Privacy Policy

Who we are

CollabTab is operated by its developer. For anything in this document, write to privacy@collabtab.app (privacy) or support@collabtab.app (everything else). A person reads both.

What we collect

Account information. Signing in with Google gives us your name, email address, and profile picture. There is no password: Google handles the sign-in. We also record your confirmation that you are 18 or over and accept these terms, with the date and time you gave it.

Profile information. Anything you choose to put on your profile: a headline, a bio, tags, the kinds of collaboration you are looking for, languages, country, and any images you upload.

Linked platform data. When you connect a YouTube, X, Instagram or TikTok account, we read and store: your stable platform user ID, your handle, display name, avatar URL, public follower count, public content count, the public URL of your profile, and the IDs of your recent public uploads (so your profile card can show your work). We store access and refresh tokens so we can refresh those numbers, encrypted at rest with AES-256-GCM.

Google user data. Linking a YouTube channel uses the YouTube Data API with the read-only scope to access your channel’s public details: channel ID, title, handle, avatar, subscriber count, video count, and the IDs and titles of your recent public uploads. We use this data for exactly one purpose: showing your verified channel and your work on your CollabTab profile so other creators can evaluate a collaboration. We never post to, modify, or delete anything on your YouTube channel, and we do not sell, transfer, or use Google user data for advertising. CollabTab’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Because CollabTab uses YouTube API Services, the Google Privacy Policy also applies to the data Google holds. You can disconnect at any time from Settings → Channels inside CollabTab, which deletes the stored tokens and channel data, or revoke CollabTab’s access from your Google account permissions. Stored YouTube data is refreshed or deleted within 30 days.

How we protect Google user data. Google user data is sensitive, and we protect it in four ways. In transit: every connection between you, CollabTab and Google is encrypted with HTTPS (TLS), and browsers are instructed to refuse unencrypted connections to CollabTab. At rest: our database is encrypted at rest by our hosting provider, and the access and refresh tokens that let CollabTab read your YouTube channel are additionally encrypted by the application with AES-256-GCM before they are stored, using a key kept outside the database. Access: Google user data is never sent to the browsers of other users beyond the public channel details shown on your profile, access to production systems is limited to the operator, and we do not let people read Google user data except with your consent, for security purposes, or to comply with the law. Deletion: disconnecting a channel or deleting your account removes the stored tokens and channel data.

We do not read your private messages, your analytics, your email, your contacts, or your unpublished content on any platform. We do not post anything anywhere on your behalf, ever.

Activity. Who you swiped on and in which direction, your matches, the messages you send within CollabTab, reports you file, and the last time you were active.

Technical data. IP address and user agent for the sessions you sign in with, used for security and abuse prevention.

What we deliberately do not collect. No precise location, no contacts, no device identifiers, no data from other apps, and no content from other platforms beyond the public channel details listed above.

Why we collect it, and on what basis

• To run the service (performance of our contract with you). Follower counts and tags are what the matching queue ranks on. Without them there is no product.
• To keep it trustworthy (legitimate interest). A verified follower count from the platform itself is the reason a profile here means more than a self-reported number.
• To prevent abuse (legitimate interest). We store a one-way keyed hash of each linked platform account ID so that our free-tier limits cannot be reset by deleting an account and signing up again. The hash is not reversible and does not contain your platform ID.
• To keep people safe (legitimate interest and legal obligation). Reports, blocks, and content moderation.
• To take payment, if you subscribe (contract).
• To understand how the product is used (consent, for browser analytics cookies; legitimate interest, for the server-side product events described under Cookies).

Cookies and analytics

We set a small number of cookies, all of them listed with their purpose and lifetime in the Cookie Policy. Essential cookies keep you signed in and protect the channel-linking flow. Analytics cookies are set only if you accept them in the banner, and we treat a Global Privacy Control signal as a refusal. There are no advertising cookies.

Separately from cookies, our servers record product events against your account ID: that you signed up, linked a channel, completed a profile, swiped, matched, sent a first message, hit the free-tier limit, or changed subscription. These go to PostHog with your account ID and the event, never with the content of a message or the identity of the person you swiped on. We use them to see where the product loses people.

Who we share it with

We do not sell your data and we do not share it with advertisers. We share it only with the processors that run the service, each bound by a data-processing agreement:

• Google — sign-in, and the YouTube Data API when you link a channel
• Supabase — database, file storage, and realtime messaging
• Vercel — application hosting
• Stripe — subscription payments. Stripe receives your email and billing details; we never see or store your card number
• Resend — transactional email
• Upstash — rate limiting
• Sentry — error reporting, with personal data scrubbed from reports
• PostHog — product analytics, as described above
• Sightengine — automated moderation of uploaded profile images (it receives the image, nothing else)
• Cloudflare — bot protection on the public data-deletion form

Other CollabTab users see your profile: your display name, headline, bio, tags, collab types, linked platform handles and follower counts, images, and general region. They do not see your email address, your exact location, or who else you have swiped on.

We disclose data to authorities only when the law requires it, and we will tell you when we are allowed to.

Who can see that you want to collab with them

Nobody, unless they swipe right back. Subscribers can see a list of creators who already want to collab with them; free users see only the number. Either way, a right-swipe never becomes a conversation until both people have swiped right.

How long we keep it

We keep your data while your account is open. When you delete your account, we remove your profile from view immediately and permanently erase your data within 30 days: your profile, images, linked platform data and tokens, swipes, subscription record, blocks, and sessions, together with your name, email address and picture.

Three things outlive deletion, and we want to be direct about all of them. First, the one-way hash of your linked platform IDs and the count of free collabs spent against them: this is what stops the free tier being reset by re-registering, and it cannot be used to identify you or to reconstruct your platform account. Second, records we are legally required to keep, such as payment and tax records held by Stripe. Third, messages you sent inside a match remain visible to the person you sent them to, and reports about an account remain with our moderation records; both are shown as coming from “Deleted creator” and are no longer linked to your name or email.

Unmatching hides a conversation from both people without deleting it, so that a report filed afterwards can still be investigated.

Your rights

You can access, correct, export, or delete your data at any time from your account settings, or via the data deletion page, which works whether or not you can sign in. You can turn off notification emails in Settings → Account or from the link in any notification email.

If you are in the UK or the European Economic Area you also have the right to object to processing based on legitimate interest, to restrict it, to data portability, and to complain to your supervisory authority. If you are in California or another US state with a privacy law, you have the right to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context advertising, so there is nothing to opt out of; we honour Global Privacy Control signals as an opt-out from analytics cookies regardless.

Disconnecting a platform account revokes our access token where the platform supports it and deletes the stored profile data and tokens for that platform.

Children

CollabTab is for people aged 18 and over. We ask you to confirm this before an account can be created and record when you did. We do not knowingly collect data from anyone under 18, and never from anyone under 13. If we learn that an account belongs to someone under 18, we close it and delete the data. If you believe a child has an account, email privacy@collabtab.app.

Security

Platform tokens are encrypted at rest. Conversations are readable only by their two participants, enforced by the database rather than by application code. Access to production data is limited to the operator, and every moderation action is logged. No system is perfectly secure; if we learn of a breach affecting you, we will tell you and the relevant authority as the law requires.

International transfers

Our processors operate mainly in the United States. Where data is transferred out of the UK or the European Economic Area, we rely on Standard Contractual Clauses or an adequacy decision, as applicable.

Changes and contact

If we change this policy materially, we will tell you by email before the change takes effect. Questions, or to exercise any right above: privacy@collabtab.app.