# Privacy policy

Source: https://northseen.com/privacy/ · Last updated: 2026-11-03 · Northseen

This privacy policy explains how Northseen and its website at northseen.com handle personal data. Northseen is made by Dulger Labs, run by Ogulcan Dulger (Dulger Labs), who is responsible for the data described here. You can contact us at any time at support@dulgerlabs.com.

## What is the short version?

We do not sell personal data, we do not show ads and we do not track you across other apps or websites. We use a small number of service providers, listed below, to process purchases, count anonymous usage and fix errors.

## Which data does the app use?

The app uses the following data. "Device" means the data never leaves your phone.

- **email** (email address): purpose: sign-in codes; stored on: Supabase; kept: until the account is deleted.
- **user_id** (random id): purpose: link your sites; stored on: Supabase, RevenueCat; kept: until the account is deleted.
- **timezone** (IANA time zone name): purpose: send notifications and reset monthly limits at your local time; stored on: Supabase; kept: until the account is deleted.
- **onboarding_answers** (choices (website/app/both, who makes changes)): purpose: personalise the fix list; stored on: device, Supabase; kept: until the account is deleted.
- **apple_sign_in_token** (Apple refresh token (only if you sign in with Apple)): purpose: revoke Sign in with Apple when you delete your account; stored on: Supabase; kept: until the account is deleted.
- **sign_in_identity** (for Google sign-in: Google account id, name and profile photo link; for Apple: Apple account id (and name if you share it)): purpose: the sign-in record kept by our login provider; Northseen does not show or use the name or photo; stored on: Supabase (Auth); kept: until the account is deleted.
- **sites** (website address, brand names, topic, platform): purpose: run checks and AI questions for your site; stored on: Supabase; kept: removed within 30 days after you delete the site, or within 24 hours after you delete the account.
- **check_results** (public data read from your website): purpose: fix list; stored on: Supabase; kept: runs older than 13 months are deleted, except the latest run of each kind per site and runs whose results your fix list still uses; everything goes when you delete the site or the account.
- **alerts_and_runs** (alerts, AI run records, check job records): purpose: alerts list and history; stored on: Supabase; kept: 13 months (job records 30 days).
- **usage_counters** (counts of re-checks, Ask questions, full checks and the one-time free check): purpose: free and plan limits; stored on: Supabase; kept: monthly counts 13 months; one-time counts kept with the account.
- **fix_progress** (states, dates): purpose: track what you fixed; stored on: Supabase; kept: until you delete the site or the account.
- **ai_questions** (text you choose): purpose: ask AI tools whether they mention you; stored on: Supabase; kept: removed within 30 days after you delete or edit the question (with its answers), or with the site or account.
- **ai_answers** (text and sources returned by AI tools): purpose: show what AI tools say and whether they mention you; stored on: Supabase; kept: answer text 13 months.
- **ask_messages** (your question and the answer (Pro)): purpose: answer questions about a fix; stored on: Supabase; kept: 90 days.
- **shared_links** (random link token): purpose: let a developer open one fix; stored on: Supabase; kept: valid 30 days or until you turn it off; deleted 7 days after that.
- **push_token** (device push token): purpose: send alerts and summaries; stored on: Supabase; kept: until sign-out.
- **purchase_status** (entitlement): purpose: unlock Plus or Pro; stored on: RevenueCat, Supabase; kept: while the subscription exists plus legal record keeping.
- **ip_address** (IP address, stored only as a salted hash): purpose: limit free first checks to 5 per day per network; stored on: Supabase; kept: 24 hours.
- **profile_meta** (country (device region), last app open, AI consent date, analytics choice): purpose: analytics default by region, retention timers, consent record; stored on: Supabase; kept: until the account is deleted.
- **notifications_log** (which notification was sent and opened, when): purpose: keep the 1-a-day and 3-a-week limits; stored on: Supabase; kept: 13 months.
- **content_reports** (reason you chose when reporting an AI answer): purpose: review reported AI content; stored on: Supabase; kept: 90 days.
- **device_settings** (onboarding answers, appearance, counters, dismissed banners): purpose: app behaviour on this device; stored on: device (kv-store; web localStorage); kept: until you delete the app; sign-out clears everything except the onboarding answers and the free-first-check flag.
- **usage_events** (anonymous events): purpose: improve the app; stored on: PostHog; kept: 12 months.
- **crash_reports** (technical data): purpose: fix errors; stored on: Sentry; kept: 90 days.

The app never sends email addresses, site addresses, brand names, question text, AI answer text, Ask messages, user ids in event properties, push tokens to analytics or crash reporting.

## Which service providers process data?

- **Supabase**: accounts, sign-in codes, database (region: EU (Frankfurt)). Privacy policy: https://supabase.com/privacy
- **OVHcloud**: checking worker and website hosting (region: EU). Privacy policy: https://www.ovhcloud.com/en/terms-and-conditions/privacy-policy/
- **OpenAI**: ChatGPT answers for tracked questions (with web search), Ask answers, and moderation checks of AI answers and Ask messages (region: USA). Privacy policy: https://openai.com/policies/privacy-policy/
- **Google (Gemini API)**: Gemini answers for tracked questions (region: USA). Privacy policy: https://ai.google.dev/gemini-api/terms
- **Google (PageSpeed Insights API)**: page speed test of your home page (only the address is sent) (region: USA). Privacy policy: https://policies.google.com/privacy
- **Expo (push service)**: delivering push notifications (region: USA). Privacy policy: https://expo.dev/privacy
- **RevenueCat**: purchase and subscription status (region: USA). Privacy policy: https://www.revenuecat.com/privacy
- **Paddle**: web payments (merchant of record) (region: UK). Privacy policy: https://www.paddle.com/legal/privacy
- **PostHog**: anonymous usage analytics (region: EU). Privacy policy: https://posthog.com/privacy
- **Sentry**: crash and error reports (region: EU). Privacy policy: https://sentry.io/privacy/
- **Google (Firebase Cloud Messaging)**: delivering push notifications to Android phones (region: USA). Privacy policy: https://firebase.google.com/support/privacy
- **Google (Sign in with Google)**: sign-in, only if you choose Continue with Google (we receive your Google account id, email address, name and profile photo link; we use only the email) (region: USA). Privacy policy: https://policies.google.com/privacy
- **Apple (Sign in with Apple)**: sign-in and revoking it when you delete your account, only if you choose Sign in with Apple (region: USA). Privacy policy: https://www.apple.com/legal/privacy/
- **Apple (Push Notification service)**: delivering push notifications to iPhones (region: USA). Privacy policy: https://www.apple.com/legal/privacy/
- **Resend**: sign-in codes, alert and what's-new emails, waitlist and support emails (region: USA). Privacy policy: https://resend.com/legal/privacy-policy
- **Cloudflare**: website delivery and email forwarding (region: global). Privacy policy: https://www.cloudflare.com/privacypolicy/

Where a provider is outside your country, the transfer is covered by the provider's data processing terms, including the EU standard contractual clauses where they apply.

## Which data does the website use?

The website sets **no cookies**. It does not show a cookie banner because it does not need consent for analytics: page views are counted without cookies and without a personal profile.

- Browser storage key `tool_uses_<date>` (localStorage): counts AI crawler checker uses per day; replaced the next day.
- Browser storage key `sb-<project>-auth-token` (localStorage (app.northseen.com only)): keeps you signed in to the web app; until you sign out.
- Browser storage key `ns-cache` (IndexedDB (app.northseen.com only)): shows your last results while offline; until you sign out.
- Browser storage key `sb-<project>-auth-token-code-verifier` (localStorage (app.northseen.com only)): one-time code used during Sign in with Apple or Google; removed when sign-in finishes.
- Browser storage key `ns.pending` (sessionStorage (app.northseen.com only)): remembers what you were doing while you sign in with Apple or Google; removed when sign-in finishes or the tab closes.
- Browser storage key `ns.*` (localStorage (app.northseen.com only)): app settings on this browser: onboarding answers, appearance, first-check flag, review and paywall counters, dismissed banners; until you clear site data; sign-out keeps onboarding answers and the first-check flag; deleting your account or data clears all of it.
- PostHog on all public pages and the web app (via the same-origin /ph/ proxy): page views and click events, cookieless, in-memory only, no personal profile.
- Sentry on AI crawler checker: error reports without personal data.
- RevenueCat Web SDK and Paddle checkout on app.northseen.com, only when you buy a plan: email and payment details for the purchase; Paddle and RevenueCat may set their own storage during checkout (see their policies).
- The waitlist form collects your email address to tell you when the app launches. It is kept until you unsubscribe.
- The contact form collects your email address and message to answer your question. It is kept 12 months.

The website's server keeps access logs (IP address, time, page, browser name and referring page) for 30 days to keep the site secure and to understand which search engines visit it. Logs are then deleted.

## How does the waitlist work?

When you join the waitlist, we send one email that asks you to confirm your address. Your address is stored only after you click the link. We use it only to tell you when Northseen launches, and every email has a one-click unsubscribe link that deletes your address.

## Why are we allowed to use this data?

We use data to provide the app and website you asked for (performance of a contract), to keep them secure and fix errors (legitimate interest), and to send waitlist emails you confirmed (consent, which you can withdraw at any time). Anonymous usage counts are based on our legitimate interest in improving the app; you can turn them off in the app settings.

## What are your rights?

You can ask for a copy of your data, ask us to correct or delete it, object to its use, or withdraw consent. In the app: Settings › Account › Export my data: one CSV file (columns section, record_id, field, value) with your profile, sites, results, fix progress, questions, AI answers and Ask messages, free, any time; Settings › Account › Delete account (signed in) or Delete my data (not signed in) removes your account and every site, result, question, answer and link from our servers within 24 hours; also from the web page /delete-account/. For data held by us or our providers, write to support@dulgerlabs.com and we answer within one month. You also have the right to complain to your local data protection authority.

## What happens when I delete the app?

Saved (signed-in) data comes back after you sign in again. A first check that was never saved stays on the server for 30 days after you last opened the app and cannot be recovered after a reinstall.. Sign in with the same email, Google account or Apple ID on every device and on app.northseen.com; all data syncs. Purchases are stored by the app stores and RevenueCat and can be restored with the same store account.

## Is Northseen for children?

Northseen is not directed at children under 13, and we do not knowingly collect data from them.

## How will we tell you about changes?

When this policy changes, we update the date at the top of this page. Important changes are also announced in the app.

## Who is the contact for privacy questions?

Ogulcan Dulger (Dulger Labs), Türkiye. Email: support@dulgerlabs.com.