Privacy Policy

Version 1.1 · Published 11 August 2026 · Effective immediately

Version 1.1 only adds disclosures and protections — it takes nothing away and asks nothing of you — so it applies from the day it is published rather than after a notice period. The changes to the Terms and the Refund Policy do ask something of you, so those wait 30 days.

The controller of the data described below is LeadSurface LLC, a limited liability company formed in the Commonwealth of Kentucky, United States, with its principal office at:

Public posts we collect

The nine sources are Hacker News, Reddit, GitHub issues, GitHub Discussions, Stack Exchange, Dev.to, Product Hunt, Lobsters, and Discourse forums. We read them through their public APIs and feeds. We do not read private messages, private repositories, private groups, or anything behind a login.

For each post that matches a customer's configuration we store: the source, the URL, the title, the body text, the author's handle as the platform published it, the publication time, and the time we fetched it. Alongside it we store what we derived: the signal verdict, a short summary, a supporting quote, any competitor named, and a score.

On the sources that publish one, we also store the platform's own internal account number for the author — Stack Exchange is the case that matters today. A handle can be changed and is not always unique, so it cannot reliably be traced back to a profile; the account number can. Being straight about that is the point of listing it separately: it is a more durable identifier than the handle, and most sources do not give us one at all.

When we send a post for classification we send the source, whether it is a top-level post or a reply, the title, the first 4,000 characters of the body, and the URL, together with your company name and the competitor names you have configured. The lead summary that follows sends the same post plus the verdict we derived from it. We do not send the author's handle as a field of its own — though on a source whose links contain it, Dev.to being the clear case, the URL carries it. The body is sent as its author wrote it, so if they put a name or a contact detail in the post itself, that goes with it.

If you wrote a post and you want it out of LeadSurface, email [email protected] with the link and we will delete our copy.

That deletion is permanent, and making it permanent costs one thing. Our scanner revisits the same communities on a schedule, so deleting the row on its own would last only until the next scan picked the post up again. To stop that, we add the post's URL to a removal list that the scanner checks before it stores anything. So we keep the link, and nothing else: not the title, not the body, not your handle, not your account number, and no record of who asked or why. Storing the request itself would mean holding more of your data because you asked us to hold less.

Account data we store

• Users: email address and, if one is set, a bcrypt hash of the password. We never store the password itself.
• Workspace configuration: company name, competitor names, keywords, and the communities you have chosen to watch.
• Activity in the app: which leads have been viewed, the useful / not-useful feedback you leave, and which digests have been sent to you.
• Contact form: name, company, email, your message, plus the IP address and browser user agent of the submission. The last two are kept only to deal with abuse. The whole submission is deleted automatically after 180 days, by a job that runs daily — you do not have to ask, though you can ask sooner.
• Server logs: ordinary request and error logs from the app and the web server. They are capped at 60 MB and roll over oldest-first, so the oldest entries are discarded automatically. That is a size, not a date, and we would rather give you the real limit than a number of days that stops being true the first time traffic changes.

Cookies and browser storage

• leadsurface_access — a cookie set only while the site is behind the private-preview key. It holds the shared preview key, is HTTP-only, and lasts 30 days.
• leadsurface_token — your sign-in token. It is stored in the browser's local storage, not in a cookie, and expires after 7 days.
• Google Analytics cookies on the marketing pages, the blog, the sign-in and sign-up pages, and the signed-in app.

Those same pages load web fonts from Google Fonts, which means Google sees the IP address of anyone loading them.

Who else processes your data

That last sentence is easy to write and easy to break by accident, so the check is built into the software rather than left to us remembering. The app refuses to start if it is configured to send posts anywhere but a private network address. Sending them to a model provider is possible, but it takes a deliberate second setting whose only purpose is to make someone stop and read this paragraph first.

How long leads are kept

The history window depends on the plan, and it is enforced in the product:

This is a window on what you can see, not a deletion schedule. A lead older than your window is hidden, not erased, so moving to a longer window brings the older leads straight back.

There is an optional cleanup job that permanently deletes very old leads. It is switched off today. If we turn it on, its cutoff is always longer than the longest window we sell, so it can never remove a lead a paying customer could still see, and it never touches an account with no time limit.

How long account data is kept

Account data is kept for as long as the account exists. Closing an account disables it — nothing is erased by that action alone — so that reopening it restores everything.

To have your account data deleted, email [email protected] from the address on the account. Three things survive deletion, and it is worth naming all three rather than saying "some records":

• Payment and invoice records held by Stripe, for as long as accounting and tax rules require them — that is Stripe's obligation and ours, and neither of us can delete our way out of it.
• Log entries, until the 60 MB cap above rolls them off.
• A removal-list entry, if you asked us to take down a post you wrote — a URL and a date, and nothing else. It exists so the deletion stays deleted.

We keep no backups. The database runs on one server with no snapshot or dump job, so there is no second copy of your data sitting somewhere after you delete it. That is genuinely better for privacy and genuinely worse for durability, and you should know both halves before you decide how much you want to depend on us.

Security

Traffic to the site is encrypted. Passwords are hashed with bcrypt. Sign-in tokens are signed and expire after 7 days. Every database query for leads, users, and configuration is scoped to one workspace. The operator console is reachable only from a private network, never from the public internet.

None of that is a guarantee against a breach. If one happens and it affects you, we will tell you.

Your rights

We grant the rights below to everyone who asks, wherever you live. Some places give their residents a legal entitlement to some of them; rather than work out which list applies to you, we apply the same list to all of you. Email [email protected] and we will:

• give you a copy of what we hold about you, in a portable format;
• correct anything that is wrong;
• delete it — see "How long account data is kept" for the few records that have to survive, and why;
• tell you what we hold and who else has processed it, beyond what this page already says;
• stop a particular use of it, if you object to that use and we are not legally required to continue.

This applies whether or not you are a customer. Most of the people whose data we hold never signed up for anything — they wrote a public post that our system read and classified. If that is you, you have the same list above. Send us the link to the post; you do not need an account, and you do not have to tell us who you are beyond what it takes to find the post.

We will answer within 30 days. There is no charge, and asking costs you nothing else — we will not degrade or withdraw anyone's service because they exercised one of these.

Two things we never do, so you never have to ask us to stop: we do not sell your personal data, and we do not use your data — or the posts we ingest — to train models, ours or anyone else's.

Legal bases, and where your data is processed

Where a law requires us to name a legal basis for handling your account data, ours are: performing the contract with you (running the account you signed up for), our legitimate interests in operating and securing the service, and complying with legal obligations such as keeping tax and payment records. For the public posts we ingest, the basis is our legitimate interest in operating a market-signal product over content its authors published publicly — and anyone who wrote such a post can have our copy deleted on request, as described above.

LeadSurface LLC is established in the United States and your data is stored and processed there. If you are outside the US, using LeadSurface means your data is transferred to the US and handled under this policy.

For data coming from the EEA, the UK, or Switzerland, the mechanism for that transfer is the Standard Contractual Clauses (and the UK Addendum where the UK applies), incorporated by our Data Processing Addendum. The DPA is a real contract, not a summary of this page: it is offered to every customer on every plan, it is pre-signed, and you do not have to be on a particular tier or ask a salesperson to get it. Two things we would rather say here than let you discover later: we are not certified under the EU-US Data Privacy Framework, and we have not appointed an Article 27 representative in the EU or the UK. Larger competitors have both. If either is a requirement for you, tell us before you buy rather than after.

If you are in the EEA or the UK, you also have the right to complain to your national data protection authority. We would rather you came to us first, but that route is yours regardless.

Privacy requests go to the same address as everything else: [email protected]. There is no separate privacy inbox, and mail sent there reaches a human either way.

Changes

If we change how we handle your data in a way that matters, we will email the address on the account before the change takes effect.

Contact

[email protected], or the contact form.