Privacy

Throttle Bird is a launch checker. This page describes the product as shipped. It is not a substitute for advice from your own counsel.

Scans

When you submit a URL we store the report: the final URL, score, short evidence lines, and the prompts. Secret matches are reduced to a short prefix. Database tests run only after you prove you own the app, and record only whether a read was allowed. They do not store row bodies or document fields. Reports expire after seven days. On a host without a shared database, a report may disappear sooner because the disk is local to one machine.

Account

There is no user account. The $9 unlock is tied to the scan id. The $19 Roost plan is tied to a secret link and the email you typed. Anyone with the Roost link can see that report. Treat the link like a password.

Payments

Stripe processes the card. We do not receive the card number. Stripe's own policy covers what they store. We keep the checkout session id and, for Roost, the customer and subscription ids Stripe returns.

Newsletter, feedback, sponsors

The email list stores the address and the time you joined. If a newsletter webhook is configured, the same address is sent there too. Feedback and sponsor inquiries store what you typed. To be removed, use the contact form. You can also POST the same address to /api/newsletter with unsubscribe set to true.

Analytics

A first-party beacon keeps daily totals: which page was viewed, the website that sent you (just its name, like reddit.com), and the utm_source tag if the link had one. The server also counts how many scans, checkout clicks, and email signups happen each day. These are plain counts. They are not tied to you, the beacon does not set a cookie, and it does not store your IP. It does nothing if the browser sends Do Not Track or Global Privacy Control, or if analytics are switched off. If Plausible is configured, that script loads as well and follows Plausible's own rules. We do not sell this data.

Contact

Use the contact form.