Privacy Policy

1. Who we are

StartupBar ("we", "us", "our") operates startupbar.co — a traffic-exchange network for software founders, with optional paid listings and featured placements. Contact us at hello@startupbar.co with any privacy-related questions.

2. Information we collect

• Account data: When you sign up via Google OAuth we receive your name, email address, and Google profile picture. We store your name, email, and the profile photo you choose to show on your startup profile.
• Startup data: The startup name, URL, logo, one-liner and founder note you submit during the application process.
• Analytics events: Anonymous impression and click events. No personal visitor data is stored.
• Purchase data: For paid listings and featured spot subscriptions we store the payment reference returned by our payment provider, the amount status, the slot you booked, and the start, renewal and cancellation dates. We never receive or store your card number.
• StartupBid data: When you place a bid on StartupBid we store the website or handle you submitted, its publicly available name, icon and description fetched from that site, the amount paid, the payment reference, and anonymous click counts for the entry. You can bid without an account; if you are signed in we link the bid to your account so you can manage it.

3. Google user data

StartupBar uses Google Sign-In (OAuth 2.0), including Google One Tap, so founders can create and access their StartupBar account. This section explains exactly how StartupBar accesses, uses, stores, shares, protects and deletes Google user data.

Data we access

We request only the openid, email and profile scopes. From Google we receive your Google account ID, email address, name and profile photo URL. We do not access your Gmail, Drive, Calendar, Contacts or any other Google service or data.

How we use it

• To sign you in and keep your account secure.
• To show your name and photo on your dashboard and, if you choose, on your public startup profile.
• To send essential account, application and billing emails to your address.

We use Google user data only to provide and improve user-facing features of StartupBar. We do not use it for advertising (targeted, personalised, retargeted or interest-based), credit or lending decisions, or to build databases for other purposes. We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.

Sharing and transfer

We do not sell Google user data and do not transfer or disclose it to third parties, data brokers or information resellers. It is processed only by service providers that help us run StartupBar (our secure hosting and database provider and our email delivery provider), under contract and only to provide the service, or where required by law.

How we protect it

All data is encrypted in transit (HTTPS/TLS) and at rest. Access is restricted by row-level security so each founder can only access their own account data, and administrative access is limited to authorised staff.

Retention and deletion

We keep Google user data only while your account is active. You can delete your account and data at any time from your dashboard settings, or by emailing hello@startupbar.co from your account email. We delete your account data within 30 days of the request, except records we must keep by law (such as payment records). You can also revoke StartupBar's access at any time via Google Account Permissions.

StartupBar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If we change how we use Google user data, we will update this policy and notify you by email.

4. How we use your data

• To authenticate you and maintain your account session.
• To display your startup in the StartupBar network and, if you buy a featured spot, in the featured card on StartupBar pages.
• To power your dashboard analytics.
• To take payment, fulfil paid listings and featured subscriptions, handle renewals and cancellations, and keep records for tax and accounting.
• To send essential product and billing emails, such as payment confirmations, renewal notices and expiry reminders. We do not send marketing emails without your consent.

5. Data sharing

We do not sell, rent, or trade your personal data. We share data only with the processors we need to run the service: Supabase (database and authentication), Google (OAuth sign-in), Resend (transactional email) and Dodo Payments, our merchant of record for all paid listings and featured subscriptions. When you check out, Dodo Payments collects your billing details and card data directly and processes them under their own privacy policy.

6. Public information

Your startup name, logo, website, one-liner, founder name and founder photo are shown publicly on the network, leaderboard, your startup profile page, and in any featured card you purchase. StartupBid entries — the site or handle, its name, icon, description, total amount bid and click count — are shown publicly on the StartupBid board; the email or account behind a bid is never shown. Links from the StartupBid board carry StartupBar attribution parameters (utm_source, utm_medium and a referral tag) so the destination site can see the traffic came from us. Do not submit anything you do not want shown publicly.

7. Supporter analytics script

Startups on a Supporter membership may place an optional StartupBar analytics script on their own website. It renders nothing to visitors. It records an anonymous pageview with the page URL, the referring source and a country derived from the IP address, which is not stored. It sets no cookies, stores no identifier in the browser, does not fingerprint devices and does not track visitors across sites. The resulting statistics are aggregated and visible only to that startup’s owner in their dashboard. If you install it, mention StartupBar analytics in your own site’s privacy notice.

8. Cookies and optional signup attribution

We use a session cookie to keep you signed in. The embedded widget does not set tracking cookies on partner websites. Optional signup attribution uses the existing widget without another widget installation, but requires the partner to connect its signup system or configure a dedicated signup-complete page. Switching tracking on alone does not let us see accounts created inside the partner's system.

A StartupBar referral link may include an opaque referral token. Only after the partner signals analytics consent does the widget retain that token in first-party browser storage (localStorage) for up to 30 days. Browser storage and reporting respect Global Privacy Control and Do Not Track. Withdrawing consent clears the referral from that browser and stops browser reports; it does not automatically delete reports already received by StartupBar. Partners must connect consent handling and explain this use in their own privacy notices.

When an eligible referral reaches the configured signup-complete page, the browser can report that page visit. The default signup-system connection instead sends a signed partner-server report after a genuinely new account is created. Signed server reports are not technically gated by the widget's browser-consent signal; partners are responsible for the applicable lawful basis, any required consent and respecting visitors' choices in their own systems. Returning logins, dashboard visits, refreshes, purchases and failed signups must not be reported as new accounts.

We show success-page reports separately from signed partner-server confirmations. A signature identifies the reporting partner, not an independently audited account. Neither report proves that StartupBar caused a signup, and clicks are not signups. Test reports are excluded from real totals. Reports help show referral performance in the startup owner's dashboard and weekly statistics.

We do not request customer names, emails, passwords or customer account details. We store hashes of referral tokens and server event IDs, linked to the destination startup, the referring startup where available, report type, timestamps and test status. These are pseudonymous attribution records, not completely unlinked anonymous events. Partners must keep private signing keys on their servers.

The attribution window is 30 days, not the retention period for server records. Unconverted referrals are removed by daily cleanup after 90 days, and conversion records after 365 days. Linked converted-referral records may remain after their conversion record is removed, until the startup is deleted. Deleting a startup deletes its attribution records. Disabling tracking stops new attribution but does not delete historical records. For privacy or deletion requests, contact hello@startupbar.co. Data held by the partner is governed by that partner's privacy notice; contact the partner for requests about its records.

Cross-device journeys, blocked storage, consent choices, other domains and conversions beyond 30 days may remain unattributed. Counts may differ from a partner's analytics. Participation in signup tracking is optional and is not a condition of network membership. See our Terms of Service for reporting responsibilities and our FAQ for setup questions.

9. Data retention & deletion

You can delete any of your startups at any time from your Account page. You can also permanently delete your whole account yourself from Account, under Profile. Deleting your account removes your listings, profile and analytics, signs you out everywhere, and permanently removes your address from every mailing list. You can still email hello@startupbar.co if you would rather we do it for you. Payment and subscription records are kept for as long as tax and accounting law requires, even after an account is deleted.

10. Email preferences

Every non essential email we send carries a one click unsubscribe link and the matching one click unsubscribe header supported by Gmail and Apple Mail. Unsubscribing takes effect immediately and applies to every future update, including the weekly digest. Addresses that permanently bounce or report a message as spam are added to our suppression list automatically and are never mailed again. Essential account emails, such as approvals, warnings, payment receipts and renewal notices, are still sent while your account exists.

11. Security

All data is transmitted over HTTPS. Authentication tokens are managed by Supabase Auth. We do not store passwords or card details.

12. Children

StartupBar is not directed at children under 13.

13. Changes to this policy

We will notify you of material changes by posting the updated policy here with a new date.

14. Contact

Questions? Email hello@startupbar.co.