Privacy policy
Buteo stores what it needs to run your validations and to stop the free trial being abused, sells none of it, and lets you delete your account yourself. This page says exactly what is kept and who else handles it.
By Buteo · Updated
Who is responsible for your data?
Buteo is operated by the operator of Buteo, which decides how the data described here is used. Questions and requests go to support@buteo.ink.
What does Buteo store about you?
| What | Why |
|---|---|
| Account | Your name, your email address and a salted hash of your password, so that you can sign in. Buteo cannot read your password. |
| Your work | The ideas you submit, your answers to its questions, the evidence and reports produced, experiment results you report, and the studies and build plans you start. |
| Credits | Your balance and a history of every credit granted or spent, so that the balance can be explained. |
| Notifications | The address you ask verdicts to be sent to, and a browser push subscription if you turn alerts on. |
| Feedback | The thumbs-up or thumbs-down you send and anything you type beside it, with your account and the result it is about, so that the product can be improved. Deleted with your account. |
| Free-trial records | See the next section. They exist to stop one person claiming the free validation many times. |
How is the free trial protected against abuse?
The first validation is free and needs no card, so nothing identifies a person who claims it. To stop the same person claiming it repeatedly, Buteo records three signals when you confirm your email address:
- Your mailbox, with any “+tag” removed, so one mailbox is one trial.
- A device cookie: a random identifier your browser keeps for up to 400 days.
- A coarse browser fingerprint, computed in your browser from a handful of stable attributes, and, where the hosting setup provides it, the network range the request came from.
Each is stored only as a keyed hash, which cannot be turned back into the address, the cookie or the network. The fingerprint is never used on its own. These signals are used to decide the free trial and for nothing else: not for advertising, and not to follow you between sites.
These records are kept after an account is deleted. Otherwise deleting an account and registering again would be a free validation each time. They contain hashes, not your details.
Who else handles your data?
Buteo sells no data and shows no adverts. It relies on these providers to work, and sends each one only what its job needs:
| Provider | What it receives |
|---|---|
| A language-model provider | The idea you submit and the text of the web pages found about it, to produce the analysis. |
| Tavily (web search) | Search queries written about your idea, and any link you paste into a case study. |
| Hacker News search (Algolia), Stack Overflow, GitHub and Apple's App Store search | A few search terms taken from those queries, to find threads, questions, repositories and apps about the same subject. No account detail is sent, and nothing you wrote is sent whole. |
| Polar (payments, merchant of record) | Your account id and what you buy. Polar takes the payment; Buteo never sees your card. |
| Resend (email) | Your email address and the message, for verification codes and the verdict emails you ask for. |
| Vercel (hosting and analytics) | Requests to the site, and, only if you allow them, page-view statistics that are not tied to your account. |
| A managed database host | Everything Buteo stores, described below. |
| Google (source icons) | The names of the sites your evidence comes from, asked for by your browser to draw each one's icon. Not your idea, and not your account. |
Who can see your ideas?
- A validation is visible only to you.
- If you share an idea, other signed-in users see its title, summary and verdict, never your evidence, hypotheses or scores. You can unshare it at any time.
- A finished go-to-market study joins a library every signed-in user can read. Deleting the study removes it.
- A study may be featured on the public site, where anyone can read it, only with its author's agreement.
- A build plan is private to the account that made it.
How do you delete your data or exercise your rights?
You can delete your account yourself, in Settings. That removes your account, your ideas, their evidence and reports, your studies and build plans, your credit history and your push subscriptions, and deletes your customer record at the payment provider. The hashed free-trial records described above are the one thing that remains.
Depending on where you live, you may also have the right to see, correct, export or restrict the data held about you, and to complain to a data-protection authority. Write to support@buteo.ink and we will answer.
Will this policy change?
If it does, the date at the top of this page changes with it. See also the terms of service.