Privacy Policy

• Account details — your email address and authentication identifiers, managed via our authentication provider. If you sign in with Google, we receive your email and basic profile from Google.
• Queries and conversations — the questions you ask and your conversation history, so your threads are saved and synced.
• Usage and credit logs — searches run, modes used, and credits spent, so we can enforce plan limits and show your usage.
• Guest sessions — if you use Superlurk without signing in, we create an anonymous account for you through our authentication provider (a real authentication record with no email or personal details). A session cookie keeps you on that anonymous account so your trial usage and history persist; it is not an advertising or cross-site tracking identifier. When you sign in, the anonymous account is upgraded in place to your account.

We never see or store your payment card details — payments are collected directly by our payment provider (see Section 4).

• Provide the service — run your searches, generate answers, save your history, and keep you signed in.
• Improve quality — debug problems and analyze usage in aggregate to make search and answers better.
• Billing — track credits and plans, with payments handled by our payment provider as Merchant of Record. Payment card data never touches our servers.
• Safety — prevent abuse, enforce rate limits, and protect the service.

We don't sell personal data and we don't use it for advertising.

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data only where we have a legal basis under the GDPR / UK GDPR. The basis depends on the purpose:

• Providing the service — running your searches, generating answers, saving your history, keeping you signed in, and managing your account.Basis: performance of our contract with you (Art 6(1)(b)).
• Plans, credits & billing — tracking your plan and credits, and keeping the records tax and accounting rules require.Basis: performance of our contract (Art 6(1)(b)) and compliance with a legal obligation (Art 6(1)(c)).
• Security, abuse prevention & improving the product — rate-limiting, preventing fraud and abuse, debugging, and analyzing usage in aggregate.Basis: our legitimate interests in a safe, reliable, and improving service (Art 6(1)(f)).
• Surfacing public posts from creators — showing snippets, handles, and public metrics from third-party social posts in your results.Basis: our legitimate interests in operating a public-content search engine, balanced against the rights of those creators (Art 6(1)(f)) — see Section 8 and our Data Removal & Objection page.
• Communications — sending service and transactional messages, and any optional product updates you opt into.Basis: contract or legitimate interests for service messages (Art 6(1)(b)/(f)); consent for any optional marketing (Art 6(1)(a)), which you can withdraw at any time.
• Legal compliance & claims — responding to lawful requests and establishing, exercising, or defending legal claims.Basis: compliance with a legal obligation (Art 6(1)(c)) and our legitimate interests (Art 6(1)(f)).

Where we rely on legitimate interests, we balance them against your rights and you can object (see Section 6). We don't use your data for automated decisions that produce legal or similarly significant effects about you.

We use a small set of service providers to run Superlurk:

• Authentication & application-database providerAuthentication — including the anonymous guest sessions we create before you sign in — and database hosting for accounts, conversation history, and usage logs.
• Backend hosting providerCloud hosting for our backend API and its database.
• Cloud hosting & CDN providerHosting and global CDN for the Superlurk web app. Processes the basic request logs needed to serve, cache, and protect the site.
• Payment / merchant-of-record providerPayment processing as Merchant of Record. Card details go directly to the provider and never touch our servers.
• AI model providerGenerates your answer — your query and the public content we retrieved are sent to the model. We don't share your name, email, or account identity with the model. Data retention and any model-training use are governed by the provider's data policy and our account settings.
• Search & data providersYour search queries are forwarded to retrieve public social and web content. Your account details are not shared with them.

Authentication emails (such as magic links) are sent through our authentication provider. We don't currently use a separate transactional- or marketing-email provider; if we add one, we'll list it here before turning it on. The specific vendor behind each category is available to customers and their auditors on request at privacy@superlurk.com, and you can link to this list directly at /privacy#subprocessors for due-diligence reviews.

We keep personal data only as long as we need it for the purposes above, then delete or anonymize it:

• Account data — kept while your account is active and deleted or anonymized within 30 days after you delete your account, except where we must keep something longer to meet a legal obligation.
• Conversation history — kept until you delete individual threads or your account; you can remove threads at any time.
• Usage, credit & security logs — retained for up to about 12 months to enforce plan limits, debug, and protect the service, then deleted or aggregated into non-identifying statistics.
• Guest (anonymous) sessions — tied to the anonymous authentication account rather than a device cookie; inactive anonymous accounts and their data are pruned on a rolling basis if you never sign in.
• Payment records — retained by our payment provider, our Merchant of Record, for as long as tax, accounting, and anti-fraud laws require (commonly several years). We keep only the minimal subscription and credit record needed to run your plan.
• Backups — residual copies in encrypted backups age out on our normal backup rotation after data is removed from live systems.

If a legal hold or an open dispute requires it, we may retain the relevant data until the matter is resolved.

You can review your conversation history in the app and delete individual threads at any time. Self-serve account deletion and a data export are available in your account settings; you can also email privacy@superlurk.com to request a copy or deletion of your data.

Depending on where you live, you may also have the right to access, correct, delete, port, restrict, or object to our processing of your personal data, and to withdraw consent where we relied on it — without affecting processing we already carried out. We'll respond within the time the applicable law requires and won't charge for a reasonable request. EU and UK residents can also contact our representatives (Section 12) and lodge a complaint with a supervisory authority; California and other U.S. state residents have the specific rights described in Section 7.

This section applies if you are a resident of California or another U.S. state with a comprehensive privacy law (for example Colorado, Connecticut, Virginia, Oregon, or Texas). It uses the terms those laws define.

We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA — and we haven't in the preceding 12 months. Because we don't sell or share, there is nothing to opt out of, but we still honor browser opt-out preference signals such as Global Privacy Control (GPC) where they apply. You can also email privacy@superlurk.comwith a "Do Not Sell or Share My Personal Information" request and we'll confirm our practices.

Categories of personal information we collect:

• Identifiers — your email address and account/authentication identifiers.
• Internet or other electronic network activity — your queries, conversation history, searches run, modes used, and credit/usage logs.
• Commercial information — your plan, subscription status, and credit balance (card details are collected directly by our payment provider, not by us).
• Inferences— we don't build advertising or behavioral profiles about you.

We collect this from you and from your use of the service, use it for the purposes in Sections 2 and 3, and disclose it only to the service providers in Section 4 for those purposes (a "service provider" relationship, not a sale). We don't knowingly collect or sell the personal information of anyone under 16.

Sensitive personal information.We don't seek to collect sensitive personal information, and we don't use or disclose it for purposes beyond providing the service — so the right to limit the use of sensitive personal information has nothing further to limit here.

Exercising your rights.Subject to the law's limits, you can request to know/access, delete, or correct your personal information, opt out of any sale or sharing, and limit use of sensitive information — and we will not discriminate against you for exercising these rights. Use the in-app export and delete tools or email privacy@superlurk.com; we verify requests against your account, you may use an authorized agent, and you may appeal a declined request by replying to our response.

Superlurk surfaces short snippets, thumbnails, handles, and public engagement metrics from posts made by creators on social platforms. If you are one of those creators — and not a Superlurk user — and you want to object to or request removal of how your public posts appear in our results, you can do that without an account. We explain exactly what we show, our lawful basis and balancing test, and how to object or request erasure on our Data Removal & Objection page.

We use only essential cookies: a session cookie that keeps you signed in — including on the anonymous guest account we create before you sign in. No advertising cookies, no cross-site trackers.

Some pages embed third-party content (for example a Reddit post or a privacy-enhanced YouTube player), which can set its own cookies when that content loads. For the full breakdown, see our Cookie Policy.

Superlurk is not directed at children and is only for people aged 16 or older. We don't knowingly collect data from anyone under 16; if you believe we have, contact us and we'll delete it.

Our service providers may process data in countries other than yours (including the United States). Where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by those providers.

The data controller for Superlurk is Scrapegg Software Private Limited, No. 8/2, 2nd Main, 2nd Cross, Chamrajpet, Bangalore South, Karnataka, India - 560018.

Where we are required to designate representatives under Article 27 of the EU GDPR and the UK GDPR, individuals in those regions can contact them — or us directly — about how we handle personal data:

You also have the right to lodge a complaint with your local data-protection supervisory authority (in the EU) or the Information Commissioner's Office (in the UK), though we'd appreciate the chance to address your concern first at privacy@superlurk.com.

We may update this policy as the product evolves. The date at the top shows the latest revision, and we'll notify you by email or in the app if a change is material.

Privacy questions or requests: privacy@superlurk.com. See also our Terms of Service and Copyright & DMCA pages.