Draft — pending legal review. This page is a first draft. It is not yet in effect and will change before launch.

Privacy Policy

Effective date: [PLACEHOLDER: effective date]

This policy explains what information DraftIQ keeps about you, why, who helps us run the service, and what you can ask us to do. We have tried to describe what the product actually does, in plain language.

Who we are

DraftIQ is operated by [PLACEHOLDER: legal entity name], [PLACEHOLDER: mailing address] (“DraftIQ”, “we”, “us”). DraftIQ is a research tool for Instagram and TikTok videos. The homepage is at draftiq.io and the app is at app.draftiq.io.

Questions about this policy or your information: [PLACEHOLDER: contact email].

The short version

• We keep what you need for an account (your email address and a protected form of your password) and the research you organize in the app.
• We do not sell your information, show ads, or use third-party tracking or advertising cookies.
• We use a small number of service providers to run DraftIQ: Cloudflare for the network and hosting, and Brevo to send account emails.
• Our servers are in the United States.
• You can delete your account yourself in Settings.

The homepage

The homepage (draftiq.io) has no sign-up form, no ads, no analytics scripts and no third-party tracking. It does not set cookies. Its fonts and images are served from the same site rather than from outside font or image services.

Like any website, the requests your browser makes to load the page reach Cloudflare, which hosts it. Cloudflare handles technical information such as your IP address and browser details to deliver the page and protect it from abuse. See “Who helps us run DraftIQ” below.

What we keep when you use the app

Your account

• Email address. Used to sign you in and to send you account emails.
• Password, in protected form only. We never store your password itself. We store a one-way “hash” of it (made with a method called scrypt) that lets us check a password you type without being able to read it back.
• Account details such as when the account was created and whether you have confirmed your email address.
• Google sign-in. If you sign in with Google, Google gives us your email address and a Google account ID, used only to sign you in. We do not receive your Google password.
• Sign-in sessions. When you sign in we create a session so you stay signed in. A session ends when you sign out and expires on our side after 30 days at most.
• One-use email links. Confirmation and password-reset emails contain a one-use link. We store only a hash of each link, not the link itself. Confirmation links expire after 24 hours and reset links after 30 minutes. Resetting your password signs you out everywhere.

Your research

Everything you set up and save in the app is stored with your account so you can come back to it:

• Workflows: each area of research you set up, including its name, the niche you chose, your account type and filming style if you give them, and the description you type when you set it up.
• Your own account names, if you enter your Instagram handle or TikTok username in a workflow. We store them with that workflow and may use them to look up that account’s public videos and statistics for your research.
• Saved videos, with a copy of the video’s public details at the time you saved it, plus the tags and notes you add.
• Creators and videos you follow, saved filters, videos you mark as watched or hidden, and when you last opened parts of the app (used for “What’s new since your last visit”).
• Niche requests. If you ask for a niche we don’t cover yet, we store the name you typed. We review requests, and an AI model running on our own servers drafts a niche from it. If we add the niche, it becomes available to all DraftIQ customers; the niche name is shared, your account is not.

Your notes, tags, workflows and saved items are private to your account. We do not show them to other customers.

Technical information

• Our servers keep technical logs of requests, which include your IP address, the address requested, and the time. We use them to run the service, fix problems, and protect against abuse. We keep them for [PLACEHOLDER: how long server logs are kept].
• To slow down password guessing, we briefly count sign-in and sign-up attempts by IP address. These counts are kept in memory for about 10 minutes and are not saved.

Cookies and browser storage

The app uses one cookie that is needed to keep you signed in. It is marked so that page scripts cannot read it and other sites cannot use it. It is removed when you sign out, and your browser may also remove it when you close it.

The app also saves a couple of display preferences in your browser’s own storage, such as whether a side panel is open. These stay on your device.

We do not use advertising, analytics or other tracking cookies.

Emails we send

We currently send only account emails: a link to confirm your email address when you sign up, and a link to reset your password when you ask for one. We send them through Brevo. If we add other emails, such as research updates, we will update this policy first.

Who helps us run DraftIQ

We share information with these service providers only so they can do their job for us:

• Cloudflare provides the network that connects you to DraftIQ and hosts the homepage. Traffic to draftiq.io and app.draftiq.io passes through Cloudflare, which processes technical information such as IP addresses to deliver and protect the service.
• Google signs you in if you choose “Continue with Google”. Google then tells us your email address and a Google account ID.
• Brevo delivers our account emails. It receives your email address and the email we send you.

We may also disclose information if the law requires it, to protect DraftIQ or others from harm or fraud, or as part of a sale or reorganization of the business, in which case this policy would continue to apply to your information.

We do not sell your information and do not share it for advertising.

Where your information is kept

DraftIQ’s servers are in the United States. If you use DraftIQ from outside the United States, your information will be transferred to and stored in the United States.

How long we keep it

We keep your account and research for as long as your account exists. When you delete your account in Settings (or ask us to), we delete your account and the research stored with it. Any copies in backups are removed within [PLACEHOLDER: backup retention period].

Niches added from requests stay available to all customers after a request’s account is deleted, because they no longer identify you.

How we protect it

Passwords and email links are stored only in hashed form, sign-in sessions use a protected cookie, and sign-in attempts are rate limited. No method of storing or sending information is perfectly secure, so we cannot promise absolute security. If we learn of a breach that affects you, we will tell you as the law requires.

Your choices and requests

• See, correct or delete your information. You can change or remove your workflows, saved items, tags and notes in the app. You can delete your account in Settings. To get a copy of your information or change your email address, contact us at [PLACEHOLDER: contact email]. We may need to confirm the request comes from you.
• Your password. Use “Forgot password” on the sign-in page to set a new one.
• Depending on where you live, you may have further rights over your information, such as objecting to some uses or complaining to a data protection authority. Contact us and we will help.

Videos and creators shown in DraftIQ

DraftIQ shows and analyzes publicly available Instagram and TikTok videos and their public statistics, such as views, likes and comments, together with public account details like usernames and follower counts. These videos and accounts belong to their creators. If you are a creator and have a question or request about how your public content appears in DraftIQ, contact us at [PLACEHOLDER: contact email].

Links in the app may take you to Instagram or TikTok, whose own privacy policies apply there.

Children

DraftIQ is not meant for children. You must be at least [PLACEHOLDER: minimum age] to create an account. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

If we change this policy, we will post the new version here with a new effective date. If a change matters for how we use your information, we will tell you by email or in the app before it takes effect.

Contact

[PLACEHOLDER: legal entity name]
[PLACEHOLDER: mailing address]
[PLACEHOLDER: contact email]