Privacy policy

What we collect

• Account details: your email, name, handle, photo, links and settings.
• Connected sources: read-only access to the sources you connect. Proof reads order and payment totals, refunds and the account name, and uses customer details inside orders only to calculate totals. Access keys are encrypted. We never get your passwords, card numbers or the ability to move money.
• Records: the figures Proof checks, how you chose to show them, and their check history.
• Activity: follows, requests, notifications you choose, and a security log of sign-ins and account changes.
• Technical data: IP address, browser and device details, kept in server logs for security and debugging.
• Messages: what you send us, like waitlist sign-ups and access requests.

Why we use it

• To run Proof: verify figures, show what you publish, and send the notices you turn on.
• To keep accounts and the service safe, and prevent fraud and abuse.
• To bill paid plans.
• To meet legal duties.

What's public

Only what you publish: your profile and the records you choose to share, shown the way you picked. Unpublished data, exact figures you chose to hide, connections and settings stay private. You can hide your profile from Explore in Settings → Privacy.

Who helps us run Proof

We share data only with providers that run parts of the service for us, and only what they need:

• Supabase: database and sign-in
• Vercel: hosting
• Stripe: payments for paid plans
• Resend: email
• Your browser's push service: notifications you turn on
• Anthropic: AI features, if you use them. Only public records or your own data are sent, and never for training.
• The sources you connect (like Stripe, Shopify, Whop, Gumroad, Square, Lemon Squeezy, Paddle, Polar, Fanvue, Plaid, Phantom and X), to read data you authorized

We may also share information if the law requires it, or to protect people's safety or our rights.

How long we keep it

We keep your data while your account is open. When you delete your account, we delete your profile, records and connection keys, except what we must keep for legal, billing or security reasons. Disconnecting a source deletes its stored keys right away.

Your choices and rights

• Download a copy of your data in Settings → Your data.
• Delete your account in the same place.
• Correct your details in Settings.
• Control notifications and emails in Settings → Notifications, or from the unsubscribe link in any email.
• Withdraw any published record from your workspace.

Depending on where you live (for example the EU, UK or California), you may have more rights, such as objecting to some uses. We honor them. We don't sell or share personal information for advertising.

Security

Read-only access, encrypted keys, and row-level security on every table. Details on our security page.

Children

Proof isn't for anyone under 18.

Changes

If we change this policy in a way that matters, we'll tell you before it takes effect.