Privacy Policy | 200Post

This Privacy Policy describes how 200Post (“we”, “us”, “our”) handles information about you when you use our website at 200post.com, any site we host for a customer on a 200post.com subdomain or custom domain, and any related services (together, the “Service”). 200Post is operated by Andres Carreón as a sole proprietor. You can reach us at 200post@andresio.com.

By using the Service you agree to this policy.

1. Information We Collect

Information you provide

Account information: your email address and name, typically from Google sign-in or a magic-link email.
Subscription information: if you subscribe, Stripe processes your payment. Stripe provides us with billing country, the last four digits of your card, transaction history, and a Stripe customer identifier. We do not receive or store full card numbers, CVVs, or other raw payment credentials.
Publication configuration: the publication name, niche, tone, language, keywords, colors, tagline, and subdomain or custom domain you choose when you create a site.
Communications: anything you send us by email or through support.

Information collected automatically

Usage data: pages visited, referrer, rough geography, device type, browser, and timestamps. We use this to operate, secure, and improve the Service.
Authentication cookies: required to keep you signed in, set by our authentication provider (Supabase).
Analytics: aggregated, privacy-friendly page-view metrics via Vercel Analytics. Vercel Analytics does not use third-party cookies and does not track individuals across sites.

Information about readers of customer sites

When a visitor reads a publication we host for a customer, we collect the same limited technical information described above (usage data, analytics). We do not place advertising or behavioral-tracking cookies on customer sites.

2. How We Use Information

To provide, operate, and maintain the Service, including hosting customer sites, generating and publishing articles, and keeping your account secure.
To process subscriptions, handle billing, and send transactional messages (receipts, account notices, security alerts).
To communicate with you about product updates and respond to support requests.
To investigate, prevent, and address fraud, abuse, security issues, and violations of our Terms of Service.
To comply with legal obligations and enforce our rights.

We do not sell your personal information. We do not use your information to train external machine-learning models.

3. Service Providers We Share With

We use third-party service providers to run 200Post. They receive only the information they need to perform their role, and they are contractually required to protect it.

Supabase hosts our database and provides authentication.
Stripe processes payments and manages subscription billing.
Vercel hosts the Service, serves customer sites, and provides page-view analytics.
Google provides OAuth sign-in if you use the “Continue with Google” option.
Anthropic powers the research and writing system that generates your publication’s articles. Anthropic receives niche-level prompts and published-article context, not your personal account information.
Replicate powers image generation for article cover images. Replicate receives the image prompt, not your personal information.

Each provider has its own privacy policy. Links are available on request.

4. Legal Disclosures

We may disclose information when we reasonably believe it is required by law, regulation, legal process, or governmental request, or necessary to protect the rights, property, or safety of 200Post, our users, or the public.

5. International Transfers

Our infrastructure is primarily hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to this transfer.

6. Data Retention

We retain your account information and site configuration for as long as your account is active. If you cancel, we keep associated records for up to 12 months after cancellation to handle billing, support, and legal obligations, after which we will delete or anonymize the information unless longer retention is required by law. Published articles may remain in our database for research and quality purposes after a site is deactivated, in a form that is not linked to any personal reader data.

7. Security

We use reasonable administrative, technical, and physical safeguards to protect information, including encryption in transit, access controls, and reliance on enterprise-grade infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct information that is inaccurate.
Delete your information, subject to exceptions for legal, billing, or fraud-prevention reasons.
Export your information in a portable format.
Withdraw consent where processing is based on consent.
Object to or restrict certain processing.
Lodge a complaint with a data protection authority.

To exercise any of these rights, email us at 200post@andresio.com. We will respond within a reasonable time and in accordance with applicable law.

9. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the “Last updated” date above. If changes are material, we will notify you by email or in-product notice when reasonably possible.

11. Contact

Questions about this policy or about how we handle your information? Reach us at 200post@andresio.com.