Skip to main content

Privacy Policy

How Startup0 accesses, uses, stores, and protects your data

Introduction

Startup0 is a decision workspace for founders managing multiple products. This policy explains what information we collect, why we use it, how we protect it, and the choices you have. Using Google to sign in and connecting Google product data are separate, optional actions.

Information We Collect

Account information

When you create an account or sign in with Google, we receive the basic account information needed to authenticate you, such as your name, email address, and profile image. We do not use Google Sign-In to access Google Analytics or Google Search Console data.

Project and service data

We store the projects, settings, actions, and other information you choose to enter in Startup0. We may also collect limited usage, device, security, and diagnostic information needed to operate and protect the service.

Current product data connections

The current observability workspace uses PostHog as its monitoring source. GitHub is optional change context for a selected repository and environment. When you connect these sources, Startup0 stores daily UTC aggregate metrics, experiment metadata, and change metadata for the private project workspace:

  • PostHog: pageviews, distinct visitors, sessions, exceptions, affected users, and the exact conversion event you configure. An optional OTel service_name allows bounded counts of log entries and log errors. Raw log bodies, stacks, user identities, event rows, and provider payloads remain in PostHog and are not stored by Startup0.
  • GitHub: selected-repository deployment, release, and commit metadata, including the branch and environment context needed to interpret a change. Startup0 does not store source code, author profiles, commit messages, or raw GitHub API payloads.

PostHog personal keys and GitHub fine-grained tokens are sent only to the server and are encrypted at rest with AES-256-GCM. New PostHog and GitHub observations and change metadata remain private and are not published to a public project profile.

Legacy Google data connections

Google Analytics and Google Search Console are legacy data connections. Google login remains available independently and does not grant Google data access. New connections and synchronization for these legacy sources are disabled. Previously authorized connections requested one read-only permission per source:

  • Google Analytics: analytics.readonly, used to read the GA4 properties available to you and retrieve aggregate users, sessions, engaged sessions, and key events for the property you select.
  • Google Search Console: webmasters.readonly, used to read the verified properties available to you and retrieve aggregate clicks, impressions, click-through rate, and average position for the property you select.

Startup0 does not request Google identity scopes as part of a data connection. It does not retain Analytics event rows, user or client identifiers, dimensions, Search Console queries, page paths, countries, devices, or raw Google API responses.

For projects that already used a Google data connection, the existing encrypted refresh token and previously synchronized aggregate observations are retained until you disconnect that source or delete the account. Moving to the current PostHog workspace does not automatically revoke an existing Google provider grant or delete historical Google aggregates. Startup0 does not silently revoke Google access; you must revoke the provider grant separately from your Google Account permissions.

How We Use Information

We use your information to:

  • authenticate your account and provide the service;
  • show source-attributed project trends in your private workspace;
  • produce evidence-backed insights and suggested actions from aggregate data;
  • synchronize data sources you have chosen to connect;
  • provide support, maintain reliability, and protect against misuse; and
  • comply with legal obligations.

Google user data is used only to provide the visible Startup0 features you request. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models.

Startup0's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and Security

Google access tokens are used only during the current server operation and are not stored. Refresh tokens are encrypted at rest using AES-256-GCM. Stored Google-derived metrics are aggregate and contain explicit source and reporting period information. PostHog and GitHub credentials are encrypted at rest using AES-256-GCM, and their stored observations are scoped to the owning private project. We apply access controls so private data is scoped to its owning account and project.

No method of storage or transmission is completely secure, but we maintain technical and organizational safeguards designed to protect the information we process.

Sharing and Public Visibility

New PostHog and GitHub data is private and is not published through public project sharing. Legacy Google data is not public by default; a previously available Google-derived aggregate metric is shown publicly only when you explicitly choose that metric for a public project profile.

We may use infrastructure and service providers to host, secure, and operate Startup0. They may process information only as needed to provide those services and under appropriate confidentiality and security obligations. We may also disclose information when required by law or to protect users and the service.

Retention, Disconnection, and Deletion

You can disconnect PostHog or GitHub from the project workspace at any time. Disconnecting deletes the locally stored encrypted personal or fine-grained key and stops future synchronization. Previously synchronized daily aggregates, experiment metadata, and change metadata may remain with your Startup0 account so historical comparisons continue to work. Disconnecting does not revoke the provider credential itself; revoke the PostHog personal key or GitHub token manually in the provider's settings when you want to invalidate it there.

You can also disconnect a legacy Google Analytics or Google Search Console source at any time. Disconnecting deletes the stored Google refresh token and stops future Google API access. Previously synchronized aggregate metrics may remain with your Startup0 account so historical comparisons continue to work.

You can delete your Startup0 account from account settings. Account deletion removes account-owned projects, stored connector credentials, and associated project data from active systems, subject to limited retention required for security, fraud prevention, legal compliance, or backups. You may also contact us to request access, correction, or deletion of your information.

You can separately revoke Startup0's legacy Google access from your Google Account permissions.

Your Choices and Rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal information. You may exercise available product controls or contact us. We may need to verify your identity before completing a request.

Changes to This Policy

We may update this policy as the service or legal requirements change. We will post the updated policy on this page and update its date.

Contact Us

If you have privacy questions or requests, please contact us.