Privacy policy

This policy explains how LaunchAF ("we") handles personal data when you visit launchaf.com, sign in, launch a product, subscribe to our newsletter, buy a placement, use the LaunchAF Directory Autofill browser extension for Chrome and Chromium-based browsers, or connect an AI agent through the LaunchAF MCP server. The extension and the MCP server have their own sections below.

Who is responsible

LaunchAF is the controller of the personal data described here. Contact us for any privacy question or to use your rights at hello@launchaf.com.

What we collect, why, and our legal basis

• Account data: your email address, and your name, profile picture and Google account identifier if you sign in with Google, plus an optional X handle. Used to create and secure your account and run the service. Basis: performing our contract with you (Art. 6(1)(b) GDPR).
• Launch and community content: product details, logos, screenshots, links, comments, upvotes, saved products and streak activity. Much of this is public by design. Used to operate the directory, rankings and archives. Basis: contract.
• Newsletter data: your email address, your edition preferences, and delivery status (such as bounces) reported by our email provider. Links in our emails carry campaign parameters so traffic from them can be measured. Used to send The LaunchAF Brief. Basis: your consent when you subscribe, or our legitimate interest in emailing founders whose launch went live on LaunchAF (Art. 6(1)(f)). Every issue has a one-click unsubscribe, and unsubscribed addresses are not added again.
• Transactional emails: sign-in codes, launch status, payment and domain-rating notices. Basis: contract and legitimate interest.
• Purchases: when you buy a plan, sponsorship or service, our payment provider Dodo Payments collects your payment details as merchant of record. We receive your name, email, what you bought, the amount and the payment status, never your full card number. Basis: contract and legal obligation (accounting and tax records).
• Messages you send us: feedback and contact messages, the optional reply email, and the page you sent them from. Basis: legitimate interest in answering you.
• Security and abuse prevention: IP addresses and request details are used for short-lived rate limits and abuse checks, and appear in hosting logs. Basis: legitimate interest in keeping the service secure.
• Anonymous click counts: when you follow a product or sponsor link we add one to a counter for that link, without storing a cookie. Basis: legitimate interest in giving founders and advertisers their click totals.
• Optional analytics and product-view counting: described under Cookies below. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• AI-assisted features: when you use features that prefill or review a listing from a website, the website content you point us to is sent to our AI provider (OpenAI). Do not enter personal data of other people into those features.

We do not sell personal data and we do not use it for automated decisions with legal or similarly significant effects.

Cookies, local storage and third-party content

Essential items work without your consent because the site cannot function without them:

• Sign-in session and security cookies (Auth.js: session token, CSRF token, callback URL), set when you sign in. The session lasts up to 30 days.
• Vault access cookie (vault_access), set when you unlock The Vault, so you stay unlocked.
• Your cookie choice, stored in your browser's local storage as laf-consent for up to 12 months.
• Local and session storage for convenience features you use: the Vault pop-up preference, streak reward notices and your founder checklist progress. They stay in your browser.

Optional items load only after you choose Accept all in the cookie notice. Nothing in this list runs before that, and a browser signal such as Global Privacy Control is treated as a refusal:

• Google Analytics (Google LLC / Google Ireland): cookies _ga and _ga_*, up to 2 years. Measures how visitors use the site.
• Minilytics (our own analytics, hosted on Cloudflare): cookies ml_vid (visitor) and ml_sid (session) with random identifiers. Measures traffic and sources, and which visit led to a purchase: the two identifiers are added to your Dodo Payments checkout. When you are signed in, your account id, email and name are linked to your visits.
• Vercel Web Analytics and Speed Insights (Vercel Inc.): page-view and performance measurements.
• Cloudflare Web Analytics (Cloudflare, Inc.): aggregate traffic measurement, when enabled.
• Product view and share counting: our cookies launchaf_view_session (30 days), launchaf_vid (30 days) and launchaf_via (7 days) count unique product views and which share link a visit came from. The cookie values are random identifiers, stored hashed for counting.
• Trustpilot review widget, Testimonial.to testimonials wall, product demo videos from YouTube or Loom. Loading them sends your IP address and browser details to those companies, and some set their own cookies.

Directory and domain-rating badges. LaunchAF is listed on launch directories that require us to show their badge, linked to them, to keep the listing and its backlink. These badge images load from each directory's own server on every visit, without waiting for consent. Your browser therefore sends your IP address, browser details and the page address to that directory. We do not set cookies for this, and we do not ask the directories to identify or track visitors. Our legal basis is our legitimate interest in keeping these listings, which require the original badge (Art. 6(1)(f) GDPR). You can object by emailing us, or block third-party images in your browser. The badge images are served from: acidtools.com, agentwork.tools, aidirs.org, aihuntlist.com, aitoolfame.com, assets.bestsky.tools, assets.dang.ai, assets.yo.directory, auraplusplus.com, boostdomainrating.com, cdn.aidirectori.es, cdn.commune.build, cdn.openhunts.com, cloutstack.net, codehype.ai, confettisaas.com, daniellaunches.com, deeplaunch.io, dirpilot.com, dododirectory.com, dofollow.tools, easydofollow.dev, easylaunch.dev, fazier.com, findly.tools, forg.to, goodaitools.com, huzzler.so, img.turbo0.com, indiehunt.io, kittylaunch.com, launch-list.org, launchigniter.com, launchit.fast, launchpanda.dev, lemonlaunch.dev, letslaunch.today, maidensail.com, marketingdb.live, neeed.directory, newtool.site, nicklaunches.com, noonlaunch.com, novatools.ai, peerpush.com, productwatch.io, publishyoursaas.com, saasbison.com, saascity.io, saasfame.com, saasgrow.app, sellwithboost.com, shinylaunch.com, shipboost.io, shipstry.com, shipybara.com, smollaunch.com, spacerrapps.com, startupbenchmarks.com, startupfa.st, startuptrusted.com, statics.startupbase.io, submitaitools.org, submitforbacklinks.com, submithunt.com, sumodir.com, thesaasdir.com, toolfame.com, toolfio.com, toolrain.com, tools.launchllama.co, trustiner.com, twelve.tools, ufind.best, unitelist.com, uno.directory, verifieddr.com, vibecodinglist.com, wayfindio.com, weliketools.com, whatsthebigdata.com, wired.business, wonderlaunch.app, www.aat.ee, www.betterlaunch.co, www.directree.io, www.founder.best, www.foundrlist.com, www.indietools.app, www.listbulb.com, www.makeitla.st, www.nxgntools.com, www.scrolllaunch.com, www.stackledge.com, www.tinyshelf.co.

You can change your choice at any time with Cookie settings in the footer. Rejecting or withdrawing consent removes the optional cookies that can be removed from your browser and stops optional scripts and third-party content from loading. Cookies set by our own server for view counting expire on their own and are not set again. Browsers also let you block or delete cookies in their settings.

Who we share data with

We use service providers (processors) that handle data on our instructions, and independent providers where described:

• Vercel (hosting, delivery and, if you consent, analytics)
• MongoDB (database)
• Resend (sending email, including the newsletter)
• Dodo Payments (payments, as merchant of record and independent controller of payment data)
• Google (sign-in with Google, and Analytics if you consent)
• OpenAI (AI-assisted listing features)
• File storage and image hosting for uploaded logos and screenshots
• Cloudflare (including our Minilytics analytics), Trustpilot, Testimonial.to and the other providers in the Cookies section, only as described there

Product pages, comments, upvote counts, builder profiles and weekly archives are public. We may disclose data if the law requires it or to protect our rights and users.

International transfers

Some providers are based in, or process data in, the United States and other countries outside the EEA and the UK. Where that happens we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses, as offered by the provider.

How long we keep data

• Account, launch and community data: while your account exists, then deleted or anonymised when you ask us to, except what we must keep by law or for archives of public results.
• Newsletter data: until you unsubscribe (we then keep only the address needed to make sure we do not add you again).
• Payment and invoice records: as long as tax and accounting law requires.
• Email sign-in codes: valid for 10 minutes. AI-agent authorisation codes: 10 minutes; access tokens: 1 hour; connections are deleted 30 days after last use.
• Rate-limit entries: kept only as long as needed to enforce limits.
• Cookie choice: up to 12 months, then we ask again.

Your rights

Under the GDPR and UK GDPR you can ask us for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Where we rely on consent you can withdraw it at any time without affecting earlier processing. Email hello@launchaf.com from the address on your account; we answer within one month. You can also complain to your local data protection authority.

Children

LaunchAF is not meant for anyone under 16, and we do not knowingly collect their data.

Security

Traffic is encrypted with HTTPS, AI-agent authorisation codes and tokens are stored only as hashes, and access to data is limited. No system is perfectly secure; tell us at hello@launchaf.com if you find a problem.

Chrome extension: information the extension handles

This section applies to the LaunchAF Directory Autofill browser extension.

The extension stores the product profile that you create or choose to import from LaunchAF. A profile can include product details, website and social links, an optional founder name and contact email, categories, tags, and optional logo and screenshot files.

When you select Fill this form, the extension reads the labels and structure of the supported directory submission form so it can place the selected product details in matching fields. It may retain the field names and outcome for the current browser session so it can show the result and support Undo.

How information is used

Product-profile information is used solely to provide the extension's form-filling feature. The extension runs on a directory page only after you explicitly invoke it. It never clicks final submission, account-verification, payment, consent, or agreement controls.

Storage, sharing, and retention

Product profiles and reusable images are stored locally in Chrome's extension storage. Form-result information is stored only for the current browser session and is removed when that session ends.

The extension does not send profile data, form contents, browsing history, passwords, authentication information, payment information, analytics, or activity data to LaunchAF, advertising providers, AI providers, or other third parties. It does not sell or use this data for advertising.

A directory website may receive the product information you choose to place in its form, including when that website begins an image upload before final submission. Its handling of that information is governed by its own privacy policy.

Your choices

You can review and edit a saved profile in Product details & images. Delete a profile there to remove its stored text and images from the extension. Disconnecting or signing out of LaunchAF does not automatically delete a previously imported local profile.

Permissions

• activeTab and scripting let the extension fill the active supported directory page after you choose Fill.
• storage keeps your selected product profile and temporary fill results locally.
• Access to launchaf.com/tools/extension lets you explicitly import a selected LaunchAF product profile.

AI agent connections (MCP server)

If you connect an AI client (such as Claude or ChatGPT) to LaunchAF, you sign in and approve the connection on LaunchAF. The agent can then call the LaunchAF tools on your behalf. It cannot publish a launch, choose a plan, or pay.

What the tools return to your AI client

• Your own launches: name, slug, status, plan, website, upvotes, launch week, edit and public links, and the rejection reason if one was given.
• Public LaunchAF product listings.
• The launch-directory catalog.
• Website readiness check results.
• Drafts the agent creates from a website you ask it to submit.

What LaunchAF stores

• The registered client: its name, redirect URIs, and optional client and logo URLs.
• The approved connection: the account, the client, and when it was created and last used.
• SHA-256 hashes of authorization codes and tokens. The raw values are never stored.

Retention

Authorization codes expire after 10 minutes and access tokens after 1 hour. Refresh tokens and connections are deleted automatically 30 days after they were last used.

Revoking access

In your dashboard, open Connected agents and press Disconnect. This revokes the connection immediately.

Your AI provider and website fetches

Information shown to your AI client is then handled by that AI provider under its own privacy policy. When you ask the agent to check or submit a website, LaunchAF's servers fetch that website.

Changes and contact

We may update this policy when the extension's or the MCP server's data handling changes. For privacy questions, contact hello@launchaf.com.