Privacy Policy

1. The short version

Hookzo collects the minimum needed to run your account and generate scripts. The posts you capture from Instagram and TikTok are processed to create scripts — we don't build a profile of you or sell your data. This policy explains the details.

2. What we collect

• Account info: your email address and, if you use Google sign-in, the basic profile (name, email) Google returns.
• Usage & quota: how many generations you've used, your plan, and timestamps — so we can enforce limits and show your dashboard.
• Anti-abuse signals: a random per-install device ID and a hashed (non-reversible) version of your IP address, used only to prevent multi-account abuse of the free tier.
• Generation inputs: the post captions/metrics you send when you click "Generate" — and, for posts without a caption, the post's cover image — which are passed to our AI provider to produce scripts (the cover image is used only to read its on-screen text). These are processed to generate your scripts and are not stored after.
• Your generations (the output): if you're signed in, the scripts, swiped hooks and carousels we generate for you are saved to your account so you can find them again on your account page instead of losing them when you close the panel. We store the generated text itself, the public @username it was generated from, and the settings used (style, length, language). We do not store the captured post captions or cover images that went in — only what came out. You can delete any saved generation from your account page at any time. Generations made while signed out are never saved, because there's no account to attach them to.
• Transcription (Pro): if you use the transcript feature on a video that has no caption track, the video's media URL is sent to our transcription provider (Deepgram) to produce a text transcript. Caption-track transcripts are read entirely in your browser and never leave your device.
• Payment info: handled entirely by Polar. We receive your plan status and a subscription ID — never your full card details.
• Support messages: if you use the contact form on our site, the email address and message you submit (delivered to our inbox via Resend) so we can reply.

3. What we do NOT collect

We do not collect your general browsing history, the sites you visit outside Instagram and TikTok, your social account credentials, or your private messages. We don't build an advertising profile of you, and we never sell your data. On Instagram and TikTok, Hookzo reads the public posts and engagement numbers already visible on the page — only to rank them for you.

4. What stays in your browser

Captured posts are ranked and displayed locally inside the extension, and they stay there — we never store the posts you capture. Your voice profile, style settings, and a per-install device ID live in your browser's local storage. We only receive data when you explicitly trigger an action (like "Generate") that needs our servers. The one thing that does leave your browser and stay with us is the output we generate for you, saved to your account so you can find it again (section 2).

5. Chrome extension permissions

Hookzo requests the minimum permissions needed to work, and uses each only for its stated purpose:

• Storage — saves your settings, voice profile, and sign-in session locally in your browser.
• Access to instagram.com & tiktok.com — lets the extension read the public posts and engagement metrics shown on the page so it can rank them. This reading happens inside your browser. Hookzo does not modify these pages and never automates your account (no liking, following, posting, or messaging).
• Access to hookzo.app — lets the extension sync your sign-in status from your account.

Hookzo does not read or run on any other websites, and does not track your activity elsewhere.

6. How we use it

To authenticate you, run and enforce your plan, generate scripts, prevent abuse, process payments, respond to support, and improve the Service. We do not sell your personal data or use it for third-party advertising.

7. Third parties we rely on

• Supabase — authentication and database (your account, plan, usage, and your saved generations), and storage of the anonymous website events described in section 8.
• Anthropic — AI processing of your generation inputs (post captions/metrics, and cover images for posts without captions, to read their on-screen text) to produce scripts.
• Deepgram — AI transcription of videos that have no caption track (a Pro feature); receives the video's media URL to produce a text transcript. Not used for caption-track transcripts, which are read in your browser.
• Polar — payments, billing, and tax as merchant of record.
• Cloudflare — bot protection (Turnstile) at sign-in and email routing for hi@hookzo.app.
• Resend — delivery of transactional emails (sign-in links) and contact-form messages.
• Vercel — hosting of the website, and privacy-friendly, cookieless traffic analytics for it (aggregate page views and referrers; no cookies, no cross-site tracking, no advertising profiles).

Each processes data under its own terms and only as needed to provide its part of the Service. Google sign-in is used only to authenticate you (we receive your name and email) — Hookzo requests no other Google access.

International transfers: these providers process data in the United States and other countries. If you're in the EEA, UK, or Switzerland, your personal data may be transferred outside your country; where required, such transfers rely on appropriate safeguards (e.g., Standard Contractual Clauses).

8. Cookies & local storage

We use local storage and essential cookies to keep you signed in and remember your settings.

On the website we measure traffic with Vercel Web Analytics: aggregate page views and referrers, so we can tell how people find Hookzo and where they get stuck. It sets no cookies, does not follow you across other sites, and never builds an advertising profile — which is why there is no consent banner to click. We do not use Google Analytics, advertising cookies, or behavioral tracking scripts.

We also record three anonymous events of our own, stored in our Supabase database: which "Add to Chrome" button was clicked, the campaign tag (utm_*) of a visit that arrived from a link we shared, and the fact that a signed-out generation happened (only its type, platform and language — never the scripts, the captions, or the profile it came from). These rows contain no identifier of any kind — no name, no email, no cookie, and no IP address, not even a hashed one. They cannot be linked to you or to each other, and they are deleted after 12 months.

The extension sends one anonymous signal, at most once a day: that a Hookzo panel was opened, on which platform (Instagram or TikTok), and which version of the extension you have. That is the whole message. It carries no account, no identifier, and no IP address — not even a hashed one — and it is stored in the same anonymous table as the events above, deleted after 12 months. It exists so we can tell whether people who install Hookzo actually get it working. Nothing about which profiles you visit or which posts you capture is ever reported to us.

9. Data retention

We keep account and usage data while your account is active. The post data you send when you click "Generate" is passed to our AI provider to create your scripts and is not stored afterwards — we never keep the captions, metrics or cover images you captured. The scripts we generate for you are saved to your account (see section 2) so they're still there when you come back; we keep them for 12 months, and you can delete any of them yourself at any time from your account page. When you delete your account, your saved generations are deleted with it, along with your other personal data — except where we must keep records (e.g., payment/tax records held by Polar).

10. Your rights

You can access, correct, export, or delete your personal data. Email hi@hookzo.app and we'll action your request. Depending on where you live (e.g., EEA/UK/California), you may have additional rights under GDPR or CCPA, including the right to object or complain to a regulator.

11. Security

We use reputable providers and standard safeguards (encryption in transit, access controls, hashed identifiers). No system is perfectly secure, but we work to protect your data and limit what we collect.

12. Children

Hookzo is not intended for anyone under 18, and we don't knowingly collect data from children.

13. Data controller

The data controller responsible for your personal data is Hookzo, a Data Runner product. For privacy matters, contact hi@hookzo.app.

14. Changes

We may update this policy. Material changes will be reflected in the date above and, where appropriate, communicated to you.

15. Contact

Privacy questions or requests: hi@hookzo.app.