Privacy Policy

Draft for review. Not yet in force.

Who we are

Ultrahype is run by Break the Signal LLC, a Tennessee company based in Nashville. Here "we" means Break the Signal LLC and "you" means a person who signs up for Ultrahype. Write to us about anything in this policy at [email protected].

Ultrahype is offered in the United States and Canada.

Two kinds of data

Your data. When you sign up and use Ultrahype, we decide what happens to your data.

Your visitors' data. When you put our snippet on your site or share our tracked links, we record visits and clicks for you. You decide that this happens and why; we act as your service provider. We use that data only to show you your results. We do not sell it, use it for advertising, or combine one customer's visitors with another's. The same goes for other people's posts, comments and testimonials you bring into Ultrahype: you decide to use them, we hold them for you. The same goes for emails people leave on a page we host for you: you decide to collect them and you are the one who emails them; we hold them for you and send them nothing.

What we collect about you

Your email address, to sign you in. We send it a one-time sign-in link and keep a record of each link you ask for, so we can limit how many are sent.
Your workspace name. We name it after the first part of your email address.
What you put in. The link to what you sell, what we read from that page, the facts you confirm, your brand colours, fonts and logo, your plan, your audiences, and for artists your releases, songs, shows and list size.
What you make. Drafts and approved posts, emails, articles and replies, ads and their budgets, and your notes.
Your sender details. The From address and postal address you give us for email. The law requires a postal address in marketing email.
Files. Pictures, artwork, video and logos you upload, images and video we make for you, and pictures of your own web pages that we take to make them.
Accounts you connect. The platform gives us your account id, name or handle, profile picture, the permissions you granted and access tokens. We never see your password. Tokens are stored encrypted.
Billing. Stripe runs our checkout and collects your card and billing details. We keep only Stripe's ids for you and your subscription, your plan, and Stripe's notices about it. We never see your card number.
AI use. For each AI request we record which feature asked, the model, how much it used and what it cost, to keep to your plan's allowance.

If you join the waitlist

Before sign-up opens, our home page takes a waitlist. We keep the email address you give, the link code you arrived with if any, the country Cloudflare works out from your internet address (never the address itself) and the time. We use it only to email you once when sign-up opens, and to count your join, without your email, toward the post that sent you. We never add it to a marketing list. To be taken off, write to us.

What the snippet and tracked links collect about your visitors

The snippet is one line of script you place on your site.

On each page a visitor sees, it sends us the page path (without anything after ? or #), whether it is the first page of the visit, the link code they arrived with, and the time. When a visit arrives without a link code from ChatGPT, Perplexity, Claude, Gemini or Copilot, it sends that assistant's name in place of a code (for example ai-chatgpt); it checks on the page which site the visitor came from, and never sends that address. Cloudflare works out the visitor's country from their internet address; we store the country, never the address.
It keeps that link code, and a note that the visit has started, in session storage on your site. Both are gone when the tab closes. It sets no cookies and stores no visitor id.
If your page reports a signup, we store the id you pass. It must be your own account number. An id that looks like an email address is refused and not stored.

Tracked links are the /go/ links in your posts. When someone opens one we record which link, when, and the visitor's country, then send them on to your page with the link code added. Links are per post, not per person, so a click tells you which post worked, never who clicked.

Your server may also report signups and payments to us with your private key: the link code, your own id for the account or payment, and the amount.

Review asks, if you turn them on: your server pulls the ids of customers who paid and are due an ask, sends the ask itself, and tells us which ids it asked or left out, with the reason (unsubscribed, refunded or deleted). We keep that id, the outcome and the time. We never receive their email or what they thought of your product.

If you leave your email on a page we host

Some businesses use Ultrahype to host a page with an email form, at a /p/ address on our site. If you join one, we store for that business your email, the time you joined, and which version of the words under the form you saw. We keep no name, IP address, device or location with it. If you arrived from one of the business's posts, that visit counts as a signup for the post under a random code, kept apart from your email.

That business is the sender: it decides what to email you, and every email must let you unsubscribe. We send you nothing. We delete your email after 12 months, or sooner if the business clears its list or removes you. To be taken off, write to the business at the contact shown under the form.

Other people's words you bring in

Threads. When you ask Ultrahype to find conversations to join, we read public Reddit search results for your terms and keep the post's link, title, an excerpt, the community and the author's username. You can also paste a post from Reddit, X or Threads.
Comments. When you draft a reply to a comment, we keep the comment and the commenter's handle with the draft.
Example posts. Public posts you save as examples, with the account name, caption and view count.
Testimonials. A person's words, their name and role as they agreed, and the record of their consent: how they agreed, what they agreed to word for word, and when. If they withdraw consent, Ultrahype stops using the quote in anything not yet posted. Taking down posts already published is up to you.

Cookies and browser storage

Name	What it holds	How long
`uh_s` cookie	your signed-in session (a random token; we store only a scrambled copy)	30 days, or until you sign out
`uh_demo` cookie	that you are looking at the sample desk; no identifier	2 hours
local storage	how you like the desk laid out, and which setup steps you have finished	until you clear your browser

On your site, the snippet keeps gm_ref and gm_seen in session storage, as above.

Ultrahype's own public pages run the same snippet, for our own results, collecting exactly what is described above. They use no advertising cookies, no analytics service from another company, no tracking pixels, and no fonts or scripts from other companies.

How we use it

To run Ultrahype for you: read your page, write your plan and drafts, publish only what you approve to the accounts you chose, make images and video, and show you results.
To sign you in and keep your workspace apart from everyone else's.
To bill you and keep within your plan's AI allowance.
To keep the service secure and fix problems.
To email you about your account. We send marketing email only if you ask for it.

We do not sell personal information or share it for advertising. We do not use your content or your visitors' data to train AI models, and our AI providers do not train on it under their terms with us.

Who else gets it

Only the companies that run parts of Ultrahype, and only what they need:

Who	What for	What they receive
Cloudflare, Inc.	hosting, database, file storage, sign-in email, and the AI models it runs for us (Workers AI)	everything stored in Ultrahype; your visitors' connections to our site
Anthropic, PBC	writing plans, drafts and replies	your product facts, page text, drafts, and the posts, comments, example captions and testimonials a draft is based on, including usernames
Stripe, Inc.	payments	your email, your plan, and what you give Stripe at checkout
The platforms you connect	publishing	what you approve to publish, and the access you granted

Some image and video rendering runs on a computer we run in Tennessee. It receives what a render needs: your brand, your text, your uploaded pictures and pictures of your own web pages.

Once something is published on a platform, that platform's own privacy policy covers it. We may disclose data if the law requires it, or to a buyer of the business, who would be bound by this policy.

Where it is

Our database and files are stored by Cloudflare in its eastern North America region. Pages are served from Cloudflare's network around the world. Our AI providers and Stripe process data in the United States. If you are in Canada, your data is stored and processed outside Canada, mainly in the United States, where courts and authorities can require access to it under US law.

How long we keep it

Sign-in links: 1 day after they expire.
Sessions: until they expire or you sign out.
Visit and click records: 13 months.
Signup and payment records from your site: 25 months.
Review ask records: 25 months.
Threads found for you: 30 days, unless you drafted a reply.
Account tokens: until you disconnect the account, or when your paid plan ends.
Waitlist emails: 12 months, or sooner if you ask.
Emails taken on a page we host for you: 12 months, or sooner when you clear them or remove someone.
Billing and AI use records: 7 years, for tax.
Testimonial consent records: 6 years after consent is withdrawn.
Everything else in your workspace: while you use Ultrahype. When a paid plan ends, we keep your workspace for 90 days, email you before we delete it, and then delete it. Signing in or choosing a plan again keeps it.
Files are deleted with the workspace. A copy can stay in a browser's cache for up to 24 hours after.

Your choices and rights

Disconnect any account in the desk and we delete its access token at once. You can also remove our access in the platform's own settings.
Delete your workspace in Account, or by writing to us from the email you sign in with. We delete your workspace, your files, your visitors' data and your account, and cancel your subscription at once. Billing records stay for 7 years for tax.
See, correct or get a copy of your data by writing to us.

We answer within 30 days. We confirm each request from your sign-in email, so nobody can read or delete your data just by naming your address. Using these rights never changes how we treat you. Depending on where you live, the law may give you further rights. You can also complain to your privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada, and in Quebec, the Commission d'accès à l'information.

If you are one of our customer's visitors, that customer decides what happens to your data, so write to them. If you write to us, we pass your request to them and help them answer it.

Your duties when you use the snippet or tracked links

By installing the snippet, sharing tracked links or switching on a page we host, you agree to:

Tell your visitors in your privacy notice that you use Ultrahype (Break the Signal LLC) to measure visits and signups, what it collects, and that it keeps a link code in session storage.
Get consent where the law requires it before the snippet runs.
Never send personal details through it: no emails, names or phone numbers in a signup id or a link.
Keep it off sites for children: never on a site or page directed to children under 13.
Be the sender for a page we host for you: give your business or legal name, contact email and postal address; email only what the page says; put your name, postal address and a working unsubscribe link in every email; when someone unsubscribes, stop emailing them within 10 business days; and keep the join date and notice version as proof they agreed. Never switch a page on for a product directed to children under 13.

Children

Ultrahype is for businesses and the people who run them. You must be 18 or older to sign up. If you think someone younger has signed up, write to us and we will delete the account. The snippet must never run on a site for children under 13.

Security

No passwords. A sign-in link works once, for 15 minutes. We store only a scrambled copy of each link and session, so reading our database cannot sign anyone in.
Platform tokens are encrypted with a key kept apart from the database.
Every request is checked against your workspace, to keep other customers out of your data.
Files you upload are stored at addresses that are long and hard to guess, but anyone given the address can open them. Do not upload anything you would not publish.

No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

Changes

We post changes here and change the date at the top. If a change affects how we use data we already hold, we email you at least 30 days before it applies.

Contact

Break the Signal LLC, Nashville, Tennessee (full postal address to come). Email [email protected].

Our founder is the person responsible for protecting your personal information. Write to them at [email protected].