Privacy Policy

1. What we collect from you

• Account email. You sign in with Google or an emailed one-time link; either way, the only account credential we hold is your email address, stored with our auth provider, Supabase. There are no passwords.
• Payment metadata. Payments run through Stripe. We receive confirmation data — that a checkout was paid, the amount, and a session reference. Your card number never touches our servers.
• What you submit. The product URL you enter and the settings you choose for a run.
• Operational logs. Standard technical logs (request timestamps, errors) kept to run and debug the Service.
• Usage analytics. Which pages of our site you view (path and query string), the site that referred you, and any UTM campaign tags on the link you followed — recorded against an anonymous visitor ID set by a first-party cookie and, once you sign in, associated with your account. Section 6 describes the cookies involved.

2. Public data we process

To build your report, we scan posts that are publicly visible on X. The authors of those posts are not WarmList users and have no relationship with us; their public posts are processed solely to compile the report you ordered. Because these are public posts, they can contain personal data their authors chose to publish — a handle, a display name, the text of the post itself. We do not access private accounts or direct messages, and we do not try to identify people beyond what they have made public themselves.

If you are the author of a public post that appeared in a WarmList report and would like it excluded from future reports — or deleted from the data we have stored — email shunsuke.main.0810@gmail.com.

3. How we use information

We use the information above to deliver your reports, process payments and refunds, respond to support requests, and keep the Service secure and working. We do not sell personal information, and we do not use it for advertising.

4. Third-party processors

The Service is built on a small set of providers:

• Stripe — payment processing. Card details are collected and stored by Stripe, not by us.
• Supabase — authentication and data storage, including your account email.
• Google — sign-in. When you choose "Continue with Google", Google handles the sign-in and shares your email address with us; we receive no other Google account data.
• Cloudflare — hosting and infrastructure. The Service runs on Cloudflare, so requests to it pass through Cloudflare's network.
• X — the source of the public posts we scan during the beta.
• Apify — the data-collection platform we use to gather those public X posts (Section 2).
• LLM providers (OpenRouter, OpenAI) — report generation uses large-language-model APIs to assess relevance; excerpts of public posts and your product URL are processed by those APIs for that purpose.
• Resend — transactional email. Your reports and account emails are delivered through Resend.

Each provider processes data under its own terms and privacy policy.

5. Data retention and deletion

We keep your account data and reports for as long as your account exists. To delete your account and its data, email shunsuke.main.0810@gmail.com from your account address; we will complete the deletion within 30 days. Payment records may be retained where required for legal, tax, or accounting purposes.

6. Cookies

WarmList sets two kinds of first-party cookies, and no others:

• Authentication. Session cookies from our auth provider, Supabase, that keep you signed in.
• Self-hosted analytics. To see how the site is used, we set wl_vid — a random, anonymous visitor ID — and wl_attr, which remembers how you first arrived: any UTM tags on the link, the referring site's hostname, the first page you landed on, and the time. Both expire after 90 days. The pages you view here and the source of your visit are recorded against that anonymous ID and, once you sign in, associated with your account.

This measurement runs entirely on our own infrastructure — there is no third-party analytics service, no advertising cookie, and no cross-site tracking, and the data is never shared with or sold to anyone.

We honor your browser's tracking-preference signals. If your browser sends Global Privacy Control (GPC) or Do Not Track (DNT), we do not set the analytics cookies and do not record analytics events for you — checked both in your browser and again on our servers. You can also switch the analytics off yourself, right here:

Opting out stops analytics events from this browser and deletes the two analytics cookies. The choice is stored in your browser (not on our servers), so it applies per browser and is cleared if you clear your site data. Authentication cookies are unaffected — you stay signed in either way.

7. Your privacy rights

Wherever you live, you can ask us to access, correct, delete, or export the personal data we hold about you, or to restrict or object to our processing of it, by emailing shunsuke.main.0810@gmail.com from your account address. We respond without undue delay, and exercising a privacy right never changes how we treat you. You can also opt out of our self-hosted analytics at any time — either with the control in Section 6 or by turning on GPC or DNT in your browser; both are honored automatically, with no account needed.

If you are in the EEA or the UK: our legal bases are performance of our contract with you (accounts, payments, reports), our legitimate interests (the self-hosted analytics in Section 6 and keeping the Service secure), and legal obligations (payment records). WarmList is operated from Japan — a country covered by an EU adequacy decision — and the processors listed in Section 4 run infrastructure in other countries, including the United States, where your data may be processed. You also have the right to lodge a complaint with your local data-protection authority.

If you are a California resident: we do not sell personal information and do not share it for cross-context behavioral advertising, and we never have. We honor the Global Privacy Control signal as described in Section 6. The rights above cover your CCPA rights to know, delete, and correct.

8. Changes to this policy

If this policy changes, the updated version will be posted here with a new effective date. Material changes will be announced on the site or by email to your account address.

9. Contact

WarmList is operated by Shunsuke Nakagawa, an independent developer based in Japan, who is responsible for the data described in this policy. For any privacy question or request, email shunsuke.main.0810@gmail.com or see the contact page.