The Social Hack: Privacy Policy
Version: 2026-11-01 v1 · Effective: November 1, 2026 (v1)
Short version: we collect as little as we can. We don't sell your data, we measure our ads with Meta only if you accept, and AI-JAY doesn't keep your chats. Here's the full picture.
1. Who's responsible
JAY GEE, operating as The Social Hack. Privacy contact: the contact form at https://thesocialhack.co/contact, with "Privacy" as the topic. Person responsible for privacy: Privacy Officer.
2. What we collect, and why
| What | When | Why | Legal basis (EU/UK) |
|---|---|---|---|
| Email address | Kit sign-in, purchase, claim, contact form, letters | To sign you in, deliver what you bought, answer you | Contract; legitimate interests (support) |
| Payment details | Checkout | Taken and stored by Stripe. We never see your full card number. We keep Stripe ids, amounts and a card-fingerprint hash for fraud checks. | Contract; legal obligation (tax records); legitimate interests (fraud) |
| Shipping name and address | Paperback checkout | Read from Stripe and passed to Lulu to print and ship. We don't store your street address ourselves. | Contract |
| Order and claim details | Purchases and /claim | To deliver, verify claims (a person reviews each one) and stop duplicate claims | Contract; legitimate interests (fraud prevention) |
| What you type to AI-JAY+ | When you ask AI-JAY+ a question | Sent to xAI to generate the answer. We don't store, log or read your questions or answers. | Contract; explicit consent where your message reveals health or other sensitive data |
| AI-JAY Basic questions | Basic | Answered on your device. They don't leave your device. | n/a |
| Memory summary (optional, off by default) | Only if you turn memory on | Your device keeps an encrypted log for 90 days. With each AI-JAY+ question it sends a structured summary: counts, streak, top rung ids, and the last entry's date, rung and status. Never your note text. We don't store it. xAI receives it with the question. | Consent (withdraw any time by turning memory off) |
| Anonymized drill logs (optional) | Only if you tick "I allow anonymized drill logs" | To improve the Kit | Consent |
| Usage counts and cost | Automatically | Daily totals (questions, tokens, cost), keyed by a one-way code, not your name or email. Used for limits and budgeting. | Legitimate interests (running and paying for the service) |
| Subscription consent record | Subscription checkout | Proof of what you agreed to: time, plan, language. Required by auto-renewal laws. | Legal obligation; legitimate interests |
| Refund and defect requests | When you ask | To decide them. A person reviews each one. | Contract; legal obligation |
| Gift recipient email and note | If a gift buyer adds them | To send the gift | Legitimate interests (of the buyer and recipient) |
| Letters (newsletter) | Only if you sign up | To send the letters via Beehiiv | Consent (separate tick box) |
| Ad measurement (Meta Pixel and Conversions API) | Only if you accept | To measure our ads | Your consent |
| Technical data (IP address, browser) | Every visit | Security, abuse limits and bot checks (Cloudflare Turnstile). IP addresses are never stored in our database. Short-lived counters use a hash. | Legitimate interests (security) |
We use the Meta Pixel and Conversions API to measure our ads, only if you accept. We never sell your data or let anyone train AI on your messages.
3. Who processes data for us
| Provider | What they do | Data | Retention at the provider |
|---|---|---|---|
| Cloudflare | Hosting, CDN, Workers, KV storage, Turnstile bot check | All site and Kit traffic, short-lived counters | — |
| Supabase | Database (accounts, entitlements, claims, refunds, audit log) | Email, account ids, purchase ids, hashes | Ours (see §5) |
| Stripe | Payments, subscriptions, billing portal, receipts | Name, email, card, billing and shipping address | Stripe's own retention. Stripe is also an independent controller for payment and fraud data. |
| Resend | Transactional email (receipts, sign-in links, reminders) | Email, message content | — |
| xAI | Generates AI-JAY+ answers | Your question, the optional memory summary, conversation context | Up to 30 days for abuse and security checks, then deleted. Not used for training. |
| Lulu | Prints and ships the paperback | Name, shipping address, email/phone for the courier | Lulu's own retention |
| Beehiiv | Sends the letters | Email, sign-up date, gift-code field, ad source (only if you accept) | Until you unsubscribe |
| Amazon | Sells the Kindle edition and the Amazon paperback | We get no buyer data | Amazon is an independent controller |
| Meta (Meta Platforms) | Measures our ad results (Meta Pixel and Conversions API), only with your consent where the law requires it | Pages viewed, sign-up and purchase events, hashed email, IP address, browser, ad-click ids (fbclid, _fbc/_fbp cookies) | Meta's own retention. Meta is a joint controller with us for collecting and sending this data, and an independent controller for its own ad use. |
4. International transfers
Your data may be processed outside your country by the providers listed in §3. Transfers from the EU/UK are protected by standard contractual clauses (with the UK Addendum) or adequacy decisions, as applicable to each provider.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account (email, entitlements) | While your account is active, then 24 months before deletion |
| AI-JAY+ questions and answers | Not stored by us. xAI: up to 30 days |
| Memory log | Your device only, encrypted, 90 days per entry. Deleted at once when you turn memory off, delete it or log out. |
| Usage telemetry | Daily totals, 70 days |
| Budget guard counters | 40 days |
| AI-JAY+ answer counter | 400 days |
| Purchases and invoices | 7 years |
| Subscription consent records | The longer of 3 years and 1 year after the subscription ends |
| Refund requests | 7 years |
| Claims | Raw details deleted 90 days after the decision. One-way hashes of the order number and email are kept to stop duplicate claims. |
| Gift recipient email and note | Deleted 30 days after the gift email is sent |
| Gift-notice opt-outs | A one-way hash, kept so we never email you again |
| Welcome gift records | Hashes only |
| Webhook de-duplication | 7 days |
| Promotion drop counters | 30 days after the drop ends |
| Sign-in replay window | 120 seconds |
| Copies at Stripe, Lulu, Resend, Beehiiv | Their own retention |
6. On your device
| Name | Type | What it does |
|---|---|---|
tsh_lang | Cookie (.thesocialhack.co) | Remembers your language |
shk | localStorage | Keeps you signed in to the Kit |
tsh_bid | localStorage | A random browser id, used only during sign-in |
aijay_memory_v1 | IndexedDB | Your optional encrypted memory log |
tsh_consent | localStorage | Your cookie choice |
_fbp | Cookie | Meta ad measurement, only if you accept |
_fbc | Cookie | The Meta ad you came from, only if you accept |
tsh_attr | localStorage | The ad or link you came from, only if you accept |
CF_Authorization | Cookie | Admin area only. Visitors never get it. |
All of these are strictly necessary or set at your request, except the Meta items, which we set only if you accept. You can change your choice any time in Cookie settings.
7. Your rights
Wherever you live, you can ask us to access, correct, delete or export your data, or to withdraw consent. Depending on where you live (EU/UK, Canada, California and others), you may also be able to object to or restrict processing. Use the contact form, with "Privacy" as the topic. We reply within 30 days. We may ask you to confirm the request from your account email.
You can complain to your data protection authority: in Canada, the Office of the Privacy Commissioner of Canada (or your provincial commissioner); in the UK, the ICO; in the EU, your local supervisory authority.
8. Letters (email)
We email you letters only if you sign up separately. Every letter shows who we are, our mailing address, and a one-click unsubscribe. We process unsubscribes within 10 business days (usually instantly). Service emails (receipts, sign-in links, renewal reminders) aren't marketing. You get them while you have an account.
9. Children
TSH is for adults (18+). We don't knowingly collect data from anyone under 18. If we learn we have, we delete it.
10. Security
Encryption in transit; hashed identifiers wherever we can; device-side encryption for memory; least-privilege admin access behind Cloudflare Access. If a breach is likely to harm you, we'll tell you and the regulators as the law requires.
11. Changes
We'll post any change here with a new date. For material changes, we'll email account holders before they take effect.