Privacy Policy

Last updated: 4 October 2026

This Privacy Policy explains what data IntentHunter (“we”, “us”) collects when you use the service, how we use it, who we share it with, and the rights you have over it. IntentHunter is the data controller.

1. What we collect

Account information. When you sign up, we collect your email address, name (optional), browser timezone, and a password hash. If you sign in via OAuth, we receive the provider’s basic profile fields.

Project data. Anything you submit while setting up and managing projects: project name, website URL, product description, ICP description, tracked keywords, competitor names, alert preferences, score thresholds.

Integration credentials. OAuth tokens for Slack and Discord, bot identifiers for Telegram, webhook URLs, and the SHA-256 hashes of any MCP tokens you generate. We never store plaintext MCP tokens — the raw value is shown once at creation.

Generated signals. Threads we collect from public platforms (Reddit, Hacker News, X, YouTube, Bluesky, LinkedIn) that match your project, plus the scores, intent classifications, and AI-generated summaries we produce. We also store your status changes (saved, contacted, ignored).

Usage data. IP address, browser/device details, request timestamps, and basic event logs we use to debug and improve the service.

Billing data. Handled by Stripe. We receive billing email, subscription state, and an opaque customer identifier — not your full card details.

2. How we use it

We use this data to:

• Run the service: scanning for signals, scoring them against your project, delivering alerts to the destinations you configure
• Authenticate you and secure your account
• Process payments and manage subscriptions
• Send transactional and product email (password resets, billing receipts, scan-complete notifications)
• Diagnose bugs, monitor uptime, and improve our scoring and product
• Comply with our legal obligations

We do not sell your data, and we don’t use your project data or signals to train shared AI models.

3. Public platform content

IntentHunter monitors publicly available threads on third-party platforms (Reddit, Hacker News, X, YouTube, Bluesky, LinkedIn) via their public APIs or our crawlers. We respect platform terms and rate limits. We surface this public content back to you — we don’t share your data with those platforms in return.

4. Sub-processors

We use the following providers to run the service. Optional Meta advertising measurement is described separately in section 7 and requires separate marketing consent:

• AI model providers (OpenAI and Anthropic) — Receive the content of monitored threads (titles, bodies, URLs) together with your project description, ICP, and keywords so IntentHunter can score relevance, classify intent, and generate summaries. Structured generation is routed through our self-hosted OctoRouter service; embeddings continue to use the OpenAI API. Provider processing is governed by the applicable account settings and provider terms.
• Stripe — Processes payments and stores card information directly. We don’t see your full card details.
• Slack, Discord, Telegram — When you connect an integration, we send signal payloads (source, title, score, link, summary) to the channels/chats you authorize.
• Email delivery provider — Sends transactional and digest emails on our behalf.
• PostHog — Only after separate product-analytics permission, receives selected action names and a random identifier kept in memory for the current page. It also receives normal connection details such as IP address and user agent. We do not send account identifiers, names, emails, project content, page URLs or referrers in this analytics stream.
• Hosting / infrastructure provider — Hosts the database and application servers.
• Error monitoring — May receive sanitized error reports including request paths and stack traces.

We use commercially reasonable diligence to pick sub-processors with strong privacy and security practices.

5. Retention

• Account and project data — Kept while your account is active. Deleted within 30 days of account deletion.
• Generated signals — Retained for the life of the project unless you delete the project or signal.
• MCP tokens — Only the SHA-256 hash is stored, indefinitely or until you revoke the token.
• Billing records — Retained as long as required by tax and accounting law (typically 7 years).
• Usage logs — Retained for up to 90 days, then aggregated or deleted.

6. Your rights

Depending on where you live (GDPR, CCPA, UK DPA, and similar laws apply), you can:

• Access the data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent to optional processing at any time
• Lodge a complaint with your local data protection authority

Most of these you can do directly from settings (delete account, revoke tokens, disconnect integrations). For anything else, contact our support team from within IntentHunter and we’ll respond within 30 days.

7. Cookies

We use cookies to keep you signed in, remember preferences, and protect against CSRF attacks. Product analytics and advertising measurement have separate choices; accepting analytics does not permit advertising measurement.

Optional product analytics requires a new, separate choice in Privacy choices; previous analytics-storage consent does not grant it. We remember this choice in a first-party cookie for 30 days. A local-storage preference notification helps notify other tabs; no analytics events or analytics identity are stored there. With permission, we send only allowlisted action names to PostHog, such as project creation, viewing a signal, starting checkout, free-scan steps and agency inquiries. Event properties supplied by the application are discarded. A random page identifier is kept only in memory; there is no persistent analytics identity, account identification, automatic page tracking, session recording or PostHog JavaScript SDK. Requests omit browser credentials and referrers, although PostHog still receives connection details such as IP address and user agent. Events before permission are discarded and are not replayed. Withdraw in Privacy choices to stop new sends and cancel pending requests where possible. Other open tabs using these controls receive the withdrawal signal and also check the saved choice before sending. Requests already received cannot be recalled. If your browser refuses to save withdrawal, analytics stops for the current page and we ask you to clear this site’s cookies before reloading. We clear accessible legacy PostHog storage for this integration where the browser permits it; previously stored provider data is not automatically deleted.

Optional Meta advertising measurement is disabled by default. If enabled, it requires a separate marketing choice in Privacy choices. With that permission we send limited account-created, project-activation, trial-started and confirmed-payment events to Meta, including a random event identifier and payment amount/currency where applicable. Meta also receives browser connection details such as IP address and user agent and may use its own cookies. We do not send names, emails, private project content, account identifiers, or private page URLs to Meta. We do not load Meta’s JavaScript library or enable automatic matching or automatic events. Withdraw permission in Privacy choices to stop future requests; withdrawal cannot erase information Meta already received.

If local measurement is enabled, we count completed account creation, project activation, trials and confirmed payments in our own database, using internal account or billing references. With separate campaign-attribution permission, we remember an approved campaign code in the first-party session for up to 30 days and associate it with your account when signed in. Attribution covers events occurring after that consented visit and within the following 30 days; it does not prove that an advertisement caused an event. We discard other campaign parameters and do not store click IDs, referrers or page URLs in these measurement records. Rejecting or withdrawing this permission prevents new campaign associations. When signed in, it also ends attribution of later events for account or billing associations you authorized. If signed out, sign in or contact support to end an existing account association. Previously recorded local history is not automatically erased. Contact support to request deletion. Direct account references, campaign associations and payment values in measurement history are cleared after 90 days. We retain event types, timestamps and hashed identifiers to prevent duplicate conversions. These retained records are pseudonymous, not anonymous: they can still be linked to the underlying account or billing record by someone with access to those records.

8. Security

We hash passwords, store sensitive credentials (OAuth tokens, webhook URLs, MCP tokens) encrypted or hashed, enforce TLS in transit, and limit internal access on a need-to-know basis. No system is perfectly secure — if you believe your account has been compromised, contact our support team from within IntentHunter immediately.

9. International transfers

Our infrastructure and sub-processors may process your data outside the country you live in. Where required, we rely on standard contractual clauses or equivalent safeguards.

10. Children

IntentHunter is not directed at people under 18, and we do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or a prominent notice on this page. The “Last updated” date at the top will always reflect the current version.

12. Contact

For privacy questions or requests, contact our support team from within IntentHunter.