Legal

Privacy Policy

Last updated: August 19, 2026

Coldstart is operated by Lead Logger LLC (“Coldstart”, “we”, “us”). This policy explains what we collect when you use coldstart.app, the Coldstart REST API, and the Coldstart MCP server, why we collect it, who it goes to, and what you can do about it. It describes the product as it actually works today — not a generic template.

The short version

We collect your Google account name, email address and profile picture when you sign in, your searches and the leads they return, and your Stripe billing identifiers.
We run the Meta (Facebook) Pixel on this site for advertising. It sends Meta a hashed version of your email and name plus your Coldstart user ID once you are signed in. Details are in Advertising and the Meta Pixel below.
If you connect Gmail, we store an encrypted refresh token and use it for one thing only: sending the outreach emails you approved, from your own address. We never read your mailbox — we do not have the permission to.
We never see or store your card number. Stripe handles payments.
We do not sell your personal information. Email ioannis2004giannopoulos2@gmail.com to get a copy of your data or to have your account and everything in it deleted.

What we collect

Account information

Coldstart only supports Google Sign-In. When you sign in, Google gives us your name, email address, profile image URL and Google account identifier, and we store them along with the OAuth tokens issued for that sign-in and the scopes they cover. We create a server-side session and set a session cookie in your browser so you stay signed in.

Gmail connection (optional)

Connecting Gmail is a separate, optional step from signing in. It grants Coldstart the gmail.send scope and nothing else. We store the resulting refresh token encrypted with AES-256-GCM, along with the Gmail address it belongs to, so we can show you which account emails will be sent from. This scope allows sending only. It does not permit reading, searching, deleting or modifying anything in your mailbox, and we do not attempt to.

Billing information

Checkout and subscription management happen on Stripe. We store your Stripe customer ID, subscription ID, price ID, subscription status and current period end date. Your card number, CVC and billing address are entered on Stripe’s pages and are never sent to or stored on our servers.

Searches and lead data

For every search we store the query text you typed (or the URL you pasted), whether it came from the dashboard or the API/MCP server, the number of results, and a timestamp. Search counts are how monthly quotas are enforced (10/month on Free, 500/month on Pro).

For each lead returned we store the company name, website domain, a short text snippet from that company’s pages, a contact email address, a contact phone number and contact name when one was found, whether the email passed verification, the drafted outreach email, and the lead’s status (needs review, approved, sent). This information is gathered from the companies’ own public websites — see Lead data and your responsibilities.

API keys

Pro subscribers can issue API keys for the REST API and MCP server. We store only a SHA-256 hash of each key plus its first characters (so you can recognise it in the dashboard), a label, the creation and last-used timestamps, and whether it has been revoked. The full key is shown once, at creation, and is not recoverable afterwards.

Onboarding answers stored in your browser

If you go through the guided start flow, your answers (goal, audience, pain points and the search query built from them) are saved in your browser’s localStorage under coldstart.funnel.v1. They stay on your device; the dashboard reads them once to pre-fill your first search and then removes them. Clearing your browser storage deletes them immediately.

Technical and log data

Our hosting provider and our servers process the ordinary technical data any website receives: IP address, user agent, requested URL, timestamps and error traces. We use it to keep the service running, debug failures and enforce rate limits.

How we use it

To sign you in and keep you signed in.
To run your searches, store the resulting leads, and show them back to you.
To enforce quotas and rate limits (10 searches/month on Free, 500 on Pro, at most 10 searches per minute).
To take payment, manage your subscription, and gate Pro-only features.
To send the outreach emails you approved, from your connected Gmail account.
To measure advertising and improve the product (see the Meta Pixel section).
To answer your support emails, prevent abuse, and comply with legal obligations.

Where the GDPR applies, our legal bases are: performance of a contract (running the service you signed up for), legitimate interests (security, abuse prevention, product measurement), consent (advertising cookies and the optional Gmail connection, each of which you can withdraw), and legal obligation (tax and accounting records).

Google user data and Limited Use

Coldstart’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In concrete terms, for data obtained through Google APIs:

The gmail.send scope is used solely to send emails that you approved in the Coldstart dashboard, from your own Gmail address.
We do not use Gmail data for advertising, and we do not use it to train generalised artificial intelligence or machine learning models. The email drafts Coldstart produces are generated from public web page content and your business description, never from your mailbox.
We do not transfer Gmail data to third parties except as necessary to provide the sending feature, comply with applicable law, or as part of a merger or acquisition with your prior notice.
No human at Coldstart reads your Gmail data, except with your explicit permission for a specific support issue you raised, where required by law, or for security purposes such as investigating abuse.
You can disconnect Gmail at any time from the dashboard, or revoke Coldstart’s access at myaccount.google.com/permissions. When you do, the stored refresh token stops working and we delete it.

Advertising and the Meta Pixel

Coldstart runs the Meta (Facebook) Pixel across the marketing site, the sign-up funnel and the app. This is the part of this policy most people care about, so it is spelled out in full.

The Pixel loads Meta’s script in your browser and records page views on every route you visit on this site.
It records specific funnel events: viewing the pricing or sign-in pages, running a demo or dashboard search, completing registration, starting checkout, starting a trial, and subscribing — plus custom events for individual funnel steps and CTA clicks. Some events carry context such as which goal or audience you selected.
Once you are signed in, we use Meta’s manual advanced matching: your email address, first and last name, and your Coldstart user ID are passed to the Pixel script, which hashes them in your browser before sending them to Meta. Meta uses these hashes to match your activity to a Meta account and attribute conversions to ads.
We also send certain conversion events to Meta server-side through Meta’s Conversions API: completing registration, running a search, starting a trial, and subscribing. These server events carry a SHA-256 hash of your email address, your first name, and your Coldstart user ID, plus — when you arrived from a Meta ad — the Meta browser identifiers (_fbp/_fbc cookies) captured at checkout. Server-side events exist so ad attribution keeps working when browsers block the Pixel; they are deduplicated against the browser events so nothing is counted twice.
Meta acts as an independent controller for the data it receives and processes it under its own terms. Under the CCPA/CPRA this kind of ad-attribution disclosure — browser-side and server-side alike — may count as “sharing” personal information for cross-context behavioural advertising. We do not sell personal information for money.

To opt out: block the Pixel with a tracking-blocker or browser privacy setting, adjust your Meta ad preferences at facebook.com/adpreferences, or email us at ioannis2004giannopoulos2@gmail.com and we will exclude your account from advanced matching. Opting out does not affect your ability to use Coldstart.

Cookies and local storage

We use a small number of cookies and browser storage entries: a session cookie that keeps you signed in and its CSRF companion (strictly necessary — the app cannot work without them), a short-lived cookie holding a random state value during the Gmail connection flow (security), the coldstart.funnel.v1 localStorage entry described above, and the cookies set by Meta’s Pixel script for advertising and measurement. Stripe sets its own cookies on its checkout and billing portal pages.

We do not sell your personal information. We share it with the service providers below, each only with what they need to do their job:

Google — sign-in, and sending your approved emails through the Gmail API when you connect it.
Stripe — payments, subscriptions and the billing portal. Stripe receives your name and email to create your customer record and handles your card details directly.
Meta Platforms — advertising measurement, as described above.
Exa — the live web search and crawling engine behind every search. Exa receives the search text derived from your query (and the URL, if you pasted one) in order to return results.
Railway — application hosting and the production database.
PostHog — product analytics and error tracking. PostHog automatically records page views, clicks and other interactions on this site (autocapture), receives the same funnel events as Meta, and captures application errors with technical context. Once you sign in, this activity is associated with your user ID, email and name. We may also enable session replay, which records a reconstruction of your interactions with our pages (with form input masked) so we can diagnose usability problems. PostHog stores this data on our behalf in the United States.
Anthropic — not currently used. Email drafts today are generated by a deterministic template running on our own servers. We intend to move drafting to Anthropic’s Claude API, at which point your business description and the public page snippet for each lead would be sent to Anthropic to generate the draft. We will update this policy and the date at the top before that goes live.

We may also disclose information where we are legally required to, to enforce our Terms of Service, to protect the rights and safety of users, or to a successor entity in a merger or acquisition.

Where data lives, and how it is protected

Production data is stored in a PostgreSQL database hosted on Railway. Traffic to and from Coldstart is encrypted in transit over HTTPS. Gmail refresh tokens are additionally encrypted at rest with AES-256-GCM, so a database dump alone does not yield the ability to send mail as you. API keys are stored only as SHA-256 hashes. Access to production data is limited to the founder; an internal admin view exists and is restricted to an explicit email allowlist checked on the server.

No system is perfectly secure. We do not promise that our security measures will never be defeated, and you should keep your Google account protected with a strong password and two-factor authentication.

How long we keep it

Account, search and lead records are kept for as long as your account exists, so your lead history stays available to you.
Gmail refresh tokens are kept until you disconnect Gmail, revoke access at Google, or the token stops working — whichever comes first. We delete the stored token automatically when a refresh fails.
Billing records are retained as long as required by tax and accounting law in the operating jurisdiction, typically six to ten years.
When you ask us to delete your account, we delete your user record and everything linked to it — sessions, searches, leads, API keys and the Gmail token — within 30 days, except records we are legally required to retain. Data held by Stripe and Meta is subject to their own retention policies; we will forward a deletion request where we can.

Lead data and your responsibilities

Coldstart searches the live web and extracts business contact details that companies have themselves published on their own websites. Those details can constitute personal data — a named person’s work email address usually does — so it is worth being clear about who is responsible for what.

For your own account data, Coldstart is the controller and this policy governs it.
For the lead data you search for, review and email, you are the controller. You chose the search, you decide who to contact and what to say, and you send from your own address. Coldstart processes publicly available business information on your instruction and stores it in your account so you can work with it.
You are responsible for making that outreach lawful in the places you send it — including CAN-SPAM, GDPR and ePrivacy, CASL and equivalent rules — for identifying yourself honestly, for honouring opt-out and erasure requests promptly, and for maintaining your own suppression list. This is spelled out further in the Terms of Service.

If you are a business contact whose details appeared in a Coldstart search result and you want them removed from our systems, email ioannis2004giannopoulos2@gmail.com from or referencing that address and we will delete the stored records and, where technically possible, suppress the domain from future results. We cannot remove the information from the website where it is published, and we cannot control what a Coldstart user has already exported or sent.

Your rights

Depending on where you live you may have the right to access the personal data we hold about you, correct it, delete it, export it in a portable format, restrict or object to certain processing, withdraw consent you previously gave, and opt out of the sharing of your information for targeted advertising. You also have the right not to be discriminated against for exercising these rights — using them will not change your price or your access.

To exercise any of them, email ioannis2004giannopoulos2@gmail.com. We will respond within 30 days. We may need to verify that you control the account’s email address before acting. If you are in the EEA or UK and think we have handled your data badly, you can also complain to your local data protection authority; ours is the supervisory authority in the State of Illinois, United States.

International transfers

Coldstart is hosted in, and our providers (Google, Stripe, Meta, Exa, Railway, PostHog) operate from, the United States and other countries. Using the service involves transferring your data to those countries. Where required, those transfers rely on the European Commission’s standard contractual clauses or an equivalent safeguard offered by the provider.

Children

Coldstart is a business tool sold to adults. It is not directed at children, we do not knowingly collect data from anyone under 18, and you must be 18 or older to hold an account. If we learn that we hold data about a child, we will delete it.

Changes to this policy

When the product changes, this page changes with it. We will update the date at the top, and for material changes — new categories of data, new third parties, a new purpose — we will email account holders before the change takes effect. Continuing to use Coldstart after that means you accept the updated policy.

Contact

Coldstart is run by one person. Privacy questions, data requests and complaints all go to the same place: ioannis2004giannopoulos2@gmail.com. The data controller for your account data is Lead Logger LLC, established in the State of Illinois, United States.