Privacy Policy

1. Who we are

CommunityTracker is a software product operated by Miraa Labs LLC, at 1309 Coffee St, Sheridan, Wyoming 82801, United States. We refer to ourselves below as “we”, “us” or “CommunityTracker”.

Our product helps businesses find relevant public conversations across community platforms and, optionally, reach out to the people involved. That second part means we handle contact details of people who are not our customers, and — if you choose to connect a mailbox — we handle access to your email account. Both deserve plain explanation, and both get one below.

This policy covers our website at communitytracker.ai and our application at app.communitytracker.ai.

2. When we decide, and when you decide

Two different relationships run through this product, and your rights differ between them.

• Your account information is ours to look after. We decide what to collect and why — your name, email, billing details, and how you use the product. In data protection terms we are the controller, and this policy is our accounting to you.
• The prospect data you work with is yours to direct. When you monitor a keyword, build a contact list, or send outreach, you decide who is contacted and what is said. We act on your instructions. You are responsible for having a lawful basis to contact those people, and for honouring their objections.

Where we act on your instructions, we still apply our own limits — see section 8. We will not send messages to an address that has asked us to stop, whoever instructed it.

3. What we collect

3.1 Account and billing information

Your name, email address and password (stored only as a cryptographic hash — we cannot read it). If you subscribe, our payment processor collects your card details directly and we receive only the subscription status, the plan, and the last four digits. Card numbers never reach our servers.

3.2 Public posts you ask us to monitor

This is the core of the product. When you monitor a keyword, we collect posts and comments that are publicly visible on the platforms you select — currently Reddit, X, LinkedIn, Bluesky, Hacker News, Indie Hackers, Dev.to, Stack Overflow, Product Hunt, GitHub and Slack communities. For each post we store its text, its public author handle, its link, its timestamp and its public engagement counts.

We collect this from public sources. We do not access private groups, direct messages, or anything behind a login that you have not connected yourself.

3.3 Business contact details we find for you

If you use the contact-finding features, we look up business contact details — typically a work email address, job title, employer and public professional profile — for people whose posts you have surfaced. We obtain these from third-party data providers listed in our sub-processor list, and from public web sources.

These people did not sign up for our product. We treat that seriously: they can ask to be removed at any time using the address in section 15, and we keep a permanent suppression record so the removal actually holds.

3.4 A mailbox you connect

Optional, and off unless you turn it on. If you connect a Gmail or Outlook mailbox so that outreach sends as you, we receive access to that mailbox. Because Google account data carries specific obligations, it has its own section — see section 5.

3.5 Other services you connect

If you connect Slack, we receive the messages in the channels you select, so we can surface relevant conversations. If you use our API or MCP integration, we log the queries made against your account.

3.6 Usage and diagnostic information

When you use the application we automatically collect your IP address, browser type, the pages you visit and the actions you take, along with error diagnostics when something breaks.

We use Microsoft Clarity, which records anonymised session replays — a reconstruction of how you moved through the interface — so we can find where the product confuses people. Message content, recipient names and email addresses are masked before leaving your browser, so they do not appear in a replay. We also use ipapi.co to look up the approximate country of your IP address, purely so that prices display in a sensible currency.

4. How we use information, and on what basis

Where we rely on legitimate interest, you can object — see section 10, and we will stop unless we have a compelling reason not to.

5. Google user data

This section applies only if you connect a Google account. It describes exactly what access we ask for, what we do with it, what we keep, and who else can see it. If you never connect a mailbox, none of it applies to you.

5.1 What we ask for, and why

Connecting a Google account grants us two capabilities:

• Permission to send email as you. This is the point of the feature: your outreach arrives from your own address, in your own name, and replies come back to your own inbox where you can continue the conversation normally.
• Read access to your mail. We use it for exactly two purposes: to notice when someone replies, and to notice when a message bounces.

Read access deserves an explanation, because it sounds broader than what we do with it. Detecting a reply reliably means reading the reply, not just its headers. An automatic out-of-office is not a real reply and must not stop your sequence; a person writing “please take me off your list” is an opt-out and must stop it immediately and permanently. Neither can be distinguished from message headers alone. Bounces are the same problem: the difference between a mailbox that is full today and an address that does not exist lives in the text of the delivery notice, and treating one as the other means either discarding a valid contact or repeatedly mailing a dead address.

5.2 What we actually store

Less than you might expect, and this is the part worth reading carefully.

What we do keep from a connected mailbox:

• The mailbox address and display name, so you can see which account is connected and we can show it in the interface.
• Messages you sent through us — the subject and body of your own outreach, which we composed and you approved. This is your record of what was said.
• Message and thread identifiers, which let us keep a follow-up in the same conversation rather than starting a new one, and let us match a reply to the sequence it belongs to.
• The outcome of a classification — that a reply was positive, negative, an auto-response, or a bounce. The conclusion, not the text it came from.

All of it is deleted 180 days after a sequence finishes, by an automated job that runs every night. Retention is covered in full in section 9.

5.3 Who else can see it

A short list, named here rather than linked away, because you should not have to click to find out who can read your mailbox data:

• Supabase — Database, authentication and server-side functions. Hosted on AWS us-east-2 (Ohio, United States).
• Unipile — Brokers the connection to your Gmail or Outlook mailbox and holds the authorisation token. Sends the messages you approve and relays reply notifications back to us.

That is the complete list. No one else receives data obtained from a connected Google account, and we do not sell it, rent it, or use it for advertising.

5.4 Limited Use, and no AI training

One consequence of that policy is worth stating on its own, because it is a question people increasingly ask and the answer is unambiguous:

Our AI features draft outreach from the prospect’s public post and the settings you configured. The code paths that handle mail from your mailbox are ordinary pattern-matching rules with no connection to a model provider at all. Your mailbox address and your recipients’ addresses are likewise never sent to a model provider.

5.5 Taking access away

You can revoke our access at any time, by either route:

1. In the application, open Settings and choose Disconnect on the mailbox. This stops all sending immediately and pauses any sequence relying on it.
2. In your Google account, visit myaccount.google.com/permissions and remove our access. This works even if you can no longer sign in to our product.

Revoking access stops any further reading or sending at once. Data we already hold is deleted on the schedule in section 9, or under section 10 if you ask us to delete the whole account — which takes effect after the 30-day window described there, not instantly.

If you delete your account, we hand the authorisation back to Google at the moment you request it, without waiting for the 30 days to pass. If that call fails we retry it every hour and tell you so on the screen; you can always remove it yourself at myaccount.google.com/permissions rather than wait for us.

6. Who we share information with

We share information with the service providers that make the product work — hosting, payments, email delivery, data sources and support. Each one receives only what it needs for its specific job.

We publish the complete list, including what each provider does and whether it can see data from a connected Google account, at communitytracker.ai/sub-processors.

Beyond those providers, we share information only when:

• you ask us to, or connect an integration that requires it;
• the law requires it — a valid court order or legal process. We will tell you unless we are legally prohibited from doing so;
• we need to establish or defend a legal claim, or to protect someone’s safety;
• the business is sold or merged, in which case the acquirer is bound by this policy until you are told otherwise and given a chance to object.

7. How AI is used in the product

We use large language models, supplied by the providers named in our sub-processor list, for two jobs: scoring whether a public post is relevant to what you monitor, and drafting outreach copy.

What we send them is the public post, the prospect’s public professional details, and the settings you configured. As stated in section 5.4, data from a connected Google account is never sent to a model.

Every AI request we make carries an explicit restriction that it may only be sent to a model endpoint which does not retain it. Our requests are routed by OpenRouter, which selects a provider at the moment of the request from that restricted set, so the company that actually processes a request is not always the company that made the model — our sub-processor list therefore names both the model creators and the clouds that serve them.

One thing you should know about how sending works. Outreach can run in a mode where each message waits for you to approve it, or in an automatic mode where messages drafted by AI are sent without individual review. The automatic mode is a choice you make. If you turn it on, messages composed by a model will be sent from your mailbox, in your name, without a human reading them first. We think that is a reasonable option to offer, and we think you should be told about it in plain words rather than discovering it later.

8. If you received an email from someone using CommunityTracker

This section is for you, not for our customer. You can act on any of it without an account and without proving anything.

Our customers use our product to send business email. We supplied the tooling; the customer chose to contact you and wrote or approved what was said. Your business contact details were most likely obtained from a public post you made, or from a business contact data provider — the providers we use are listed on our sub-processor page.

What you can do:

• Unsubscribe. Every message we send carries a working unsubscribe link. Using it stops that sender’s messages to you immediately, including any already queued, and records a permanent suppression so it does not restart.
• Just reply and say so. If you reply asking to be removed, our system recognises that and stops the sequence.
• Ask us directly. Email support@communitytracker.ai and we will suppress your address across every customer on our platform, and tell you what we held about you.

Suppression records are the one thing we keep indefinitely, and deliberately so. A suppression list only works if it outlives the account that triggered it — deleting it would mean you could be contacted again by the next customer who finds your address. We keep the minimum needed to recognise your address and block it.

9. How long we keep things

Each of these windows is enforced by an automated job, not by intention.

10. Your rights, and how to use them

You can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete what we hold;
• stop a particular use, or object to it;
• export your data in a portable format;
• withdraw a consent you previously gave.

One address, one procedure. Email support@communitytracker.ai from the address you want us to act on, and tell us what you want. There is no form, no subject-line format to get right, and no account required. We respond within 30 days and will tell you sooner if a request will take longer.

Deletion you can do yourself. The account owner can delete the account from Settings in the application, without asking us first. You type your account email to confirm, and then:

• everything stops immediately — no outreach is sent, no monitoring runs, and the account is frozen so it cannot be used while the deletion is pending;
• the authorisation for any connected mailbox is handed back to Unipile, the provider that holds it, so nothing can read or send from your mailbox from that moment. If that call fails we retry it hourly and say so on the screen, and you can remove our access yourself at myaccount.google.com/permissions;
• we cancel any active subscription so it does not renew. You keep the period you have already paid for and there is no refund for it. If the payment provider is unreachable we retry hourly and tell you on the screen, so you can watch for a charge;
• 30 days later the data is permanently deleted, by an automated job that runs every night.

Frozen means frozen. While a deletion is pending you can still sign in and read your data — you need to, to decide whether to go through with it — but you cannot change anything. That is enforced by the database itself, not by the interface, so it holds even for a stolen session.

You have 30 days to change your mind. Sign back in and cancel it, or use the link in the email we send you the moment you request deletion — that link works without signing in, which matters if someone else scheduled the deletion from your session. Cancelling puts back exactly what the request stopped: the monitoring it paused, the sequences it stopped, the queued messages it cancelled and the API keys it revoked. Anything you had paused yourself stays paused.

Two things do not come back on their own. Your mailbox has to be reconnected, because we handed the authorisation back to Google at the moment you asked, rather than sitting on it for a month. And access tokens for the Claude connector stay revoked, so you would authorise it once more; your API keys are restored.

If you are a team member on someone else’s workspace, your membership is deliberately left in place during the 30 days — so that cancelling can restore it rather than leaving you to be re-invited. You can still see that workspace and still cannot change anything. Both your membership and your ability to sign in end when the deletion completes. Their workspace and its data are untouched throughout.

If you want a copy, take it before you delete. You can export your leads and your action items to CSV yourself from inside the application. There is no one-click export of the whole account, so for anything else — posts, keywords, sequences, settings — email support@communitytracker.ai before you delete and we will send it to you. That address is also how you exercise every other right above, and it remains the route to deletion if you cannot sign in.

Deletion removes your account data and everything associated with it, including the public posts we collected for you and the contact details we found. Four things deliberately survive, and this is the complete list:

• Suppression records, for the reason given in section 8 — reduced to a one-way hash of the address, enough to recognise it and keep blocking it, not enough to read it or write to it. Deleting these would let someone be emailed again after they told us to stop, which is the harm the right to erasure exists to prevent.
• Unsubscribe links in mail already delivered, for 30 days, so a recipient can still opt out after the sender is gone. Held only as hashes.
• Billing and tax records, with your name, email, phone and address removed — see section 9.
• A record that a deletion was carried out, identified by a one-way hash rather than by you, so we can show it happened without keeping whose it was.

If you think we have handled your information badly, please tell us first — we would like the chance to fix it. You can also complain to your local data protection authority.

11. How we protect information

• Everything is encrypted in transit (TLS) and at rest.
• Access to customer data is restricted to the small number of people who need it to operate and support the product.
• Database access is enforced per-tenant at the database layer, so one customer’s queries cannot reach another customer’s rows.
• Mailbox authorisation tokens are held by our mailbox provider, not in our application code.
• Passwords are stored only as salted cryptographic hashes.
• Two-factor authentication is available on your account, and we recommend it.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your information we will tell you and the relevant regulator without undue delay.

12. Where your information is processed

We operate across three locations, and it is worth being specific about which is which:

• Our database — including everything described in section 5 — runs on Amazon Web Services, us-east-2 (Ohio, United States), via Supabase.
• Our website and application are served by Vercel (global edge network).
• Our community-monitoring automation runs on A dedicated server in Mumbai, India (Hostinger). This system handles public posts only. It has no access to connected mailboxes and never receives Google account data.

Our other service providers operate in their own jurisdictions, principally the United States and the European Union. Where information moves between countries, we rely on the transfer mechanisms in each provider’s data processing terms, including the European Commission’s Standard Contractual Clauses where they apply.

13. Children

This is a business product and it is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

14. Changes to this policy

We update this policy when the product changes. The date at the top always reflects the current version. If a change materially affects how we handle your information — particularly anything in section 5 — we will tell you by email before it takes effect, rather than quietly changing the page.

15. Contact us

For anything in this policy, including any request under section 10, write to support@communitytracker.ai. It reaches a monitored mailbox and a person will answer.

Miraa Labs LLC
1309 Coffee St, Sheridan, Wyoming 82801, United States