Privacy policy

• Research and results. Questions you submit, product and category names and saved query configurations. Research findings, source links and excerpts, ratings, retailer prices, generated shortlists, comparisons and Catch Up summaries are processed only in request and active-view memory, not retained in our database, caches, browser storage or logs.
• Account and sign-in information. The email, name, profile image and provider account identifier supplied by your enabled sign-in provider, currently Google. Our authentication adapter can store provider access, refresh and identity tokens, scopes and expiry information, plus Lately session records. We do not receive your Google or Apple password or request access to your email messages for sign-in.
• Trackers and alerts. Products followed, schedules, stars, tags, user-entered rating, sentiment, price and verdict targets, delivery preferences, next-check and lease/retry metadata, generic delivery notices, and sent, read and link-open times. No snapshots or observed values are stored. Inferred currencies are not retained.
• Subscription information. Your plan, Stripe customer and subscription references, subscription status and billing-period information. Stripe collects payment and billing details directly. Lately does not store full payment card numbers or security codes.
• Technical and usage information. Anonymous session identifiers, account identifiers, IP addresses used for anonymous request limits, and events such as submitted questions, completed research, upgrades, tracker actions and source-panel opens. Event properties are restricted to operational identifiers, error codes, cost and duration; they do not include queries, source content or observed research values. Hosting and infrastructure providers also process request metadata, including IP addresses, browser information and operational logs.
• Correspondence. Your email address, message and information you choose to send when requesting support, a correction, a refund or help exercising your rights.
• Marketing preferences and consent. If you choose to receive marketing emails, we record your account identifier, email address, the exact consent wording and version, when and how you opted in, and subsequent preference changes or withdrawals. We also store a random unsubscribe token so you can stop marketing without signing in.

Information comes from you, your browser, your sign-in and payment providers, and public research sources. Please do not put confidential or sensitive personal information in questions or tags. Product interests and queries may reveal information about you even without your name.

We use information to answer questions, produce temporary research, associate anonymous saved questions with an account when you sign in, manage subscriptions, run trackers, send requested alerts and provide support. We also use it to apply usage limits, control research costs, prevent abuse, investigate failures, understand product usage and improve the Service.

Only if you separately and expressly opt in, HelloNoon uses your account email address to send Lately newsletters, promotional product updates, Plus offers and upgrade campaigns. This is optional and is not a condition of creating an account, using Lately or subscribing to Plus. Signing in with Google or another provider, accepting our terms, or continuing to use Lately does not by itself give marketing consent. Existing users are not automatically opted in by this policy update.

You may instead request one email when Lately Plus is fully available, using the unchecked signup choice or the in-app banner. This separate Plus launch notification does not subscribe you to newsletters or ongoing marketing. We record its wording, version, email, time and source separately in consent history, and remember banner dismissal so we do not keep asking. You can turn the launch notification off in Account. A marketing unsubscribe link stops both ongoing marketing and any pending Plus launch notification.

Where applicable data-protection law requires a lawful basis, we rely on providing a requested service or performing a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, or consent where required. We do not sell personal information or use it for cross-context behavioural advertising. We do not display third-party advertising or use affiliate links.

Saved Briefs retain only your question and ownership/sharing configuration. Each explicit run starts fresh. Shared questions can appear on public product pages, homepage examples and search-engine listings. New comparison questions are private library inputs unless shared; older public comparison directory entries may remain without an account association. Shared links expose questions, not archived findings. Visiting a saved/shared/preview link does not start research automatically.

Your Library lets you rediscover saved inputs, revoke a share link or confirm deletion of a question and your dependent trackers/notices. A revoked link stays disabled if you later create a new share link. We preserve other people’s independently saved question copies; revocation or deletion cannot recall copies already made by recipients, browsers, search engines or providers. Findings are not included in the Library.

We do not display your account email or name as the person who asked for research. However, shared query text is visible, so removing your displayed identity does not make sensitive inputs safe to submit. Deep Review is excluded from the standard public product-page listing, but paid access and unlisted URLs are not a promise of confidentiality. Tracker settings, tags, billing records and account details are not intended to be public.

Lately uses an HTTP-only first-party cookie called lately_sid to associate anonymous research and activity with a browser. It is set with a lifetime of up to one year. It contains a random identifier, not your name, but we treat it as potentially identifying information because it can be linked to activity and later to an account. Separate authentication cookies support sign-in, session security, callback URLs and request-forgery protection. Their names and expiry depend on the sign-in flow.

If you tick the Plus launch notification choice before signing in, tab-local session storage remembers that choice for up to ten minutes across the sign-in redirect. It is bound to the first signed-in account and removed after the save attempt. An unchecked choice or failed sign-in does not grant consent.

Browser local storage records visit and notice-display times for returning signed-in Free users so we can decide when to show a Plus reminder. Anonymous usage-limit keys may contain your IP address; the current daily counters have approximately 24-hour expiry. This is separate from infrastructure logging, which follows the providers’ retention arrangements.

Opening an alert’s tracked link records that link access and can mark the alert read before redirecting to the Brief. This measures link engagement, not a guaranteed human read; email security scanners can also open links. You can remove a tracker to stop its future alerts and, where available, use its delivery settings. Essential account or billing notices may still be sent.

You can clear cookies and local storage or block them in your browser, but sign-in and parts of the Service may not work. Lately’s product-usage events are stored in our own application database rather than a separate third-party advertising analytics service. That database is still hosted by an infrastructure provider.

We use providers for the following purposes, according to the features and deployment configuration:

• Hosting and storage: Vercel for the web app, Neon-hosted Postgres for query/account/operational records, a Python research service, and Redis/Upstash where enabled for temporary usage/spend counters only.
• AI: Anthropic’s API receives research queries, product context, public excerpts, source metadata and, for Catch Up, selected video transcripts to generate summaries and recommendations.
• Research: Brave Search API, public Bluesky services, YouTube/Google APIs, relevant public websites, and Reddit through ScrapeCreators only when commercial access is approved receive search terms or content requests. Plus Deep Review also sends the product phrase to the public Hacker News search API, GitHub’s public API, and Polymarket’s public Gamma API.
• Identity and payments: Google, and Apple when offered, provide sign-in; Stripe processes checkout, recurring payments and billing management.
• Email and support: our configured SMTP and mailbox providers process recipient addresses, alert content, consented marketing email content, unsubscribe links, delivery information and support correspondence.

Account credentials and payment card details are not included in research prompts. Queries and public-source text are sent to AI and search providers, so do not include private information in them. Provider processing and retention are governed by our service arrangements and their applicable policies; we do not promise zero retention or a particular model-training treatment without a verified agreement. Lately does not use research results for model training, evaluation or improvement. Brave processing is described in its privacy information.

We may give authorised personnel and providers access as needed to operate the Service, resolve support requests, protect against abuse or comply with law. We may disclose information where legally required, to protect rights and safety, or in a business transfer subject to appropriate legal protections and notice where required.

HelloNoon operates from Australia. Our providers may store or process information outside Australia, including in the United States and other countries in which they operate. Information is not guaranteed to remain in Australia. Where applicable law requires safeguards for an international transfer, we must use an appropriate lawful transfer mechanism. Contact us for information about the arrangements relevant to your request.

We use HTTPS, authenticated account access and server-side access checks, with credentials kept on the server, to help protect information. No online service is completely secure. Keep your sign-in provider account secure and contact us promptly about suspected unauthorised access.

Account, subscription, saved-query, tracker, generic delivery and usage records are stored to operate the Service and meet security, support and legal needs. We do not currently apply a universal automatic deletion period to these database records. Retention depends on the record’s purpose, your requests, legal obligations and provider or backup arrangements.

We retain marketing consent and withdrawal records as needed to demonstrate permission and honour opt-outs, including after you unsubscribe, subject to applicable law and your privacy rights. We do not treat an unsubscribe as permission to contact you again for marketing.

Research findings are not retained after the request/active view. Reloading or returning to a saved question requires a fresh run. We do not retain price/sentiment history, snapshots, prior comparisons or Catch Up findings. Removing a tracker deletes its generic delivery notices. Signing out does not delete your saved queries, account or subscription.

Account deletion is currently a support request, not a self-service button. After appropriate identity checks, we will review deletion or de-identification of your account and associated personal records, and explain any information we must retain. Shared question inputs may remain without their account association unless they contain personal information requiring removal. Billing records, backups and provider records may be retained where necessary or required by law. Cancellation of billing is separate; use Account → Manage billing or ask us for help. Legacy research must be purged during migration. Historical backups, CDN copies and provider mail archives require a separate retention review; changing schemas alone does not erase those copies.

To request access, correction, export or deletion, contact isaac@hellonoon.studio.

Research can temporarily process public author or channel names, handles, excerpts, URLs, video timestamps, engagement counts, ratings and other source metadata. These findings are not stored. Publicly available information can still be personal information. If you are quoted and believe content is inaccurate, private or improperly used, send the result URL, original source URL and an explanation so we can review it.

Clicking a source or “Keep exploring” search link takes you to a separate site. Prefilled web, YouTube and Bluesky searches send the displayed product or topic text to that site when you open the link. The destination may collect IP, browser or account information under its own policy. See the Google Privacy Policy for Google and YouTube. You can review or revoke Google connections through your Google Account; revoking a connection does not by itself delete data already stored by Lately or cancel billing.

You can give or withdraw marketing consent through the optional email preference on your account page. Every marketing email identifies HelloNoon and includes contact details and an unsubscribe link that does not require a login or additional personal information. Confirming unsubscribe stops future marketing sends immediately; we honour requests made through support within five working days, or sooner where required by law. Unsubscribe links remain usable for at least 30 days after sending. Withdrawing marketing consent does not affect your access to Lately, essential account, security or billing notices, or tracker alerts you separately requested.

Depending on the laws that apply to you, you may request access, a copy, correction, deletion, restriction or portability of personal information, object to certain processing, or withdraw consent where consent is the basis. These rights are subject to applicable exceptions; we may need to verify identity and authority before acting. We will explain a refusal or retention requirement where the law requires it. We do not discriminate against you for exercising applicable privacy rights.

Contact us with your request or complaint and enough detail to locate the relevant records, but do not email passwords or full payment card details. We aim to respond promptly and within any timeframe required by applicable law. If you are not satisfied, you may contact the Office of the Australian Information Commissioner where it has jurisdiction, or the relevant privacy regulator in your location.

Lately is intended for adults aged 18 and over, not children. If you believe a child has supplied personal information, contact us so we can investigate and take appropriate action. We may update this policy as the Service or legal requirements change, update the date above, and provide notice of material changes through the Service or account email where appropriate.

For every privacy or support enquiry, write to isaac@hellonoon.studio.