Privacy policy | Hodorak

1 Who we are

Hodorak follows the communities and keyword searches a business chooses on Facebook, Reddit, LinkedIn and X, and shows it the posts from people looking for a product or service like the one it offers.

This policy explains how we handle data on this site and in the Hodorak app at app.hodorak.com. For any privacy question, email support@hodorak.com.

2 Visitors to this site

You don't need to give us any data to browse this site. When you visit:

The site runs through Cloudflare, which protects and delivers it, so Cloudflare receives the usual connection data, such as your IP address and browser type.
Article images may load from the Sanity content delivery network, which receives the usual technical request data, such as your IP address, when an image is requested.
If you pick a language with the language switch, we keep your choice in one cookie on this site only, so the home page opens in that language next time.
We count visits with Cloudflare Web Analytics, which uses no cookies and does not identify visitors.
We keep our own cookie, hdk_attr, with the page you arrived on and the link or ad that brought you, so we can tell which of our ads bring people who sign up (section 7). Only our site and app read it.
We measure how the site is used with PostHog, which can also record your visit (what you click and scroll; anything you type in a field is hidden), and with Google Analytics.
On the platforms where we advertise (for example Meta), their pixel tells the platform about your visit and a click on our sign-up button, so it can measure our ads.
Visitors in the European Union, the European Economic Area, the United Kingdom and Switzerland first see a cookie banner. Until you choose Accept, PostHog runs with no cookie and no stored identifier, and Google Analytics and the advertising pixels don't load at all. You can change your choice at any time from "Cookie settings" in the footer. Elsewhere these tools run when you visit.
If you send us a message from the Contact page or by email, we keep your email address, message, subject, and any name you choose to include so we can respond and handle your request. The Contact page form sends your message to our support mailbox through our server and our email provider, Resend.

3 What we collect in the app

Your account

Your email address, your password stored in a form that cannot be reversed, your name if you add it, and your interface language. Each time you sign in we store the IP address and browser type to protect your account. We also record when you sign in, open the leads page, move a lead or join a team, to understand how the service is used and to support you.

When you create your account we keep where you came from (the first and the last page, link or ad that brought you, from the hdk_attr cookie), your cookie choice, your country, and the IP address and browser type of the sign-up. In the app we measure the pages you open and the steps you take with PostHog, which knows you by your account number, never your email or name. PostHog can record your session in the app with every text and every field hidden and images blocked.

Your business

What you write about your business: its name, summary, what you sell, the problems you solve, competitors, what you never want to see, and your reply settings, including the contact method you want replies to mention. If you give us your website, we read its public text and keep it to build your business profile and refresh it later, including any phone number, email or address published on it. From your Facebook or Instagram pages we keep the name, category, description and website link, not the page's phone, email or address fields.

Your sources and leads

The groups, communities and keyword searches you add, the leads we show you, and what you do with them: moving them between stages, your feedback and your reasons for rejecting a lead, notes, suggested replies, and author details when you ask for them.

Your team

If you invite someone to your business, we keep their email and role with the invitation. An invitation never accepted is deleted 30 days after it is cancelled or expires; an accepted one stays as the record of who invited whom (section 8). Team members see each other's names, who is on each lead, notes, what happened on a lead, and who has it open right now; the owner and managers also see members' and invitees' email addresses.

If you link Telegram, we store the chat ID, your user ID, name and username there, and send you service messages, such as the link confirmation, plan notices and a lead assigned to you with a short line about it. Messages delivered to Telegram stay with Telegram under its own terms.

Email

We send service email only: email confirmation, password reset, email change and team invitations. We don't send marketing email.

We don't store card details.

4 If your post appears in Hodorak

Hodorak reads posts that are publicly available in the sources businesses choose. From a post we keep its text, link and time, its comment and reaction counts, its media links, the author's display name, profile link and picture as everyone can see them, and the platform's own record of the post (deleted after 30 days unless the post became a lead). We keep the first image of a post only to analyze it. It is usually deleted within a day; if its analysis is still waiting, it is deleted shortly after it is analyzed.

If a business asks to know more about the author, we fetch the public profile details on that platform, such as title, city and company, keep what the platform returns, and write a two-line summary with AI. We don't show the business any email or phone number, and we don't use them.

We use this only to find requests and show them to the businesses that follow the source, and to check and improve how well we do that (section 5). The business decides whether to reply on the platform itself. We don't sell this data, and we never message the author.

The example posts on this site's home page are written for illustration. Any example we take from a real public post has names, pictures, links and anything that points to the author removed, and is lightly reworded.

To ask us to remove your post or your data from Hodorak, email support@hodorak.com with the link to the post.

5 How we use data

To run the service: we follow your sources, judge each post against your business, and show you leads.
To improve results for your business: your feedback and rejection reasons become examples Hodorak uses when judging posts for your business only.
To improve the service for everyone: our team reviews samples of AI decisions, including post text, to improve the shared instructions the AI works with.
To run the service and support you: our team can view accounts, businesses, sources and leads when needed.
To secure accounts, prevent abuse and send service messages.
To measure our own marketing: we count which pages, links and ads bring the people who sign up and choose a plan, and we tell the platforms where we advertise when a visit from their ad led to a sign-up or a paid plan (section 6).

We don't sell your data, we don't show you ads, and we don't train AI models on it. Advertising platforms get only what section 6 describes, to measure our own ads. To stop the sharing of your data with advertising platforms, email support@hodorak.com.

6 Who helps us process data

We work with companies that help us run Hodorak, and send each one only what its task needs:

Cloudflare: protecting and delivering the site and the app, visit counts, and passing the messages you send to our email addresses on to our mailbox.
Sanity: hosting published editorial content, public author profiles and article images, and delivering images. Sanity privacy policy.
A cloud hosting provider: our servers and database.
OpenRouter and the AI model providers it connects us to: we send them what each request needs, such as post text and images, your business profile and website text, your feedback examples, your reply settings and any guidance you type for a reply, and the author's name and the details you ask for, so they can return a result. They process it under their own terms.
ScrapeCreators, HarvestAPI and SocialFetch: fetching public posts and public profile details from the platforms.
Jina AI: reading websites that can't be read directly.
Resend: sending email.
Google (Gmail): our support mailbox, which holds the messages you send us.
Telegram: service messages, if you link it.
PostHog: measuring how the site and the app are used, and recording sessions (on the site, anything typed in a field is hidden; in the app, every text and field is hidden and images are blocked). Its data is stored in the European Union. It knows account holders by their account number, never their email or name.
Google (Google Analytics): counting visits to the site, and the sign-ups and plans that came from them, by account number, never email or name.
The advertising platforms we advertise on (for example Meta): when a visit from one of their ads led to a sign-up or a paid plan, we send them a hashed email (scrambled so it can't be read back), a hashed account number, the visit identifiers their ad and cookie set, and the IP address and browser type of the sign-up, so they can match it to the ad. For a paid plan we add the plan and the amount. We never send them your name or anything about your business, and nothing for team members who joined by invitation or for visitors who chose "Necessary only".

These companies may process data in countries other than yours. We don't disclose your data to anyone else unless the law requires it.

7 Cookies and storage

Cookies are small files your browser keeps. We use necessary cookies, the cookie for the language you choose, our own cookie that records where you came from, and, where allowed, the cookies of our measurement and advertising tools.

In the app: the sign-in cookie (15 minutes, renewed by a second cookie that lasts 90 days) and the interface-language cookie (until you close the browser).
The app's sign-in cookies are set for hodorak.com and its subdomains, so your browser also sends them to this site, which does not read them.
On this site: the cookie for the language you picked (one year).
On this site and in the app, set for hodorak.com and its subdomains: hdk_attr (90 days), the first and the last page, link or ad that brought you, written on every visit and read only by us; and hdk_consent, your answer on the cookie banner (6 months after you choose; one hour where no banner is shown).
Measurement and advertising cookies, only once allowed (after Accept, where the banner is shown): PostHog's cookie, Google Analytics' cookies, and the cookies of the advertising platforms we use, such as Meta's. Each tool sets how long its cookie lasts.
The app keeps a few preferences in your browser, such as hints you closed and the filter you chose.

8 How long we keep data

Your account, your business, its leads and the author details linked to them: as long as the account exists.
Posts that did not become leads: deleted 90 days after they were last seen, unless kept as an example for your business's AI or in our review samples.
We keep vectors of public posts (numbers computed from a post's text, used to compare posts with each other) on our server for up to 90 days (longer only for a post kept as an example for a business's AI), and in our encrypted monthly backups, without the post's text or its author.
The content of AI requests: deleted after 30 days, except for those behind an existing lead.
Sign-in sessions: deleted 30 days after they end.
Email and Telegram messages we sent: deleted after 90 days.
Your usage record (section 3): one year.
The record of websites we read: one year.
Where you came from and your cookie choice at sign-up: as long as the account exists; the sign-up IP address and browser type are removed after 90 days.
Our record of each measurement and advertising delivery: 90 days. The measurement events themselves (such as sign-up and plan started): as long as the account exists. What PostHog, Google Analytics and the advertising platforms hold: under their own retention; Google Analytics keeps it 14 months.
Sign-ups whose email was never confirmed: deleted after 7 days.
Technical server logs, including IP addresses: overwritten automatically once they reach a set size.
Emails you send us: kept in the support mailbox; deleted on request.
Post authors' names, pictures, profile links and the platform's record of them, and the email of anyone who accepted a team invitation: not deleted automatically for now; deleted on request.

9 Your choices

Edit your data: in Account settings and the business profile.
Delete your account: in Account settings, at any time. This permanently deletes your account and every business you own with its data. Sources and public posts shared between businesses remain; notes and actions you made in businesses you joined stay without your name; your email stays in an invitation you accepted; other records are deleted on the schedule in section 8.
Unlink Telegram: on the Notifications page.
Cookies: in Europe and the UK, change your choice at any time from "Cookie settings" in this site's footer. Anywhere, you can clear or block cookies in your browser.
Advertising platforms: to stop the sharing of your data with advertising platforms, email support@hodorak.com.
For any other request, such as a copy of your data or a correction, email support@hodorak.com.

10 Security

Passwords are stored in a form that cannot be reversed, sign-in cookies can't be read by scripts on the page, every connection is encrypted, and the database is not exposed to the internet. Our team uses the admin with defined roles, view-only staff see customer emails masked, and every change our team makes in the admin is logged. Nothing online is perfectly secure, but we protect your data with safeguards suited to it.

11 Age

Hodorak is a service for businesses and professionals, not for anyone under 18.

12 Changes to this policy

If we change this policy, we update the "Last updated" date at the top, and for an important change we tell account holders by email or in the app before it takes effect.