Privacy policy

Account information includes your name, email address, profile image when available, authentication identifiers and email-verification status. We also store workspace membership, preferences, onboarding progress, saved tool configurations, workflows, run history, Assistant chats, credit balances and usage records.

When you use a research tool, we process the source URLs, search terms, records and instructions you provide, and the results returned by data providers. Results may contain public profile details, posts, comments, engagement, business contact information and source links. Publicly available information can still be personal information.

Our hosting and authentication providers also process technical information such as IP addresses, browser details, request logs and security events to operate and protect the service. Support messages contain the information you choose to send us, plus your account ID if you are signed in. The contact form uses a protected (hashed) version of your IP address to limit abuse.

If you choose Google sign-in, Clerk receives your Google account identifier, name, email address, verification information and profile image to authenticate you and connect you to your CrowdYeti account. Google sign-in requests only basic identity scopes: OpenID, email and profile.

Signing in does not authorize CrowdYeti to read your Gmail, Google Drive or Google Calendar, or to send messages from your Google account. We do not receive your Google password. Google sign-in information is used for account access and security, not as input to our social-data collection or AI tools.

We do not sell Google user data, use it for advertising, or use it to train generalized AI models. CrowdYeti's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use information to provide account access, run the tools you request, save and export results, account for usage, prevent abuse, troubleshoot failures and respond to support or privacy requests.

When you use the Assistant, your messages and the application context needed to answer them are sent through OpenRouter to the model provider. When you choose a workflow AI step or preview, relevant research records and instructions are sent through OpenRouter to the AI model provider we use for that feature. Share only information you are entitled to send to these services.

Dodo Payments processes checkout and acts as merchant of record for applicable paid transactions. Dodo may process your name, email address, billing address, tax information, payment method and transaction details. CrowdYeti stores provider customer, payment and subscription identifiers, payment status, billed amount, credit grants, refunds and related accounting records. For a saved payment method, we store only the card brand, last four digits and expiry date. We also record which policy version you accepted at checkout and when. CrowdYeti does not receive or store your full card number or card security code.

Our service providers may process information in countries other than your own. Their processing is governed by their terms and privacy practices. We may also disclose information when required by law or where necessary to protect people, investigate abuse or secure the service.

We use these providers to operate CrowdYeti:

• Vercel — website hosting.
• Convex — database, file storage and backend processing.
• Clerk — sign-in and account authentication.
• Dodo Payments — checkout, payments and subscription billing.
• Apify — collection of public social data.
• OpenRouter — access to AI models for the Assistant and workflow AI.
• Resend — transactional email, including trial reminders.
• Sentry — error diagnostics. Error monitoring is off until configured.

Authentication uses cookies and related browser storage to keep you signed in and protect your session, and our sign-in provider may run a Cloudflare bot check. CrowdYeti also uses browser storage for your theme and sidebar settings, onboarding answers, Assistant session state and local drafts. We do not use analytics or advertising cookies. Blocking essential storage may prevent sign-in or parts of the app from working.

Collected Scout and workflow results are deleted automatically 12 months after the run finishes. Run history and billing records remain. Export any results you want to keep before they expire. Export files we prepare for download are deleted after 7 days. Account and workspace information is kept while it is needed to provide the service. Security logs, backups, financial history and external providers can follow different retention periods, so deleting a result does not mean every related record is erased immediately.

Assistant chats expire 30 days after they are started or after their latest successful reply, whichever is later. Expired chats are hidden straight away and deleted by a cleanup that runs every hour. Deletion can be delayed by up to about a day while a reply is still being processed or a request that may have been charged is being settled.

You can delete your account in Settings → Data & privacy once active runs and pending charges or billing changes have finished. If your workspace has other members, or you belong to more than one workspace, contact us to delete it. Deletion cancels your subscription immediately and deletes your account data, Scout results, workflows, Assistant chats and login. Unused credits are lost; the deletion screen warns you before you confirm. Account deletion does not issue a refund or clear an unpaid credit balance. Our refund policy explains how to request one.

Billing, payment and checkout-agreement records are kept for accounting. Your name, email and workspace content are removed from them, but payment provider reference numbers, plan dates and download records remain. After account deletion, we keep a one-way keyed hash of your verified email address and the payment provider's customer reference. We use them to enforce one trial per person and to restore any unpaid credit balance if you return. The hash is a protected value derived from your email, rather than a copy of the email itself.

For an access, correction or other privacy request, use our contact page. We may need to verify your identity. Deletion in CrowdYeti does not delete copies you have exported or information held by external providers under their own retention practices. Removing CrowdYeti's access in your Google Account settings does not itself delete your CrowdYeti account.

You can manage available account settings, choose which research tools to run, and decide which records to export or process with AI. Contact us to request access to or correction of your personal information, or to discuss a privacy concern.

We may update this policy as the service changes. The last updated date shows the current version.