Privacy Policy

Punchy is an independent product run by a solo founder. Punchy turns a product URL into short form posts you can put on TikTok, Reels and Shorts.

For data protection purposes, we are the data controller for the information described here. You can reach us through the contact form on this site.

We collect four kinds of information.

Your account

• Your name and email address.
• Your profile picture and Google account ID, if you sign in with Google.
• Which plan you are on.

What you put into Punchy

• The URL of the product you want posts for.
• Your brand profile. That means the name, tagline, description, audience, and the dos and donts we read from your site or you write yourself.
• Files you upload, such as images, video and audio.
• The posts Punchy writes for you, and any edits you make to them.

Payment information

If you subscribe, Stripe handles the payment. Stripe holds your card details, not us. We keep your Stripe customer ID, your card type, the last four digits, and your subscription status.

Technical information

• Your IP address and browser user agent, stored with your session.
• Basic logs of errors and activity, which we use to keep the service working.
• How you use Punchy, such as the pages you visit, what you click, and the posts you approve, reject and download. This is linked to your account.

• To run your account and sign you in.
• To scrape your site and write posts that sound like your brand.
• To store the files and posts in your library.
• To take payment and manage your subscription.
• To apply plan limits, such as daily posts and storage.
• To send you service email, such as sign in links and billing notices.
• To find and fix problems with the service.
• To understand how Punchy is used, so we can make it better.

If you are in the UK or the EU, our legal bases are performance of a contract for running the service, legitimate interests for keeping it secure and working and for understanding how it is used, and consent where we ask for it.

Punchy sends parts of your content to AI providers so it can write your posts. That includes the text we read from your site, your brand profile, and the text of posts you ask us to rewrite.

We use Anthropic and OpenAI for this. They act as our sub-processors. They process your content to return a result to us. Your content is not used to train their models.

AI output can be wrong. Check anything Punchy writes before you post it. You are responsible for what you publish.

We do not sell your data. We share it only with the services that make Punchy run.

• Anthropic and OpenAI, to write your copy and to catalogue library assets.
• Stripe, to take payment and manage subscriptions.
• Google, if you choose to sign in with Google.
• PostHog, which measures how Punchy is used and records errors in the app.
• Our hosting and email providers, which store data and deliver our email.
• Unsplash and Pexels, which supply stock media. We send them search terms, not your content.

We may also share information if the law requires it, or to protect the service and its users from harm or abuse.

Every post has a share link. Anyone who has that link can see the post without signing in. The link is the only thing protecting it, so treat it as private until you are happy for people to have it.

Once you post something to TikTok, Instagram or YouTube, that platform's own rules apply. This policy stops at Punchy.

• Your account data stays until you ask us to delete it.
• Your uploads and approved posts stay until you delete them or close your account.
• Drafts you never approve are cleared out automatically after a while, so your deck stays clean.
• Billing records are kept as long as tax and accounting law requires.
• Logs are kept for a short period and then removed.

You can ask us to do any of the following.

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your account and the data with it.
• Give you a copy of your data in a portable format.
• Stop or limit how we use it.

Use the contact form and we will get back to you. We aim to answer within 30 days. If you are in the UK or the EU and you are not happy with our answer, you can complain to your local data protection authority.

If you are in California, you have the right to know what we collect, to delete it, and to not be discriminated against for asking. We do not sell personal information.

We use encrypted connections, hashed credentials and access controls to protect your data. No service can promise perfect security. Use a strong password on the account you sign in with, and tell us if you think something is wrong.

We use cookies to keep you signed in and to protect forms against cross site request forgery. These are needed for the site to work. If you block them, you will not be able to sign in.

We also use PostHog cookies to measure how Punchy is used and to recognise you between visits. Blocking them does not stop the site from working.

Punchy is not for children. You must be at least 16 to use it. If you believe a child has given us their data, contact us and we will remove it.

Our providers may process data outside your country, including in the United States. Where that happens, we rely on the safeguards those providers have in place, such as standard contractual clauses.

We may update this page as Punchy changes. The date at the top tells you when we last did. If a change matters to you, we will tell you by email or in the app.