Privacy Policy

1. Overview

Cosigned is a permanent social-proof platform for indie builders and software products. We collect the minimum data necessary to operate the platform, protect against manipulation, and provide private analytics to builders. We do not sell personal data and do not run third-party advertising trackers.

2. Information We Collect

We collect information in the following categories:

• Authentication Data: When you sign in via Google OAuth through Supabase Auth, we receive your Google display name, email address, avatar URL, and a unique account identifier. We never see or store your Google password.
• Profile Data: Information you optionally add to your builder profile, such as your username, display name, bio, headline, company, location, and links to your personal website or social profiles (e.g., X, GitHub, LinkedIn).
• Product Submissions: Information builders submit when listing a product, including product name, tagline, description, product URL, demo links, categories, pricing model, and uploaded logo or screenshot URLs.
• Community & Endorsement Data: Cosigns you cast and optional Reasons you write in support of products. Cosigns and Reasons are publicly displayed on the platform.
• Product-Page Visits: Product-page visits may be recorded when a visitor views a public product page, whether or not the visitor is signed in. Visit information is used for private builder analytics and is not displayed publicly or used for ranking.
• Technical Log Data: Basic server logs including IP addresses, browser user-agent headers, and request timestamps, retained temporarily for security, rate-limiting, and operational troubleshooting.

3. How We Use Your Information

We use the data we collect solely to:

• Authenticate your identity and manage your account
• Publish your product listings, Cosign endorsements, and Reasons
• Provide private, aggregated visit analytics to product builders
• Perform automated website badge verification when requested by a builder
• Detect and prevent vote manipulation, fake accounts, and spam
• Maintain platform stability, performance, and security

4. Third-Party Infrastructure & Service Providers

Cosigned relies on a limited set of infrastructure providers to host and deliver the platform:

• Vercel: Web hosting, edge network, and serverless compute infrastructure.
• Supabase: Managed database, authentication services, and asset storage.
• Google OAuth: Secure federated sign-in processed via Supabase Auth.

We do not sell personal data to any third party and do not share information with advertising networks or data brokers.

5. Ask AI Links

Cosigned provides links that open third-party AI services with a pre-filled question. When you use one of these links, your browser sends the query directly to the AI service you select. Cosigned does not proxy the AI conversation through its servers, nor do we store or log your interactions with those external AI services.

6. Cookies & Browser Storage

We use strictly necessary cookies for authentication sessions through Supabase Auth, temporary session storage (sessionStorage) for visit deduplication, and local storage (localStorage) for client-side dashboard caching. We do not use advertising or tracking cookies. For further details, please review our separate Cookie Policy.

7. Account Deletion & Data Retention

You can delete your account at any time through your account settings. When you delete your account:

• Your personal profile details, authentication credentials, and contact information are permanently removed from our active databases and authentication systems.
• All products you have submitted and their private visit logs are permanently deleted.
• All Reasons you have authored are permanently deleted.
• To preserve the permanent historical integrity of platform counters on third-party products, your past Cosign contributions are anonymized so they count toward aggregate totals without displaying or linking to your personal identity. No public profile is maintained for deleted accounts.

8. Your Rights & Contact

Depending on your jurisdiction, you may have rights to access, review, update, or request deletion of your personal data. To exercise any of these rights or ask questions regarding our privacy practices, please contact us through our contact page.