Privacy policy

Sidelong is a writing tool operated by Whatcha, Inc., a Delaware corporation ("Whatcha", "we", "us"). You save what you learn, write with it, and publish. That means we hold things that matter to you, so this page says plainly what we collect, what we do with it, and what we never do with it. It applies to sidelong.app, the Sidelong browser extension, and email addresses that Sidelong gives you.

The short version

• Your library, your writing, and your subscriber list are yours.
• We never sell your data or share it for advertising.
• Your content is not used to train AI models, by us or by our providers.
• Deleting your account deletes your content. All of it, promptly.
• Readers of your published work are not tracked or profiled by us.

Information we collect

Your account and profile. Your email address, and the profile you choose to fill in: display name, handle, bio, photo, and social links. Sign-in happens with one-time codes sent to your email, so we never hold a password for you.

Your library. The content you save: articles, videos, podcasts, book highlights, posts, and newsletters, whether they arrive through the extension, your personal Sidelong email address, an import, or a file you upload. Saving something tells Sidelong to fetch and store it for you, along with things derived from it to make it useful: transcripts of audio and video, summaries, key insights, and a search index. Your highlights and notes on that content are stored with it.

Your writing. Drafts, notes, projects, images you add or generate, and your conversations with Sidelong, including the per-project memory that makes those conversations useful over time.

Your audience. The email addresses of people who subscribe to your publication or that you import, when they joined and through what, and delivery events for the email you send them (delivered, opened, bounced, reported as spam). We use those events to show you how your writing is doing and to protect deliverability for every writer on Sidelong.

Connections you authorize. If you connect X or LinkedIn for direct posting, we store the tokens those platforms give us so we can post on your behalf when you ask. You can revoke a connection at any time, in Sidelong or on the platform itself.

Payment information. Paid plans are billed through Stripe. Your card details go straight to Stripe and never touch our servers; we keep only your plan, billing status, and Stripe's identifiers for your subscription.

Technical information. Sign-in cookies, the preferences you set (like your theme), and server logs recording requests to the service (IP address, browser type, timestamps). Logs exist for security and debugging and age out on a rolling basis. We run no advertising trackers. Traffic is measured with Vercel's cookieless analytics, which counts visits in aggregate without cookies, profiles, or cross-site tracking.

How we use information

We use what we collect to:

• run the product: store and process your library, generate summaries, insights, and transcripts, index your content for search, surface relevant passages while you write, and answer your questions from your own library;
• publish and deliver your work: host your public pages and send your newsletter to your subscribers;
• operate your account: sign you in, bill your plan, and send you service email (login codes, receipts, and notices about your account, which you can't opt out of while you have an account, plus occasional product updates, which you can);
• keep the platform healthy: prevent abuse, protect email deliverability for all writers, enforce our terms, and debug problems;
• comply with legal obligations.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we don't run ads.

AI processing

Making your library useful means processing your content with AI models and related services: summarizing, extracting insights, transcribing audio and video, indexing for search, and powering the drafting help you ask for. Your content is not used to train AI models. We send it to providers over their commercial APIs, under terms that do not permit them to train on it, and we don't train models on it either. Your private writing is never read by a human at Whatcha except with your permission when you ask for help.

Legal bases

Where the GDPR or similar laws apply, we process your data to perform our contract with you (running Sidelong is what you signed up for), for our legitimate interests (securing the service, preventing abuse, improving the product), to comply with legal obligations, and, where we ask for it, with your consent.

What becomes public when you publish

Publishing is the point, and it is always an explicit action. When you publish a piece, the piece itself, your byline (display name, handle, photo, bio), and your publication's name and page become publicly visible and may be indexed by search engines. Sources you cite get a public source page showing the material you quoted. Unpublishing or deleting removes the public page, though search engines and archives may hold copies for a time beyond our control. Everything else stays private.

Your subscribers and your readers

Your subscriber list belongs to you. Sidelong processes it on your behalf to deliver your newsletter, and for no purpose of our own: we never email your subscribers ourselves, and you can export the full list as a CSV at any time. For your subscriber list you are the data controller and Whatcha is your processor; for your own library and writing, Whatcha is the controller. If one of your subscribers asks us directly to exercise a privacy right over your list, we'll point them to you and help you honor it.

Every email we send for you carries a working unsubscribe link, and addresses that unsubscribe, bounce, or report spam stop receiving mail automatically.

Readers of public pages are counted, not tracked: view counts use a salted identifier that resets every day, so we can tell you how many people read your piece without building a profile of any of them. Public pages set no advertising or analytics cookies.

When we share information

Service providers. Sidelong runs on infrastructure and services from a small set of providers, each processing data only to provide their service to us and bound by contract to protect it:

• Supabase (database, authentication, file storage)
• Vercel (web hosting)
• Trigger.dev (background processing)
• Anthropic, OpenAI, and Google (AI models)
• AssemblyAI (audio and video transcription)
• Voyage AI (search indexing)
• Firecrawl (fetching web pages you save)
• Resend (sending and receiving email)
• Stripe (payments)

Platforms you connect. When you post to X or LinkedIn through Sidelong, the content you chose to post goes to that platform under its own terms.

Legal requests. We may disclose information if we believe in good faith that the law requires it, or to protect the rights, safety, or property of our users, the public, or Whatcha. Where we lawfully can, we'll tell you before your data is disclosed.

Business changes. If Whatcha is acquired or its assets are transferred, your data may transfer with the service, under this policy's protections; we'll notify you of any change in ownership.

Cookies

Sidelong uses cookies to keep you signed in and to remember your preferences. That's it: no advertising cookies, no third-party tracking cookies. Because we don't track you across other sites, there's nothing for a Do Not Track or Global Privacy Control signal to turn off, but we honor the spirit of both by default.

Where data is processed

Whatcha is a United States company and your data is processed in the United States, where privacy laws may differ from those where you live. If you use Sidelong from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as standard contractual clauses in our agreements with the providers listed above.

Retention and deletion

We keep your data for as long as your account exists, because the product is your accumulating library. When you delete your account, everything goes with it: your library, your writing, your published pages, your subscriber list, your uploaded files, your chat history, and the AI memory built from your projects. Deletion is immediate in the live system, and residual copies in encrypted backups age out within 30 days. A few things outlive an account by nature or by law: email already delivered to subscribers' inboxes is theirs and can't be recalled, and billing records are retained as tax and accounting law requires.

Security

Data is encrypted in transit and at rest, access is scoped so each account can only ever reach its own rows, and the keys that power integrations are held server-side, never in your browser. No system is perfectly secure, so if a breach ever affects your personal data we'll notify you and the relevant authorities as the law requires, without undue delay.

Your rights

You can do most of this yourself, today, in the app: read and correct your data, export your writing as Markdown or HTML, export your subscriber list as CSV, and delete your account in Settings.

Depending on where you live, you may also have legal rights to access, correct, delete, or receive a portable copy of your personal data, to restrict or object to our processing of it, and to withdraw consent where processing rests on consent. California residents have equivalent rights under the CCPA, along with the right not to be discriminated against for exercising them; we don't sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of. To exercise any right you can't handle in the app, email us at the address below; we'll verify the request and respond within the time the law allows. If you're in the EEA or UK, you can also lodge a complaint with your local supervisory authority.

Automated decisions

Sidelong makes no automated decisions about you with legal or similarly significant effects. The closest thing is our email abuse protection, which can automatically pause a publication's sending when its bounce or spam-report rates threaten other writers' deliverability; a human reviews any pause on request.

Children

Sidelong is not for children under 13 (or the higher minimum age where you live), and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll delete it.

Third-party links

Your library links back to the things you saved, and published pages can link anywhere. Those destinations have their own privacy practices, which this policy doesn't cover.

Changes

If this policy changes in a way that matters, we'll say so on this page and, for significant changes, by email before they take effect.

Contact

Whatcha, Inc. operates Sidelong. Questions about privacy: support@sidelong.app.