Information in this workspace
Optional dictation uses your browser speech service after you start it and grant microphone access. The browser provider may process audio; recognized text is editable and is never automatically submitted. We process the name and email you provide for an account, authentication records, your brand brief, product concepts, store settings and social drafts. Passwords are hashed by Better Auth. Authentication may also process session identifiers, IP addresses and browser information for account security. Google may share your profile information when you choose those sign-in methods after they are enabled.
Free-offer signups
If you reserve the 7-day free offer, we save your email address, the offer, signup source, consent version and signup date in Cloudflare D1. We use this information to manage your reservation and contact you about this offer. This does not create an account, begin a trial or authorize a charge. Signup protection stores a rotating one-hour hash of your network address with an attempt count. Expired attempt records are removed when the endpoint is used again. To request access to or removal of your signup, contact austinhfrankel@gmail.com. We do not subscribe this list to unrelated marketing.
Google sign-in data
When you choose Sign in with Google, KickStart requests your basic identity through the openid, email and profile permissions. Google provides an account identifier, email address, email verification status, display name and profile picture where available. We use these details to create or find your KickStart account, authenticate you and display your account identity. We do not request access to Gmail, Google Drive, Google Calendar, contacts or YouTube. Google passwords are entered only on Google’s own pages and are not collected by KickStart.
How Google data is stored and shared
The hosted app stores Google account identity, provider authentication records and KickStart sessions in its Cloudflare D1 database. Cloudflare processes these records to host and secure the service. Google processes the sign-in request under its own privacy policy. Basic Google identity is not included in the brand brief sent to OpenAI for artwork generation. We do not sell Google user data, use it for advertising or share it with suppliers, social networks or domain services. Access is restricted to the authenticated account and service administration needed to operate and secure the app.
Why information is used
Account information is used to sign you in, keep your workspace private, save your work, prevent abuse and support account recovery when email delivery is configured. We do not use this preview to serve advertising or sell personal information. The launch policy still needs the operator’s applicable legal bases for its supported regions.
Where your work is stored
The local preview stores account and workspace records in a local Cloudflare D1 simulation on the development computer. Landing-page reference files stay in IndexedDB in your browser. Onboarding answers also use session storage until setup completes. Reference files are not automatically uploaded to your account. The hosted version uses Cloudflare D1 for account records; the local development version uses a separate simulation. Email/password registration opens a private draft account. The email address remains unverified until verified through Google or an email link. Optional verification is off by default in Settings; paid access requires a verified address.
Analytics and error monitoring
PostHog receives page views and time on page (the page address without search terms, codes or record IDs, the referring website, campaign tags, and browser, device and screen type), plus account, setup and checkout events and a browser identifier stored locally. When you are signed in, these events are linked to your account’s random ID, never your name or email, so we can see how people move through setup and checkout across visits and devices. PostHog is set to discard IP addresses and does not look up your location. KickStart also records page counts, active time and conversion events using a random browser-tab identifier. Landing page and headline tests use signed assignments. Analytics are on by default; you can turn them off at any time on the Cookie preferences page, and we honor the Global Privacy Control signal. These first-party analytics records expire after 90 days; they contain no form text, designs, email addresses or raw IP addresses. We do not send your design content or account email as event properties. Sentry receives redacted browser error details to help us fix problems. Error messages, request data and user details are removed before sending; the Sentry project is configured to prevent storage of IP addresses for new events. Google Analytics receives the same cleaned page addresses, the referring website, campaign tags, browser and device type, and coarse click, reading and checkout events. Google signals and advertising features are off, and Google Analytics does not store IP addresses. In the European Economic Area, the United Kingdom and Switzerland it uses no analytics cookies unless you turn analytics on on the Cookie preferences page.
Providers and disclosure
The implementation uses Better Auth software, Cloudflare hosting and Google sign-in. When you create a design in the signed-in studio, your typed brand brief is sent to OpenAI to generate original artwork. The brief, generated artwork, chosen garment and placement are saved in your private account in Cloudflare D1. Browser reference files are not sent to OpenAI by this feature. No supplier, payment, domain or social publishing connection is active. Before activating a new data recipient, the production policy must identify the actual service, purpose and any relevant international transfers. We may need to disclose information if legally required; the scope depends on the applicable law.
Additional contact emails
Settings lets you save up to five additional contact email addresses and choose optional email verification, which is off by default. These addresses are stored privately with your account in Cloudflare D1. Adding an address does not verify it, make it a sign-in alias or grant recovery access. Verification and password-reset messages require a configured email sender and are not sent automatically by this setting.
Your controls
Settings lets you download your saved workspace and delete your account and its associated workspace, studio artwork and approvals. Browser reference files can be removed from the draft or through browser site-data settings. Deleting an account does not clear files stored separately in your browser. For access, correction and deletion requests, contact austinhfrankel@gmail.com.
Managing Google access
You can revoke KickStart access from the third-party connections section of your Google Account. Revoking Google access prevents future Google-authorized access but does not itself delete a saved KickStart workspace or end an existing KickStart session. Sign out to end the active session. To delete a Google-only account, sign in again with Google, open Settings, choose Delete account and leave the email-account password blank. A recent sign-in is required. For help or other deletion requests, contact austinhfrankel@gmail.com. Account identity and saved workspace data are retained until account deletion. Production backup and operational-log retention schedules remain to be finalized and are not promised to expire on a specific date.
Retention and security
Saved workspace data remains until you delete it. Authentication tokens have expiry times. Production backup retention, log retention and deletion schedules must be documented before launch. Access to workspace data is checked against the authenticated account. No system can promise absolute security.
Young founders
The intended product includes creative tools for younger founders. Minimum account age, parental consent and seller eligibility rules are not yet finalized. Public registration for children must not be enabled until those requirements and supported regions are established.
Changes and contact
Material changes to processing will require an updated policy and appropriate notice. Support and privacy contact: austinhfrankel@gmail.com. The legal operator name, postal address and supported launch regions still need to be finalized before commercial launch.