Privacy

If you only read the site

The public reading surfaces (the directory, weekly digests, deep dives, events) do not require a sign-in and do not collect a name or email from anonymous visitors. Server logs record the IP address of incoming requests for rate-limiting and abuse-prevention. When the platform sends an analytics event tied to an anonymous request, the IP is hashed with a server-side salt before it leaves the request boundary; the raw IP never reaches a third party.

If you use natural-language directory search, the platform keeps the text you entered, the parsed filters, and result metadata in its first-party database for up to 90 days so failed searches can be used to improve the directory. Anonymous search rows are not linked to an IP address or account. After 90 days, the raw text and parsed filters, one-way query hash, and any account link are removed. De-identified result counts and performance metadata remain.

Resume import during profile setup

In profile setup or Edit profile, choosing “Read my résumé” sends your PDF or pasted text to Anthropic to suggest professional profile fields, companies, and roles. Triangle Startups processes this upload temporarily and does not write the original PDF or pasted text to its database or file storage. This flow does not create a saved resume read or a shareable result link.

Only the editable profile fields and follows you confirm with “Save my profile” are saved to your account. These are personal information. You can change or clear them in Edit profile; the account deletion process below also applies. Temporary suggestions disappear when you leave the page. The upload is not sent to employers and does not apply for a job.

Anthropic processes the upload under its own commercial data retention policy. Triangle Startups does not promise immediate deletion from Anthropic. Manual profile setup is available without sending a resume.

If you submit a resume for a saved read

The separate reader at /resume accepts a PDF or pasted resume text from a signed-in account. Triangle Startups sends that source document to Anthropic to extract a structured profile and generate a read against the Triangle company and job roster. The platform stores the source document, structured profile, generated read, company and role matches, the account that ran it, a hashed IP address, and the request's user-agent string. A contact email and note are stored only if you choose to ask for follow-up; feedback is optional.

The resume and generated read are not posted publicly. They go to a company only when you choose to include them: in an introduction request (next section), or with an application to a role on Triangle Startups, which shares what the resume states and never the read's feedback or matches (below). Your reads are listed in your account, and each is also at an unguessable bearer link: anyone you give that exact link to can open it, so do not share it unless you intend to share the read. The founder can see reads in order to service requests and deletions. Analytics and error tools receive only the masked path /resume/[token], never the link's actual token.

The resume you submit is kept for 90 days so reads can be revisited, compared, and re-run as the product improves, then it is deleted automatically. The generated result is kept after that, because it is what your saved link renders.

You do not have to wait for either. The saved read and your account's resume page both carry a delete control that removes the resume, the result, the matches, and any contact details or feedback you left, immediately and without going through anyone. Deleting your account deletes its reads. If you no longer have the link or the account, email adam@triangle-startups.com and the same records are removed within seven days. An email address is only on file when you asked for an introduction, so the link is usually the fastest way to find your record.

If you ask to be introduced to a team

Company pages, role pages, /jobs, and resume reads carry a request form for when the role you want is not listed. A request stores the company you named (if any), the role page it started from (if any), what you are looking for, your name, your account email, and the optional note and link you add. If you tick the box to include your resume, it also records which of your reads to share.

Nothing is sent to a company automatically. The founder reads each request and passes it to the team himself: your name, email, the role you named, and whatever you chose to include. Your account shows each request's status. Requests are kept while your account exists and are deleted with it; email adam@triangle-startups.com to remove one sooner. Information already passed to a company is then held by that company under its own policies.

If you apply to a role on Triangle Startups

Roles marked Paid role take applications here rather than on the company's own site. An application stores your name, your account email, an optional link, your answers to the role's questions (at most three), its status, and the date the company committed to reply by.

It is visible to the hiring reviewers Triangle Startups assigned to that one role, each a verified account, and to nobody at any other company. If you withdraw it, it disappears from the company's view. Status changes the company makes show on your Applications page. The company can read and update it until 90 days after the role's paid period ends; after that it can no longer see it at all, unless the company re-opens the role for a new period.

If you tick the box to include your resume, the application also carries what your resume states: name, headline, location, years of experience, employers, schools and skills. The company can download the original file while it is still stored, which is 90 days from upload. It does not carry the feedback Triangle Startups wrote to you, how the site classified your sectors, or the other companies it matched you with. Sharing is per application, so including it with one company shares it with no other, and you can stop sharing it from your Applications page at any time. Downloading the file counts as opening the application.

When a reviewer opens your application, the first and most recent date it was opened are recorded. Your Applications page shows when the company first opened it. It does not show which person did, and the company cannot see this record at all.

Your own copy of an application, and its open dates, stay on your Applications page while your account exists and are deleted with it. The end of the company's access does not delete anything you can see. Anything a company already read is held by that company under its own policies.

If you sign up

The signup form at /signup collects your name, email, role (founder, operator, investor, student, other), optionally your company name, and how you heard about Triangle Startups. The platform stores those values in its membership roster. A completed signup currently grants access immediately unless access has been explicitly blocked by the founder; that blocked status prevents sign-in. The email is used for Supabase sign-in. The landing URL and user-agent string of the request are stored alongside the row for context. The IP address is stored as a hash, not raw.

If you sign in

Triangle Startups uses Supabase Auth for sign-in. Three methods are supported: email-and-password, one-time email codes, and social sign-in (Google, LinkedIn, GitHub when enabled). For email-and-password, the platform stores your email address and a salted hash of your password (Supabase handles the hashing; the platform never sees the plain password). For social sign-in, the provider returns your email, your full name, and a profile picture URL; the platform stores those in your authentication record. Optional onboarding can also store the profile details you choose to provide: role, job title, company, website, LinkedIn URL, school and graduation year, current goals, focus regions, sectors and stages, watchlist, digest preference, and free-form context. If you use the agent-import path, the prompt, response, named tool, and normalized imported profile are stored so you can review and edit what was imported.

Once signed in, the features available to you (a watchlist of companies, private notes against company profiles, weekly-digest preferences) save additional structured data tied to your account. That data is visible only to you and the founder.

Signed-in natural-language searches are linked to your opaque account ID for the same 90-day raw-text window. This helps the founder distinguish repeated unmet demand from one-off searches.

Who else sees the data

• Supabase hosts the database and authentication layer. Your account record, signup row, watchlist, notes, and submitted resume records live in Supabase Postgres.
• Vercel hosts the application code and processes requests, including form and search content you send to the platform. Its request logs can include the URL, response code, and latency. Persistent user records live in Supabase rather than Vercel.
• PostHog receives product-analytics events (page views, button clicks, search submissions, sign-in attempts). Anonymous events use a hashed IP as the identifier; signed-in events use an opaque account ID or a one-way email hash. Search events include query length and result metadata, not the text you entered. The browser sends these through a same-origin reverse proxy to reduce ad-blocking. Query strings are stripped from analytics URLs, session recording and PostHog exception capture are disabled, and PostHog never receives raw IPs or raw email addresses.
• Sentry receives error and performance telemetry so failures can be diagnosed. Default collection of personally identifying data is disabled. Sentry may receive a route URL without its query string, error type, stack trace, browser or runtime metadata, and timing information.
• Anthropic receives a submitted resume or its pasted text to generate the resume read. It also receives the text of a signed-in natural-language search only when the deterministic parser cannot handle it and the AI fallback is enabled. If the company-question feature is enabled in the future, Anthropic will receive the question and the bounded company context needed to answer it. Anonymous directory searches do not use the AI fallback.
• Google / LinkedIn / GitHub see only the fact that you initiated an OAuth sign-in. They do not receive a list of who else uses Triangle Startups.
• Email providers (Supabase's authentication mail service and Resend) handle the actual delivery of sign-in, newsletter, and notification emails. They see the recipient address and the email body.

The platform does not sell, license, or otherwise share user data with third parties beyond the infrastructure vendors named above.

Cookies and similar

The site uses Supabase session cookies to keep you signed in. PostHog sets a first-party `distinct_id` cookie for the same-origin analytics proxy. There are no advertising cookies, no third-party tracking pixels, and no remarketing tags. The site does not load Facebook Pixel, Google Ads, or similar.

Your rights

• Access: email adam@triangle-startups.com from your account email and the platform will reply with the data on file.
• Correction: same address. Send what is wrong and what it should be.
• Deletion: a saved resume read deletes itself from its own page or your account's resume page, with no request and no wait. Everything else is the same address: account, signup row, watchlist, notes, resume source and generated read, optional resume contact and feedback, introduction requests, and analytics events tied to your hashed identifier are removed within seven days. Aggregated counts (the “25,000 visitors this week” type) are not reversible because they are not tied to individual records.
• Export: a CSV of your watchlist and notes is available on request.

Retention

Account data is retained while your account exists. Analytics events older than 24 months are aggregated and the per-event records are deleted. Signup rows that were explicitly declined are retained for 90 days for audit purposes, then deleted. Raw natural-language search text and parsed filters are redacted after 90 days along with the one-way query hash and any account link; de-identified result metadata remains. Submitted resume documents are deleted 90 days after submission by a scheduled job; the generated read is retained after that so a saved link keeps working, and both can be deleted at any time from the read’s own page. Raw IPs are never persisted to a long-term application store.

Children

Triangle Startups is intended for founders, operators, investors, students, and reporters working in or covering the Triangle startup landscape. The platform is not directed at children under 13 and does not knowingly collect data from children under 13. If you believe a record on the platform describes someone under 13, email adam@triangle-startups.com and the record will be removed.

Changes

This policy can change. Material changes show on this page; the date at the top tracks the last edit. Significant changes that affect signed-in users will also surface as an in-app notice on your next sign-in.