Legal

Privacy Policy

Last updated:

This policy explains what InnerLoop collects, why, and how to ask us to forget you. Plain language; no dark patterns.

What we collect

  • Your quiz answers. The twelve choices you make. Stored against a random response ID so we can show you your result and generate the report.
  • Your email. Only when you reach the result page and ask for the preview. We use it to deliver the report, send the receipt, and (if you opt in) send occasional product updates.
  • Standard server logs. IP address, user-agent, request timestamps. Used for abuse defense and basic operations. Rotated and aged out.
  • Payment information. Handled by Polar. We never see or store your card number.

We do notcollect: location data beyond the country level, social graph, or your contacts. We do run one advertising pixel (Meta); what it shares, and how to opt out, is set out under “Advertising measurement (Meta)” below.

How we use it

  • Deliver the test, the preview, and the full report you bought.
  • Send you a link to your report, the PDF of your report, and your receipt by email.
  • Improve the product. We use product analytics (PostHog) and marketing analytics (Google Analytics 4) for aggregate funnel and pageview measurement; neither is tied to your email.
  • Measure our advertising. When you consent, we share a small set of conversion events with Meta so we can tell which ads bring people who find their pattern. See “Advertising measurement (Meta)” below.
  • Defend against abuse and fraud.
  • Comply with the law.

We do not sell your data. The one advertising platform we share data with is Meta, and only the limited, consent-gated conversion events described below; we never hand over your quiz answers or your report.

Sub-processors we rely on

  • Google Ireland Ltd. (Google Analytics 4 and Google Search Console.) Dublin, Ireland. EU data residency for EU visitors.
  • Polar. Processes payments. We never see or store your card number.
  • Neon / Postgres. Stores the data above.
  • PostHog Inc. (Product analytics, EU region hosting via PostHog Cloud EU.) Frankfurt, Germany.
  • Meta Platforms, Inc.(Advertising measurement via the Meta Pixel and Conversions API.) United States. See “Advertising measurement (Meta)” below for what we share and how to opt out or delete.
  • Resend. Sends transactional and nurture email (your report link, receipts, sign-in codes, follow-up sequence).
  • Vercel. Hosts the app.
  • Vercel Blob. Stores the PDF of your report so we can email you a link to it.

Cookies and similar technologies

Strictly necessary (always on, no consent required):

  • innerloop.utm.v1 (first-touch attribution). 30-day lifetime. Records which marketing channel brought a visitor to the site (e.g. a search engine, a newsletter link, an ad). Contains no personal information.
  • innerloop.region.v1 (region flag). Session lifetime, refreshed on each request. Records a coarse EU / non-EU flag so we can decide whether to show the consent banner and hold analytics until you consent. Contains no personal information and does no cross-site profiling.
  • A single session cookie when you sign in to retrieve a past report.

Analytics (off by default in the EU and UK; visitor opts in via the banner):

  • PostHog. Uses browser local storage, not traditional cookies, to record aggregate funnel events. Also records masked session replays (a playback of page layout, taps, and scrolling) so we can diagnose where the experience breaks down. All text you type and all on-screen text is masked before it leaves your browser, so replays never capture your email, your answers, or any other personal content. Off until you accept in the EU and UK.
  • Google Analytics 4. Sets a small number of cookies used for aggregate pageview measurement: _ga (2-year random identifier) and _ga_<container> (GA4 session state).
  • Meta Pixel. Sets _fbp and reads _fbc (ad-click attribution cookies) so Meta can match a conversion back to an ad. Off until you accept in the EU and UK, the same as PostHog and Google Analytics.

Other Google tools

We use Google Search Console to monitor how our content appears in Google Search. Search Console does not place cookies on your browser and does not track individual visitors; it shows us aggregate, anonymized data Google already has about how its search results link to our site.

Advertising measurement (Meta)

We run ads on Meta (Facebook and Instagram). To learn which ads actually bring people who find their pattern, we send Meta a small set of conversion events, for example that a quiz was completed or a report was bought, through the Meta Pixel in your browser and the Meta Conversions API on our server.

What we send Meta:

  • A one-way hashed version of your email as the match key. Meta receives the hash, never your plain-text email.
  • The event and its value (for example a report purchase of 4.99 USD), your _fbp and _fbc cookies, your IP address, and your user-agent.

Consent, region by region.In the EU and UK nothing goes to Meta until you accept in the banner, exactly as with our other analytics. If you decline, or before you choose, we send Meta nothing. For visitors in the United States we apply Meta's Limited Data Use flag, which restricts how Meta may use the data.

Deleting your Meta data.We honor Meta's data deletion callback: if you ask Meta to delete your data, Meta notifies us at /api/meta/data-deletion and we confirm the request. You can also email support@innerloopapp.com to ask us to stop sharing your data with Meta and to delete what we hold.

Your rights

You can ask us to:

  • Show you what we have on you.
  • Correct anything that's wrong.
  • Delete your data (response, email, report; all of it).
  • Export your data in a portable format.

Email support@innerloopapp.com and we'll act within 30 days. If you're in the EU/UK, your rights under GDPR / UK GDPR apply; if you're in California, your CCPA rights apply.

Children

InnerLoop is for people 18 and over. We don't knowingly collect data from anyone younger.

Changes

When we update this policy we change the date at the top and, for material changes, email anyone whose email we have on file.

Contact

Privacy questions: support@innerloopapp.com.