Privacy

Small product, small data footprint.

Effective September 19, 2026

Operator

They Talk About is operated by Bjola Software Inc. in British Columbia, Canada. Questions and deletion requests can be sent through the contact page.

What we store

We store your waitlist or verified email, access decision, product names and URLs, problem statements, search phrases, selected markets, search-run state, normalized public discussion fields, private notes, workflow decisions, and any public reply URL you choose to record. AI features also store bounded attempt state, validated output, model token counts, conservative integer-cent cost records, and compact strategy feedback. For website suggestions, the owned run also keeps the same bounded plain text extracted from the fetched public product page, its final address, and the date it was read. Discussion-analysis records include an input hash and source-strategy provenance, not the pasted page body.

Service providers

Supabase provides authentication and database storage. Vercel hosts the application and processes anonymized public-page analytics. DataForSEO performs the exact searches you approve. Cloudflare Turnstile helps protect the waitlist and sign-in forms from automation. OpenAI processes bounded product context for website phrase suggestions and, when you explicitly analyze a discussion, normalized forum text, reduced structural observations, and the owned product and opportunity context. DataForSEO may retain task results for up to 30 days; Cloudflare processes challenge and network information under its own policies.

TypeSafe, during a pilot, receives the name and published rules of communities the application reads, and, when you explicitly analyze a discussion, the same bounded discussion text and product name, audience and problem that OpenAI receives. It answers in numbers rather than prose: a probability for each answer to a fixed question. We record those numbers, and the operator compares them with the application's own reading or with a reading the operator makes by hand; no one else sees them and nothing you see is changed by them. TypeSafe receives no account email, note, reply URL, discussion URL, credential, or output from another provider. TypeSafe has not published a retention period for submitted content; until it does, we treat what we send as retained.

OpenAI data handling

OpenAI application-state response storage is disabled for both phrase suggestions and pasted-discussion analysis, but that is not zero retention. The project currently uses OpenAI's default API data controls, under which abuse-monitoring logs may retain submitted customer content for up to 30 days. OpenAI receives no forum credentials, Supabase credential, DataForSEO credential, account email, private note, reply URL, investigation bundle, or tool access from these calls.

Pasted discussions and investigation files

The maker deliberately supplies each discussion snapshot. Clipboard HTML is reduced in the browser to bounded text and semantic control observations and then discarded. Saving compact feedback transiently sends the bounded text and observations to the application server so it can recompute the owned source strategy; this does not call OpenAI. The application does not retain the raw HTML, submitted normalized block and observation collection, complete prompt, provider response object, or investigation starting case. Validated analysis output may retain bounded evidence excerpts cited from submitted blocks or observation labels. Analysis can label a response state as deterministic or AI-assisted, but it does not inspect the live page or prove that replies are currently allowed.

A locally downloaded investigation starting case can still contain names, messages, or other personal data. It is outside application retention and account deletion, must remain outside git, and is intended for one supervised development loop. Delete it and any later DOM, console, or network sample when that loop ends.

What we do not collect

We do not ask for forum credentials, control your browser, read private messages, buy a persistent browser fingerprint, or store complete provider responses. The application cannot inspect a live forum DOM, execute DevTools code, probe forum endpoints, upload investigation material, or post a response. Do not enter confidential, regulated, or client information in product context, search phrases, pasted discussions, or investigation notes.

Retention and deletion

Application data remains until you delete your account or ask us to remove it. Encrypted pre-migration database exports are destroyed within 14 days. Account deletion removes your live products, searches, discussions, notes, replies, suggestion candidates and attribution, completed analysis, compact strategy feedback, and linked interaction and AI-usage data. TypeSafe judgments about your analyses are deleted with the analysis. It cannot remove files you downloaded or material retained under a processor's separate policy.

Measurement

We derive most product metrics from operational records. We record source-link activation and workflow actions, strategy versions and compact outcomes, suggestion acceptance or editing, model token use, and conservative AI cost in integer cents. Pasted or investigation bodies do not enter analytics. AI use and DataForSEO search use are measured separately. A source-link activation does not tell us whether the external page loaded.

Vercel Web Analytics counts visits to public pages using anonymized data. It reports the visited page, referring page, broad location, browser, operating system, device category, and time of the visit without using cookies. We do not attach these analytics records to your account, products, searches, or discussions.

Report pages, which live under the /r/ path, load no analytics and set no cookie. The application stores a count of requests for each page and nothing else about its readers; that count includes the fetches made by link previews, so it is a count of requests and not of people. Vercel's hosting logs record requests to them, including the page address, as they do for every page on this site. The report text is held in the application's database while its page is up and is deleted from it when the page is taken down; the address, the product's name and public URL, and the dates stay, as the record of when a page went up and when it came down. Before a report is written, an administrator may approve a citation check, which sends the report's buyer questions to OpenAI with web search on. The application keeps the domains each answer cited and whether it cited or named the product, and never the answer's text; the questions are deleted with the report's text. The public thread where a report was offered is held privately by the operator for 90 days after the last update, and is deleted when the product's maker asks for the page to be removed.