Privacy policy

What we collect

• Your account. When you sign in with Google or GitHub we get your name, email address, profile picture URL and your account ID with that provider. We ask only for basic profile and email access. We store the sign-in tokens the provider gives us so the sign-in keeps working; we do not use them to read anything else in your Google or GitHub account.
• Your session. A sign-in cookie, plus the IP address and browser user agent of each session, so you stay signed in and we can spot misuse.
• Purchases. Payments go through Gumroad. Gumroad sends us the sale details: your email, the product, price, currency, sale and subscription IDs, dates, refund status and the other fields in Gumroad's sale notification. We drop every card field before saving. We never see or store your card number.
• What you put in. Your products (name, URL, tags, audience, pricing notes), your listing kit (taglines, descriptions and other fields), uploaded assets such as logos and screenshots, your directory plan and submission history.
• Directory accounts. For each directory, the identity you used (an email alias or handle), the sign-in method and the name of the password-manager item that holds the login. Never passwords or session cookies.
• What your agent reports. When your AI agent uses our MCP server it sends status updates, listing URLs, blockers and short evidence notes (for example confirmation text). We save those with a timestamp.
• Link checks. For your live listings we fetch the listing page and record whether your link is there, its HTTP status, rel attribute and anchor text.
• API keys. We keep a hash and a short prefix of each key you create, never the key itself.
• The free readiness check. When anyone checks a site at /check we save the address checked and the report, which is public at /check/<domain>. To limit checks per visitor we save a hash of your IP address and the date, which can't be turned back into the address. If you're signed in, the check is linked to your account.
• Logs. Our host, Cloudflare, keeps request logs (URL, time, status, IP address) for a short time for debugging and security.

We do not use advertising or third-party analytics trackers, and we do not sell or rent your data to anyone.

Why we use it

• To sign you in and keep your workspace separate from everyone else's.
• To unlock what you paid for and handle refunds.
• To give your agent the kit and plan it needs, track your submissions and check your links.
• To look for your product on launch directories (the listing monitor). It visits public directory pages built from your product's name and domain, never signs in anywhere, and doesn't send the directories anything about you. If an agent of yours checks your email for directory news, it reads your inbox where it runs and sends us only the outcome; we never see your email.
• To keep the service secure, fix bugs and answer your emails.

If you are in the EU or UK: we process your data to provide the service you signed up for (contract), and for security and abuse prevention (legitimate interests). Purchase records are kept to meet tax and accounting duties (legal obligation).

Google and GitHub sign-in

We use Google and GitHub only to sign you in. We read your name, email address and profile picture, and nothing else. ListingBro's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or GitHub data for advertising, do not sell it, and do not use it to train AI models.

Who else handles your data

• Cloudflare hosts the app and its database, and keeps request logs.
• Gumroad takes payments as the merchant of record. Their own privacy policy covers what you give them at checkout.
• Google and GitHub handle sign-in when you choose them.
• Ahrefs gets the public domain names of launch directories so we can look up their Domain Rating. No personal data is sent.
• Anthropic reads the public text of a site checked at /check to write the AI part of the report. Only the site's own public content is sent, never your account details.
• Your AI agent's provider. Data our MCP server returns to your agent goes to whichever provider runs it (for example Anthropic, OpenAI or Cursor), under your own agreement with them.

These services may process data outside your country, including in the United States. We may also share data if the law requires it.

Cookies

We use one essential cookie to keep you signed in. There are no advertising or tracking cookies, so there is no cookie banner.

How long we keep it

We keep your data while your account exists. Delete your account and we delete your workspace, products, kit, submissions and sign-in records within 30 days. Purchase records are kept as long as tax and accounting law requires. Cloudflare request logs expire on their own within a few days.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it, by emailing hello@listingbro.com from your account's email address. We answer within 30 days. In the EU and UK you can also object to processing, ask us to restrict it, and complain to your data protection authority.

Children

ListingBro is for people building products, not for children under 16. We do not knowingly collect their data.

Changes

If we change this policy we update the date at the top. If a change matters, we email signed-in users before it takes effect.