Legal
Privacy Policy
the individual developer operating wouldit.work · Privacy Policy · Last updated 2026-11-01
the individual developer operating wouldit.work ("we", "us", "our") is committed to protecting your privacy. This Policy explains how we collect, use, store, and share personal information when you use wouldit.work (the "Service"), and the rights available to you. We will announce material changes on this page and, for paying customers, by email.
1. Data controller
- Operator: the individual developer operating wouldit.work (individual / sole trader)
- Privacy email: support@wouldit.work
- Data Protection Officer: not applicable
2. Personal information we collect
2.1 Information you provide directly
- Idea text: the description you submit for a check, and the report generated from it.
- Account info (paid plans only, when available): email address and the plan you bought.
- Payment info: order amount and payment status, received from our merchant of record. We never receive or store full card numbers; card data is handled by the payment processor (see Section 5).
- Communications: emails you send to our support address.
2.2 Information we collect automatically
- IP address (hashed): used only for rate limiting. We store a salted one-way hash of your IP together with a daily counter; the raw IP is not stored by us, and the counter expires after about 24 hours.
- Log data: our hosting provider records standard request logs (timestamp, URL, status, user agent) for security and debugging.
We do not use advertising trackers, and we do not currently use analytics cookies.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Running your idea check and showing your report | Contract performance |
| Rate limiting and abuse prevention (hashed IP) | Legitimate interests |
| Billing and payment processing (paid plans) | Contract performance |
| Customer support | Contract / legitimate interests |
| Service notices (billing, security, policy changes) | Legitimate interests |
| Legal compliance | Legal obligation |
We do not use your idea text to train AI models, and we never publish private reports. Public case studies are written from public sources, not from users' ideas.
4. Cookies & tracking technologies
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Core functionality (and login sessions once accounts exist) | No |
| Analytics | Not used | n/a |
| Marketing | Not used | n/a |
5. Sharing & disclosure
We do not sell your personal information, including as defined under laws such as the CCPA. We share information only as follows:
- AI model provider: your idea text is sent to our OpenAI-compatible LLM provider to generate search queries and write the report.
- Public search APIs: short search queries derived from your idea (not your identity) are sent to the GitHub search API and the Hacker News search API by Algolia.
- Hosting and storage: the site runs on Vercel; reports and counters are stored in our database provider (Upstash Redis) or on our server. DNS and email forwarding run through Cloudflare.
- Payments: paid plans are sold by our merchant of record, Waffo. Card data is processed exclusively by our PCI-DSS certified payment processor, Waffo Pancake, and is not stored on our servers.
- Legal requirements: where required by law, court order, or a lawful regulatory request.
- Business transfers: in a merger or acquisition, with notice to you and continued protection.
- With your consent: for any other purpose, only with your explicit prior consent.
6. Data security
- Encryption in transit (TLS/HTTPS) on every page and API.
- Private reports live at unguessable URLs and are marked noindex. Anyone who has the link can open it, so share links carefully.
- IP addresses are stored only as salted hashes.
- Access to production systems is limited to the operator.
If a security incident affects your rights, we will notify affected users and the relevant authorities within 72 hours of discovery where the law requires it.
7. Data retention
| Data | Retention | On expiry |
|---|---|---|
| In-progress check jobs | 7 days | Deleted automatically |
| Private reports (idea + report) | 12 months | Deleted automatically |
| Hashed-IP rate-limit counters | About 24 hours | Deleted automatically |
| Account info (paid plans) | While active, then 90 days | Deleted |
| Transaction records | As required by tax law (kept by the merchant of record) | Archived/deleted |
| Support emails | 2 years | Deleted |
8. Your data rights
To exercise any right below, email support@wouldit.work. We respond within 30 days. To delete a private report, send us its link.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Get a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Ask us to delete your data |
| Right to restrict processing | Temporarily suspend processing in certain cases |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests |
| Right to withdraw consent | Withdraw consent for consent-based processing |
You may also lodge a complaint with your local data protection authority.
9. Marketing & opt-out
We do not send marketing email. If we ever do, it will be opt-in only and every email will include an unsubscribe link. Essential service notices (billing, security) are not marketing.
10. International data transfers
Our providers operate in multiple regions, including the United States. Where personal data is transferred internationally, we rely on our providers' data-processing terms (including EU Standard Contractual Clauses where offered).
11. Children's privacy
The Service is intended for users aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
12. Third-party links
Reports and case studies link to third-party websites. This Policy covers only data we collect directly; please review third parties' policies before using their sites.
13. Policy changes
For material changes, we will give at least 15 days' notice on this page (and by email to paying customers) and update the "Last updated" date.
14. Contact us
- Email: support@wouldit.work
- Operator: the individual developer operating wouldit.work
- Website: https://wouldit.work
This Privacy Policy is provided for general information and does not constitute legal advice.