Privacy policy

Validated (validated.page) helps pre-revenue founders prove demand for their ideas with metrics from connected sources. This page explains what we collect, why, and what you can do about it.

Founders who sign in

• Sign in with X. We read your X user id, username, display name, profile image and account creation date. We use the X access token once to read these details, then revoke it. We don't post, read your posts or store the token.
• Landing pages you add. We store each URL and fetch the page's public title, description, icon and a screenshot to build its card.
• Google Analytics (optional). If you connect it, we ask for read-only access (analytics.readonly). We read your property list, the web stream's domain, your key events, and daily visitor and signup counts for the property you choose. We store daily totals only, and an encrypted refresh token so we can update them. Disconnecting deletes the token and revokes our access.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, use it for advertising, or let people read it, except as needed to run the service or where the law requires.

Visitors to founders' sites (the Validated snippet)

• The snippet sets no cookies and stores no identifiers on visitors' devices.
• We count visits with a daily-rotating salted hash of the IP address and browser user agent. We never store the raw IP address, and the salt is deleted every day.
• When a visitor joins a founder's waitlist, their browser hashes the email address before anything is sent. We key that hash again with a server secret and keep only the result, to count each signup once. We never receive or store email addresses.
• For snippet data we act on behalf of the founder whose site it is.

Retention

• Raw visit records: 35 days, then only daily totals remain.
• Signup de-duplication hashes: 13 months.
• Daily totals: as long as the listing exists.
• Deleting a landing page deletes all of its data. Deleting your account deletes your pages and connections.

Sharing

We don't sell personal data. Public leaderboard listings are opt-in and show only aggregate metrics. We use service providers to host the service and to take page screenshots; they process data only for us.

Your rights

You can ask to see, correct or delete your data, or object to how we use it, by emailing [email protected].