Privacy Policy

1. Who we are

LaunchPist ("LaunchPist", "we", "us") provides software-as-a-service tools for app marketing, hosted at launchpist.com. We are the data controller for the personal information described below. For any privacy question, write to privacy@launchpist.com.

2. Information we collect

Account data

• Email address, full name, and password hash (or Google OAuth identity)
• Workspace name and team member roles
• Profile preferences and locale

Billing data

• Plan, subscription status, trial dates, billing interval, and Stripe customer/subscription IDs
• Payment card details are entered directly into Stripe and are never stored on our servers. We only see a reference token and the last four digits.

App and content data you provide

• Apps you connect: App Store / Google Play listings, names, icons
• Brand assets, voice guidelines, target keywords, competitors, and other inputs you upload for content generation
• Articles, social posts, ad creatives, and emails generated by the platform

Integration tokens

• Encrypted OAuth tokens for Google Search Console, X (Twitter), and LinkedIn when you connect those accounts
• App Store Connect API keys (.p8 files) and Google Play service account JSON, used only to fetch performance metrics for apps you own. These are encrypted at rest with AES-256-GCM.

Usage and device data

• Pages visited, actions taken in the dashboard, and feature usage
• IP address, browser type, device model, and approximate location
• Cookies and similar technologies for sign-in sessions and analytics

3. How we use your data

• To provide, maintain, and improve the service you signed up for
• To generate marketing content (articles, posts, ad copy, emails) on your behalf using third-party large language models
• To process payments and manage your subscription
• To send transactional emails (sign-in, billing, product updates)
• To detect, prevent, and respond to abuse, fraud, and security incidents
• To comply with legal obligations

4. Legal bases (GDPR / UK GDPR)

If you are in the EEA or UK, we rely on these legal bases:

• Contract: to deliver the features you subscribe to.
• Legitimate interests: to keep the product secure, analyze usage, and improve features.
• Consent: for optional marketing emails and certain cookies, where required.
• Legal obligation: tax, accounting, and law enforcement requests.

5. Sub-processors and third parties

We use carefully selected vendors to operate LaunchPist. They process data on our behalf under data processing agreements:

• Cloudflare (USA / global edge): hosting, CDN, DDoS protection
• Supabase (USA): authentication, primary database, file storage
• Stripe (USA): billing, payments, invoicing
• Resend (USA): transactional and waitlist email delivery
• PostHog (USA / EU regions): product analytics
• OpenAI, Anthropic, and other LLM providers: text and image generation. Inputs you provide for content generation are sent to these providers for processing only and are not used by them to train public models when run through our enterprise endpoints.
• Google, Apple, X (Twitter), LinkedIn: only when you explicitly connect those integrations.

6. International transfers

LaunchPist is operated globally. Data may be transferred to and stored in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

7. How long we keep data

• Account data: while your account is active, then up to 90 days after deletion request.
• Billing records: retained for at least 7 years to meet tax and accounting obligations.
• Generated content and app metrics: deleted within 30 days after you delete the app or close your workspace.
• Backups: encrypted backups may persist for up to 30 days after primary deletion.

8. Your rights

You can:

• Access and download your data from the dashboard.
• Correct inaccurate information from your profile and workspace settings.
• Delete your account at any time. We will erase your data in line with section 7.
• Object to or restrict certain processing.
• Withdraw consent for optional marketing emails using the unsubscribe link.
• Lodge a complaint with your local data protection authority. We hope you talk to us first at privacy@launchpist.com.

9. Security

We use TLS in transit, AES-256-GCM for sensitive credentials at rest, Row Level Security on the database, role-based access for staff, and regular vendor reviews. No system is perfectly secure, so we encourage you to use a strong unique password and enable Google sign-in where possible.

10. Children

LaunchPist is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it.

11. Cookies

We use a small number of cookies for authentication sessions, security, and product analytics. Essential cookies are always on; analytics cookies can be disabled via your browser settings. We do not use third-party advertising cookies.

12. Changes to this policy

When we make material changes, we will post a notice in the dashboard and update the "Last updated" date above. Continued use of the service after changes means you accept the new policy.

13. Contact

Questions, requests, or complaints? Email privacy@launchpist.com. We respond to privacy requests within 30 days.