Privacy Policy · Startup Feedback Exchange

Who we are

Startup Feedback Exchange (“we”) operates startupfeedbackexchange.com, a membership network where independent software founders exchange product feedback, testimonials, and launch support. You can reach us at privacy@startupfeedbackexchange.com.

What we collect

Account information from Google or GitHub. When you sign in we receive your name, email address, and profile picture and nothing more. From Google we request only the openid, email, and profile scopes; from GitHub, only your public profile and email address. We do not request, receive, or have any access to your Gmail, Drive, Calendar, Contacts, repositories, or any other Google or GitHub data.
Information you give us. Your application answers, product details, the reviews you write, and the testimonials you submit.
Content you publish through us. URLs of blog posts you publish as part of the content pool.
Technical data. Standard server logs and privacy-respecting product analytics, used to keep the site working and understand which pages are useful.

How we use it

To operate your membership and the programs you take part in.
To send you service email: review reminders, content-pool assignments, launch announcements, and your monthly site audit.
To publish your product listing and approved testimonials on the public directory.
To keep the exchange fair, by tracking review and publishing commitments.

We do not sell your data, and we do not use it to train machine learning models.

What is public

Your product listing (name, tagline, description, category, product URL, and your name as founder) and any testimonials you approve are published on the public directory and are visible to anyone, including search engines and AI crawlers. Private review feedback is never published. It is visible only to you, the founder you wrote it for, and the site administrator.

Screen recordings (Jam)

Reviewers may attach a Jam recording to a review. Jam is a third party with its own privacy policy, the recording lives in the reviewer’s own Jam account, and we store only the link.

A Jam captures far more than the picture on screen. It records the browser console and the network requests the reviewed site makes while you record, along with device details and what you clicked. That can include your own session token, whatever data happens to be on screen, and the internal shape of the reviewed product’s API. Automatic blurring is a paid Jam feature and we do not assume you have it.

So, when recording a review:

Use a throwaway or demo account with invented data. Never record while signed in to anything holding real customer information.
Never record a payment, billing, or card-entry screen.
Treat the link as public. A Jam link is an unlisted URL, not an access-controlled one, so anyone who has it can open it.

We pass the link to the founder whose product you reviewed. Ask us to remove it and we will drop it from the review; deleting the recording itself is done in your own Jam account.

Who processes your data

Supabase: database and authentication hosting.
Vercel: application hosting.
Cloudflare: DNS and bot protection on our forms.
Google: sign-in only, under the limited scopes described above.
GitHub: sign-in only, under the limited scopes described above.
Resend: delivery of the service email described above.
Anthropic: drafts the content-pool posts. It is sent the public description of each product to be featured and the fact that the host recommends it. Your private review notes and the scores you gave are never sent.
Google PageSpeed Insights: runs the monthly Lighthouse audit against your product’s public homepage. It receives the URL and nothing about you.
PostHog: product analytics. Analytics requests are proxied through this domain to PostHog, which stores them, as described under Cookies below.

If we ever begin charging for membership, Stripe will process payment details. We never see or store your full card number.

How long we keep it

We keep your data for as long as you are a member. If you leave, we remove your public listing immediately and delete your account data within 30 days, except where we need to keep records for legal or accounting reasons. Testimonials you wrote for other members remain on their profiles unless you ask us to remove them.

Your rights

You can access, correct, export, or delete your data at any time. Email privacy@startupfeedbackexchange.com and we’ll action it within 30 days. Depending on where you live you may have additional rights under the GDPR or CCPA; we honour those requests regardless of location.

Cookies

We use a session cookie to keep you signed in. That’s required for the site to work.

We also use PostHog for product analytics, which sets a first-party cookie so that repeat visits from the same browser are counted once rather than as new people each time. It records which pages you view and which links and buttons you click, so we can tell which parts of the exchange are actually useful. If you are signed in, those events are linked to your member ID.

While we are still learning how the exchange gets used, PostHog also records session replays: a reconstruction of the public pages you saw and how you moved through them. Everything inside your dashboard and the admin area is excluded from recording, and anything typed into a form anywhere on the site is masked. This is a temporary measure and we will turn it off. If you would rather not be recorded in the meantime, email privacy@startupfeedbackexchange.com and we will exclude you.

Analytics requests are sent to a path on this domain and forwarded from there to PostHog, which stores the data. Nothing is shared with advertisers. We do not use advertising or cross-site tracking cookies, and we do not sell your data.

Children

Startup Feedback Exchange is for people running businesses and is not directed at anyone under 16.

Changes

If we make a material change to this policy we’ll email members before it takes effect.