Privacy Policy

What we collect

Account information. Your email address, display name, and password (stored only as a hash — we never see it). Your confirmation that you are 18 or over, with the date and time you confirmed it.

Profile information. Anything you choose to put on your profile: a headline, a pitch, niches, the kinds of collaboration you are looking for, languages, country, and any images you upload.

Linked platform data. When you connect a YouTube, X, Instagram or TikTok account, we read and store: your stable platform user ID, your handle, display name, avatar URL, public follower count, public content count, the public URL of your profile, and the IDs of your recent public uploads (so your profile card can show your work). We store access and refresh tokens so we can refresh those numbers, encrypted at rest with AES-256-GCM.

Google user data. Signing in with Google gives us your name, email address, and profile picture. Linking a YouTube channel uses the YouTube Data API with the read-only scope to access your channel’s public details: channel ID, title, handle, avatar, subscriber count, video count, and the IDs and titles of your recent public uploads. We use this data for exactly one purpose — showing your verified channel and your work on your CollabTab profile so other creators can evaluate a collaboration. We never post to, modify, or delete anything on your YouTube channel, and we do not sell, transfer, or use Google user data for advertising. CollabTab’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect at any time from Settings → Connections inside CollabTab (which deletes the stored tokens), or revoke CollabTab’s access from your Google account permissions.

We do not read your private messages, your analytics, your email, your contacts, or your unpublished content on any platform. We do not post anything anywhere on your behalf, ever.

Activity. Who you swiped on and in which direction, your matches, the messages you send within CollabTab, reports you file, and the last time you were active.

Technical data. IP address and user agent for the sessions you sign in with, used for security and abuse prevention.

Why we collect it

• To run the service. Follower counts and niches are what the matching queue ranks on. Without them there is no product.
• To keep it trustworthy. A verified follower count from the platform itself is the reason a profile here means more than a self-reported number.
• To prevent abuse. We store a one-way keyed hash of each linked platform account ID so that our free-tier limits cannot be reset by deleting an account and signing up again. This hash is not reversible and does not contain your platform ID.
• To keep people safe. Reports, blocks, and content moderation.
• To take payment, if you subscribe.

Who we share it with

We do not sell your data. We share it only with the processors that run the service:

• Supabase — database, file storage, and realtime messaging
• Vercel — application hosting
• Stripe — subscription payments (Stripe receives your email and billing details; we never see or store your card number)
• Resend — transactional email
• Upstash — rate limiting
• Sentry — error reporting
• PostHog — product analytics
• Sightengine — automated image moderation for uploaded profile images
• Cloudflare — DNS and bot protection

Other CollabTab users see your profile: your display name, headline, pitch, niches, collab types, linked platform handles and follower counts, images, and general region. They do not see your email address, your exact location, or who else you have swiped on.

Who can see that you liked them

Nobody, unless they like you back. Subscribers can see a list of people who have already liked them; free users see only the number. Either way, a like never becomes a conversation until both people have swiped right.

How long we keep it

We keep your data while your account is open. When you delete your account, we remove your profile from view immediately and permanently erase your data within 30 days.

Two things outlive deletion, and we want to be direct about both. First, the one-way hash of your linked platform IDs and the count of free likes spent against them — this is what stops the free tier being reset by re-registering, and it cannot be used to identify you or to reconstruct your platform account. Second, records we are legally required to keep, such as payment and tax records held by Stripe.

Messages in a conversation are retained while either participant still has an account, so that a report can be investigated. Unmatching hides a conversation from both people without deleting it.

Your rights

You can access, correct, export, or delete your data at any time from your account settings, or via the data deletion page, which works whether or not you can sign in. Depending on where you live you may also have the right to object to processing, restrict it, or complain to a supervisory authority.

Disconnecting a platform account revokes our access token where the platform supports it and deletes the stored profile data and tokens for that platform.

Children

CollabTab is for people aged 18 and over. We ask you to confirm this at signup and record when you did. If we learn that an account belongs to someone under 18, we close it and delete the data.

International transfers

Our processors operate in the United States and the European Union. Where data is transferred out of the UK or EEA, it is done under Standard Contractual Clauses or an adequacy decision.

Changes and contact

If we change this policy materially, we will tell you by email before the change takes effect. Questions, or to exercise any right above: privacy@collabtab.app.