Privacy policy

The short version: we collect what the features need and nothing more, analytics stays off until you switch it on and goes off again the moment you say so, and deletion is self-serve. See also the terms of service.

1. Who is collecting

First Launch (firstlaunch.promo) is operated by D-EFFCON Pty Ltd in Australia. We handle personal information under the Australian Privacy Principles, and we extend equivalent rights — access, correction, deletion — to visitors everywhere, including the EU, the UK and Switzerland. Contact for anything on this page: support@firstlaunch.promo.

2. What we collect, and why

Accounts: your email, name and avatar from Google sign-in or magic-link login, plus the profile details you add — country of residence (required, it drives local features and correct tax invoices), interests, and notification preferences.

Newsletter: your email, optional country and interests, your opt-in status, and which of our weekly editions you were sent. Subscribing is separate from having an account.

Founder listings: the product and deal details you submit, a contact email for lifecycle notices, and invoice records. Payments are processed by Stripe — card details never touch our systems.

Community activity: your reactions, follows, comments and reports, attributed to your profile.

Technical: every request to this site arrives carrying your IP address, as every request on the internet does, and our server reads it. Two things are done with it here. Our hosting provider keeps it for a short time in standard request logs, the way any web host does. And we turn it into a salted hash — a one-way scramble — to key the counters that stop the site being scraped or spammed; the salt rotates daily, so those hashes cannot be joined across days into a browsing history. We never store the address itself in our own database, never attach it to your account, and never put it into anything we send anywhere.

What we cannot do is stop it travelling, and it would be misleading to say otherwise: an address is how a reply finds you, so every request your browser makes carries it to whoever answers. When a measurement script on this page contacts Google or Vercel, their servers receive yours exactly as ours does. What each does next is the part that matters. Google says it uses the address to work out an approximate location and does not log or store it. Vercel — who host this site as well as measure it — turns it into the 24-hour visitor hash described in section 3. Neither reports the address itself back to us, neither of us can tie it to your account, and section 3 sets out everything they do record.

3. Cookies, analytics and your choice

We ask everybody, wherever you are. Analytics starts switched off and stays off until you accept it — there is no country where it is on by default, and we do not use your location to decide what to ask you. Google Analytics 4 is loaded through Google Tag Manager in Google's Consent Mode v2, which means that until you accept, nothing may be written to your device and nothing measured can be tied to you. Accepting or refusing takes effect immediately, without a page reload, and the "Cookie preferences" link in the footer of every page reopens the same panel whenever you want to change your mind.

What we ask consent for, and nothing more: analytics. That one switch covers two things — Google Analytics 4, which counts what happens, and Microsoft Clarity, which shows us how a page was used. There is a second switch for advertising, and it is off; we run no ads, no remarketing and no advertising pixels, and the switch exists so that if that ever changes it cannot start without your agreement. We never sell personal information and we never share it for advertising.

Clarity deserves its own paragraph, because it is the one thing here that records rather than counts. When you accept analytics, it builds heatmaps of where people click and how far they scroll, and it can replay a visit as a silent, cursor-level playback of the pages you saw — a more intimate thing than a page-view count, and you should know it before you agree rather than after. Three limits, and we would rather be held to them than to a reassuring summary. It never runs at all on sign-in, claim, submit or onboarding pages, so the pages where you type something private are not recorded in any form. What you type into a form elsewhere is masked in your own browser and the masked content is never uploaded, so a recording shows that a field was filled, not what was in it. And there is no camera, no microphone and no keylogging: it sees the page, your pointer and your scrolling, nothing outside the browser tab. Refuse analytics and none of it loads — we checked that by loading the site as a refused visitor and watching what left the browser, which was nothing.

One more thing about Clarity that we would rather say plainly than bury in the table. It is a Microsoft product, so when it loads, Microsoft sets cookies on their own domains as well as the two this site sets — and one of them, MUID, is an identifier Microsoft also uses for advertising across its properties. We run no ads, buy no remarketing and place no advertising pixel of our own; we never see that identifier and get nothing from it. But it is set when you accept analytics, and telling you there are no advertising cookies on this site would be untrue. If that is not a trade you want, refusing analytics prevents it entirely, and so does a tracking blocker.

One thing we should be straight about, because "nothing happens until you accept" would be a slight overstatement: while analytics is switched off, Google's tag still sends Google a cookieless signal that a page was viewed. It sets and reads nothing on your device and carries no identifier that could follow you across sites; like every request on the internet it reaches Google carrying your IP address, as section 2 explains, and Google uses the signal only to estimate overall traffic. That signal is the only thing Google gets from a visit you have not consented to. What you do on the page is not part of it — revealing a code, reacting to a launch, subscribing, starting a claim or submitting one are recorded only if you accepted analytics, and are not sent in any form if you did not. If you would rather even the page-view signal did not happen, a tracking blocker or your browser's "block third-party scripts" setting stops it, and the site works exactly the same.

Two more things run regardless, because neither one stores or reads anything on your device either: Vercel Web Analytics and Vercel Speed Insights, which count page views and measure real-world page speed. To count you once rather than twice, Vercel derives a hash from your request that lasts at most 24 hours and is then discarded — so there is no persistent or cross-site identifier, no cookie, and nothing that survives to be joined up with tomorrow. Alongside the page address (redacted as described below), each measurement can carry the page you came from, an approximate location from your IP, your browser, operating system and device type, and for speed measurements the page template and the timings themselves. None of it is tied to your account, and your IP address itself is not part of what either product reports back to us.

Whichever of the four is measuring, the same rule decides what may be recorded about a page. We exclude the dashboard, admin and notification pages entirely, and we strip the query string from sign-in, claim, submit and onboarding addresses before anything is recorded — those carry one-time codes, verification tokens and, on the submit page, your own unpublished draft. Everything after a "#" is dropped from every address, everywhere, because that is where a sign-in link puts its token. That applies to Google Analytics 4 as well as to the two Vercel measurements: the page address it is given is one this site works out, with those parts already removed. Clarity is held to a stricter version of the same rule, because stripping an address does nothing about a recording of the page it belongs to — on those four, it does not run.

Your choice is stored for six months, after which we ask again. Clearing your cookies clears the choice with it, and the next visit starts where everyone starts: switched off, and asking.

4. Who we share with

Service providers only, each for one job: Supabase (database and authentication), Vercel (hosting and the cookieless measurement above), Google (Tag Manager and Analytics 4 — nothing that identifies you without your consent, and the cookieless signal described in section 3 whether or not you give it), Microsoft (Clarity — heatmaps and session replay, only if you accepted analytics, and never on the pages section 3 names), Stripe (invoicing), Postmark (transactional email), and MailerLite via Make.com (newsletter delivery, if you subscribed). Some of these providers process data outside Australia — primarily in the United States — under their own compliance programs, which for EU and UK transfers means Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. We never sell personal information, and we never share it for advertising.

5. How long we keep it

Account and community data: for the life of your account. Newsletter data: until you unsubscribe (we then keep the suppressed address so we don't email you again). Invoice records: as long as Australian tax law requires. Rate-limit hashes: hours to days by design. Analytics: Google Analytics 4 retains event data for 14 months; Clarity keeps session recordings for 30 days and heatmap data for up to 9 months, which is Microsoft’s window and not one we can extend; Vercel's aggregate counts carry no identifier to retain.

6. Your choices

Change your cookie choice any time with the "Cookie preferences" link in the site footer — take analytics back as easily as you gave it. Unsubscribe from the newsletter with one click in any edition. Turn announcement and reply emails off in your profile. Delete your account from your profile page: your comments become "deleted user" with the text preserved, your reactions and follows are removed, and your personal details are erased. For access, correction or a full export, email support@firstlaunch.promo — we respond within 30 days. If you are in the EU or UK and think we have got something wrong, you may also complain to your national data protection authority; in Australia, to the Office of the Australian Information Commissioner.

7. Changes

Material changes to this policy are dated here. Last updated 15 September 2026 — this revision adds Microsoft Clarity (heatmaps and session replay) to the analytics consent described in section 3, says where it does not run, and lists the Microsoft cookies that come with it. The revision before it, on 10 September 2026, documented the cookie consent notice, Google Tag Manager and the Vercel measurement.