| When you | We keep | Why |
|---|
| Join as a seller | Your name, email, the handle and platform you post on most, what your followers are into, the country if you give it, the moment you said you're 18 or over, who invited you (if anyone), the connection address you joined from, and the private address of your portal. | To match you to apps, make your links and codes, email your portal link, tell one person from another, and slow down sign-up floods. |
| Are invited by us | Your name, email, the platform and public handle we found you on, a short note on why, and whether the invite was sent, opened or used. We find these on public profiles; nobody gets an account they didn't ask for. The invite link fills in your email only together with the code in the email we sent you; without that code it shows your first name and handle and leaves the email empty. | To send one personal invite and know whether you used it. |
| Film takes in your portal | The video and sound of the takes you record or upload (and, while an upload is unfinished, its pieces), and the film our engine makes from them. | To make your film. A person may watch a post to check it's really you on camera before it earns the on-camera rate. Your takes are never used to train any model and never shown to anyone but you, the reviewer, and the people who see the post you choose to publish. |
| Log a post | The address of your post, whether it's on camera, and the link we made for it. | To count that post's clicks and sales and send you its report. |
| Set up payouts | The ID of your Stripe account (it starts acct_) and whether it's ready. Payouts are in test mode today. | To know where your money goes. Stripe's own pages collect your bank and identity details; we never see them. |
| Click a seller's link | That a click happened, which link, when, and a short daily code made by scrambling your connection address, browser and the date together. Not your address itself. | To count clicks and different visitors, and to leave out a seller's clicks on their own link. |
| Buy through a seller | What the app reports: its order number, the amount, the currency, whether you're a new customer, the app's payment reference, which seller or code, and, if the app sends it, your email scrambled into a short one-way code, keyed with a secret only our server holds, so it can't be checked against a list of addresses. Also the connection address the sale was reported from: when the app reports it from your browser (our tracking pixel), that is your address. The pixel also writes a short log of each report (the address, the time and the app), which we delete after 30 days. | To credit the seller who sent you, to refuse a seller buying through their own link, and to slow down fake reports. The one-way code can't be turned back into your email, but anyone who already had your email could match it, so it is never shown on a receipt or to anyone else. |
| (any sale) | A sale record: the product, the amount and currency, whether it was a new customer, the app's payment reference, the seller's public code (never their name), and its status. | So anyone can check the sale was real. A sale record is public to anyone who has its address. It never contains a buyer's name or email. |
| Read a lesson, open a dispute, write to us | That you read it, what you write in a dispute, and your messages to us and our replies. | Payouts open after the lesson on saying it's an ad. A dispute is read by the app and by us. Never put a buyer's personal details in one; the form refuses an email or phone number. |
| Ask for your portal link again | A scrambled code of the email you typed, your connection address and the time. We delete these after 30 days. | So nobody can flood one inbox with link emails. |
| List an app, or ask for platform access | The app's name, address and description, your name, company and work email, the share you set, a signing secret for your sales, your Stripe webhook secret if you add one, and the type of each Stripe event we receive. API keys and the tokens apps get when you connect them through OAuth are kept only as scrambled hashes. The private address of your listing's manage page is a long random key, kept as it is, like a seller's portal address. | To run the listing and the account, and so only you can report its sales. We open the app's public address to check it's live and has a refund policy. |
| Connect Avouch to Claude or another AI agent | The name the connecting app gives itself and the address it returns to, the connection address it called from (to limit calls), and what each tool call sends us: the call's own arguments, such as an app's address. The OAuth tokens the agent is given are kept only as scrambled hashes. We never receive or keep your conversation with the agent. | To run the tool you asked for, on your own Avouch account, and to stop abuse. |
| Start a launch, or get a bill | The launch you chose (how many people, the amount to each accepted post, its price) or the bill for your cleared sales (its number, amount, the sales on it and its due day), and when and how it was paid, as we record it. | To run the launch, pay your sellers from what you paid, and give back what wasn't used. |
| Subscribe to Avouch Pro | Your plan (monthly or yearly), when it started, renews or ended and why, each payment (amount, currency, date, whether it was paid, failed, refunded or charged back, and its test reference: Pro payments are in test mode today and no card details are asked for or kept), how many films and re-cuts you made this month, whether you get the weekly digest and whether your posts may appear in what's working, and who brought you to Pro: the seller whose Pro link you came from (kept in a cookie in your browser for up to 30 days), else whoever invited you. | To give you Pro, renew or end it, count the free allowance, and credit the person who brought you. Nothing is charged until payments are switched on, and this page will say so first. |
| Share your Pro link | That someone opened it (a short daily code scrambled from their connection, browser and the date, not their address), and the Pro payments of people you brought, with your share of each and whether it is held, cleared, paid or taken back. | To show you how many Pro members you brought and pay your share with your other payouts. |
| Join the founder waitlist | Your app's name and address, the builder you used, and your email. | To tell you when Avouch opens to you. |
| Run the sandbox | Nothing about you except the connection address that started the run, kept with it to limit runs an hour. The run uses made-up data in its own throwaway database, and both are deleted when it's an hour old (at the latest by the next day's clean-up). | To show the real system working. |
| Unsubscribe, or delete your account | Your email address, on a do-not-email list, and nothing else with it. | So we never email you again from any list. Joining again yourself takes you off it. |
These are all the emails Avouch sends: your portal link (when you join, claim an invite, or ask for it again); at most one message a day in your first week as a seller (for example, that your post is ready); our replies when you write to us; if you're on Pro, one what's-working digest a week (the posts that sold, and what they did), which you can turn off on your Pro page; and one personal invite to sell, to people we found on public profiles, which says why you got it; if it's never opened, one reminder three days later, and then nothing more. Every invite carries a link that stops all emails from us. Once you unsubscribe or delete your account, nothing more is sent to you, except your portal link if you ask for it yourself. We never send anyone else's offers.
When you join, the page keeps your portal's address in your browser on that device, so it can open it again. While you fill in the seller application, it keeps your place on that device (your name, email, where you post, your handle and what your people are into) for up to 14 days, so you can come back to it; it is cleared once you join. The portal remembers which tab you had open, on that device only. There are no advertising or analytics trackers. Pages load their fonts from Google Fonts, which receives your connection address when they do. The landing page's smooth scrolling runs in your browser and sends nothing.
An app sees the sales credited to its sellers, each seller's public code and handle, and the posts that sold. Sellers see their own numbers. If you joined from an agency's invite link, that agency sees your first name, your handle, and how many posts and sales you've had (never your email or your money); the join page says so before you join. If you're on Avouch Pro, what's working shows you other sellers' posts that sold or were clicked that week: each post's public address, the app, whether it was on camera, its opening line, and its click and sale counts, never the seller's name, email or money; you can keep your own posts out of it on your Pro page. Someone who brought you to Pro through their Pro link sees only that a Pro member they brought is on Pro, and their share of your payments, never your name or email. The operator sees everything above. We don't sell any of it or give it to anyone else, except the services below and where the law requires.
The host that runs the site and stores the database and videos: Railway (railway.com), in its US West region, so what we hold is stored in the United States. Email, once it's switched on: Resend, which receives each email's address and text to deliver it. Payouts, once they're live: Stripe, whose own pages collect bank and identity details; we never see those. The AI that suggests your hook and script, and reads what you ask the video editor to change: DeepSeek, which receives the words you type there, with emails, phone numbers, links and @handles taken out first, and never your videos. It also checks stock pictures we might add to your edit as b-roll; it never sees your own footage. Until payouts are live, no bank details, card numbers or tax forms are collected.
You must be 18 or over to join as a seller. The sign-up asks, and won't go through until you say you are.
Set by the code today: the pixel's log, the portal-link asks and the other connection logs, 30 days. A sandbox run, about an hour. Your saved place in the application, in your browser, 14 days. Backups: one copy of the database a day, on the same storage, each kept 14 days, so anything deleted is gone from the backups within 14 days. Everything else: for as long as your account is open, then deleted or stripped of your details as the next section says. Your takes and films are deleted when you ask, or when you close your account.
You can do both without writing to us. With your portal's private key (the part after /m/ in your portal address), /api/me/<key>/export downloads everything we hold about you, and a request to /api/me/<key>/delete deletes your account; a paused account's portal shows the download link. Deleting removes your takes, films and posters (and any unfinished upload), wipes your name, email and handles, ends your portal link and removes any invite we sent you. The records of sales stay for the apps' books, without your name. Your email stays only on the do-not-email list, and, if you were banned, a scrambled code of it that can't be turned back, so the ban holds. A business can do the same with its manage page's key, at /api/f/<key>/export and /api/f/<key>/delete. Or write to the address above from the email you joined with, and we'll send you a copy of what we hold, fix it, or delete it, within 30 days. Signed receipts already issued stay valid, because others rely on them, but we remove anything in them that could identify you.