Privacy Policy

Account details. Your email address, and a password that is hashed — we never see or store the plain text. If you sign in with Google we receive your email, name and profile picture from Google, and nothing else.

What you tell the product. Your onboarding answers (your niche, audience, experience, goals, hours, pricing), the public Skool URL you paste, and any notes, documents or files you upload as background material.

What the product makes. Your blueprint, generated posts, scripts, setup assets and anything else the AI produces for you.

Billing records.Your plan, credit balance, how many blueprints you've used, and identifiers linking you to your Stripe customer and subscription. We never receive or store your card number — Stripe handles payment details directly.

Technical data. Standard server and security logs from our host, such as IP address, browser type and timestamps.

This is unusual enough to call out. Much of what you create — your blueprint, saved ideas, generated library, course progress, settings and the metrics you type in — is stored in your own browser's local storage, not on our servers. That means:

• It stays on that device and in that browser. It doesn't follow you to another computer.
• Clearing your browser data deletes it, and we cannot recover it for you.
• We cannot read it from our side.
• Content is sent to our servers only at the moment you ask for something to be generated.

Your account record — your email, plan and credit balance — is held on our servers so your plan works wherever you sign in.

• To run the service: generate your blueprint and content, and show you your work.
• To manage your account, plan, credits and payments.
• To reply when you contact support.
• To keep the service secure, detect abuse and prevent fraud.
• To meet our legal and accounting obligations.

Where the GDPR applies, we rely on performance of a contract for running the service and billing, legitimate interests for security and abuse prevention, and legal obligationfor financial records. We don't use your content for advertising or profiling.

To generate anything, we send the relevant parts of what you've given us — your answers, uploaded material and scraped public community data — to Anthropic's Claude API, which returns the result. Under Anthropic's commercial terms, inputs and outputs sent through the API are not used to train their models.

Please don't paste anything into the product that you wouldn't want processed this way — in particular other people's personal information, payment details, passwords, health records or government ID numbers. The product never needs any of that.

We use these providers, each only for the purpose listed:

• Supabase — accounts, sign-in and our database, plus brief storage of files you upload.
• Anthropic — AI generation, as described above.
• Stripe — payments and subscriptions. Stripe is the controller of your payment-card data under its own privacy policy.
• Vercel — hosting and delivery of the website.
• Apify — fetching public information from the Skool community URL you provide. Only that public URL is sent.
• Google— sign-in if you choose it, and, only if you connect it, read access to Google Drive files you explicitly select. We read the files you pick in order to extract their text, and we don't browse the rest of your Drive.
• Canva — only if you choose to connect it, to help design covers.

We may also disclose data if the law requires it, to enforce our Terms, or to protect our rights or someone's safety. If the business is ever sold or merged, your data may transfer with it, and we'll tell you first. We do not sell your personal information, and we don't share it for cross-context behavioural advertising.

We use cookies only to keep you signed in and to keep the service secure. We run no advertising, analytics or third-party tracking cookies, which is why you aren't asked to accept a cookie banner. Blocking essential cookies will stop sign-in from working.

• Files you uploadare deleted from storage as soon as the text has been extracted from them — they aren't kept.
• Account and billing records are kept while your account is open, and afterwards only as long as tax and accounting law requires.
• Work stored in your browser stays until you clear it. That one is in your hands, not ours.

Wherever you live, you can ask us to show you the personal data we hold about you, correct it, delete it, or send you a copy. Email hello@communityhq.ioand we'll respond within 30 days. Deleting your account removes your account record and credit ledger from our database.

If you're in the UK or EEA you also have the right to object to or restrict processing, to withdraw consent for optional integrations at any time, and to complain to your data protection authority. If you're in California, you have the rights to know, delete, correct and opt out of sale or sharing — we don't sell or share, so there's nothing to opt out of — and we won't treat you differently for exercising them.

We use encryption in transit, hashed passwords, access controls and private storage. No system is perfectly secure, so we can't guarantee absolute security, but we'll notify affected users and the relevant authority without undue delay if a breach puts your data at risk.

Our providers are based in the United States, so your data is processed there. If you're in the UK or EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

The service isn't for children under 16. We don't knowingly collect their data, and we'll delete it if we discover we have.

If we change this policy materially we'll tell you by email or in the app before it takes effect. For any privacy question or request, contact Concentric Solutions Group LLC at hello@communityhq.io.