Privacy Policy

Account information: When you sign up, we collect your email address, an optional display name, and a hashed version of your password. We never store your password in plain text.

API keys: We store a one-way SHA-256 hash of your API key. The raw key is shown only once at creation and is never stored by us.

Search history: We store the queries you run, the sources selected, the results returned, and the timestamp of each search. This is used to power your search history view and for billing purposes.

Billing information: We use Stripe to process payments. We store your Stripe customer ID, subscription status, and credit balance. We do not store credit card numbers — Stripe handles all payment data.

Usage data: We log API request metadata (timestamps, endpoints called, response codes) for debugging and abuse prevention. We do not log request or response bodies beyond what is stored as part of your search history.

• To provide and operate the Uncover service
• To process payments and manage your credit balance
• To send transactional emails (account creation, billing receipts)
• To detect and prevent abuse, fraud, and unauthorized access
• To improve the service based on aggregate usage patterns

We do not sell your personal information to third parties. We do not use your data for advertising. We do not share your search queries or results with anyone.

Your data is stored in a PostgreSQL database hosted by Neon (neon.tech), with servers located in the United States. We use industry-standard encryption in transit (TLS) and at rest.

API keys are hashed using SHA-256 before storage. Passwords are hashed using bcrypt with a cost factor of 10.

While we take reasonable steps to protect your data, no system is completely secure. You use Uncover at your own risk.

We retain your account data for as long as your account is active. Search results are retained for 90 days and then automatically deleted. If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law or for fraud prevention.

We use the following third-party services to operate Uncover:

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Neon — database hosting. Data stored in US-East region.
• Render — API server hosting.
• Vercel — web app hosting.
• Resend — transactional email delivery.
• Groq / OpenRouter — AI analysis of scraped content. We send anonymized post content for analysis; no personally identifiable information is included.

Uncover scrapes publicly available data from Reddit, X (via Nitter), HackerNews, and optionally other public websites as requested by users. We do not scrape private or authenticated content. Scraped content is processed to extract insights and then discarded — we do not build long-term archives of scraped content.

If you believe content associated with you has been inappropriately processed, contact us at privacy@thealxlabs.ca and we will address your request within 14 business days.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Portability: Request your data in a machine-readable format
• Objection: Object to certain types of processing

To exercise any of these rights, email privacy@thealxlabs.ca. We will respond within 30 days.

Uncover complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) applicable to Canadian businesses. If you are located in the European Economic Area, you have additional rights under GDPR. If you are located in California, you have additional rights under CCPA.

By using Uncover, you consent to the transfer of your information to Canada and the United States for processing.

For privacy-related inquiries: privacy@thealxlabs.ca

TheAlxLabs — Toronto, Ontario, Canada