newsletter).
• Lodge a complaint with your local supervisory authority (e.g. an EU DPA).

To exercise any right, email kalash@scrolllaunch.com. We may ask you to verify ownership of the account.

We use strictly-necessary, first-party cookies for session management (NextAuth) and CSRF protection. We also use Google Analytics 4 measurement cookies for aggregate traffic reporting - not for advertising - and an optional Affonso referral cookie (affonso_referral) when you arrive via a partner link. See our Cookie Policy for the full list.

We use TLS in transit, encrypted storage at rest with our infrastructure providers, least-privilege access control, and automated dependency scanning. No online service is perfectly secure; if you discover a vulnerability, please report it privately to kalash@scrolllaunch.com.

The Service is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has given us data, please email kalash@scrolllaunch.com and we will delete it.

We do not serve third-party ads. Google Analytics 4 may set first-party analytics cookies; Google may honour Do Not Track and Global Privacy Control signals depending on your browser and region. We still honour deletion and opt-out requests on the merits, regardless of browser signal.

We may update this policy as the Service evolves. If changes are material, we will update the "Last updated" date at the top of this page and, where practical, notify registered users by email before the change takes effect.