Privacy Policy
Prowler is operated by Hypebox Media SARL (trading as Hypebox). This policy explains what we collect when you use Prowler, why we collect it, how long we keep it, and how to get it deleted.
1. Information we collect
We collect what is needed to run your account, your sources and your billing — nothing more.
- Email address and, for password accounts, a password hash. Passwords are hashed by Supabase Auth; we never see them.
- Name, organisation and how you heard about us, collected during onboarding to set up your workspace. Optional.
- The sources you configure, so we know what to monitor on your behalf.
- Collected posts and articles — public content from the sources you nominate, used to build your feed.
- Scan history and credit ledger, to meter usage, bill accurately and let you audit your own spend.
- Stripe customer and subscription identifiers. We never receive or store card numbers.
- Technical logs (IP address, browser, timestamps), kept briefly by our hosting and authentication providers for security and abuse prevention.
2. Signing in with Google
You can create an account or sign in with your Google account. When you do, Google sends us your name, email address and profile picture, plus an identifier that lets us recognise the same Google account next time. We use these only to create and sign you in to your Prowler account and to show your name in the app. We do not request access to your Gmail, Drive, Calendar, Contacts or any other Google data, and we never post to Google on your behalf.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is never sold, never used for advertising, and never used to train AI models. You can revoke Prowler’s access at any time from your Google account permissions; doing so does not delete your Prowler account, which you can request separately below.
3. How long we keep it
- Feed items and raw scrapes: 48 hours. They are hard-deleted on a schedule that runs every 15 minutes. Prowler is a radar, not an archive.
- Saved items: until you delete them. Saving an article keeps a copy — including its image — outside the 48-hour window, by design.
- Account, billing and ledger records: for the life of the account, and afterwards only as long as tax and accounting law requires.
- Technical logs: up to 30 days at our hosting and authentication providers.
4. Deleting your account and data
Email info@hypebox.agency from the address on your account with the subject “Delete my account”. Within 30 days we will delete your profile, sources, feed items, saved items and credit ledger, and remove you from our authentication system so the account can no longer be used. Billing records that tax law obliges us to keep are retained for that period only and are not used for anything else. If you signed in with Google, deletion also removes the Google identifiers we hold.
6. Content about other people
Prowler collects material published publicly by the accounts and sites you choose. That material may include personal data about the people who posted it. You decide what to monitor, so for that content you are the controller and we act on your instructions — you are responsible for having a lawful basis to monitor those sources. We will act on a valid removal request from a person whose content appears in the system, and the 48-hour retention window means most collected content clears on its own.
7. Legal basis
Where data protection law requires a legal basis, we rely on performance of our contract with you for account, sources, feed and billing data; on our legitimate interests in securing the Service for technical logs; and on legal obligation for the billing records we must retain.
8. Your rights
Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to your data protection authority. Write to info@hypebox.agency and we will respond within 30 days.
10. Security
Data is encrypted in transit and at rest. Every table is protected by row-level security so one account cannot read another’s data. Administrative functions are restricted to service credentials that are never exposed to the browser.
11. International transfers
Our subprocessors operate in the United States and the European Union, so your data may be processed outside your country under the transfer safeguards those providers offer, such as standard contractual clauses.
12. Children
Prowler is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact info@hypebox.agency and we will delete it.
13. Changes to this policy
We will post any update here and, for material changes, notify you by email or in-app before it takes effect.
14. Contact us
Hypebox Media SARL, Lebanon — info@hypebox.agency