Legal

Privacy Policy

Last updated:

This policy explains what InnerLoop collects, why, and how to ask us to forget you. Plain language; no dark patterns.

What we collect

  • Your quiz answers. The twelve choices you make. Stored against a random response ID so we can show you your result and generate the report.
  • Your email. Only when you reach the result page and ask for the preview. We use it to deliver the report, send the receipt, and (if you opt in) send occasional product updates.
  • Standard server logs. IP address, user-agent, request timestamps. Used for abuse defense and basic operations. Rotated and aged out.
  • Payment information. Handled by Polar. We never see or store your card number.

We do not collect: location data beyond the country level, social graph, contacts, or any third-party tracking pixels.

How we use it

  • Deliver the test, the preview, and the full report you bought.
  • Send you a link to your report, the PDF of your report, and your receipt by email.
  • Improve the product. We use product analytics (PostHog) and marketing analytics (Google Analytics 4) for aggregate funnel and pageview measurement; neither is tied to your email.
  • Defend against abuse and fraud.
  • Comply with the law.

We do not sell your data. We do not share it with advertisers.

Sub-processors we rely on

  • Google Ireland Ltd. (Google Analytics 4 and Google Search Console.) Dublin, Ireland. EU data residency for EU visitors.
  • Polar. Processes payments. We never see or store your card number.
  • Neon / Postgres. Stores the data above.
  • PostHog Inc. (Product analytics, EU region hosting via PostHog Cloud EU.) Frankfurt, Germany.
  • Resend. Sends transactional and nurture email (your report link, receipts, sign-in codes, follow-up sequence).
  • Vercel. Hosts the app.
  • Vercel Blob. Stores the PDF of your report so we can email you a link to it.

Cookies and similar technologies

Strictly necessary (always on, no consent required):

  • innerloop.utm.v1 (first-touch attribution). 30-day lifetime. Records which marketing channel brought a visitor to the site (e.g. a search engine, a newsletter link, an ad). Contains no personal information.
  • A single session cookie when you sign in to retrieve a past report.

Analytics (off by default in the EU and UK; visitor opts in via the banner):

  • PostHog. Uses browser local storage, not traditional cookies, to record aggregate funnel events.
  • Google Analytics 4. Sets a small number of cookies used for aggregate pageview measurement: _ga (2-year random identifier) and _ga_<container> (GA4 session state).

Other Google tools

We use Google Search Console to monitor how our content appears in Google Search. Search Console does not place cookies on your browser and does not track individual visitors; it shows us aggregate, anonymized data Google already has about how its search results link to our site.

Your rights

You can ask us to:

  • Show you what we have on you.
  • Correct anything that's wrong.
  • Delete your data (response, email, report; all of it).
  • Export your data in a portable format.

Email support@innerloopapp.com and we'll act within 30 days. If you're in the EU/UK, your rights under GDPR / UK GDPR apply; if you're in California, your CCPA rights apply.

Children

InnerLoop is for people 18 and over. We don't knowingly collect data from anyone younger.

Changes

When we update this policy we change the date at the top and, for material changes, email anyone whose email we have on file.

Contact

Privacy questions: support@innerloopapp.com.