Privacy

If you only read the site

The public surfaces (the directory, weekly digests, deep dives, events) do not require a sign-in and do not collect a name or email from anonymous visitors. Server logs record the IP address of incoming requests for rate-limiting and abuse-prevention. When the platform sends an analytics event tied to an anonymous request, the IP is hashed with a server-side salt before it leaves the request boundary; the raw IP never reaches a third party.

If you use natural-language directory search, the platform keeps the text you entered, the parsed filters, and result metadata in its first-party database for up to 90 days so failed searches can be used to improve the directory. Anonymous search rows are not linked to an IP address or account. After 90 days, the raw text and parsed filters, one-way query hash, and any account link are removed. De-identified result counts and performance metadata remain.

If you sign up

The beta-access form at /beta collects your name, email, role (founder, operator, investor, student, other), optionally your company name, and how you heard about Triangle Startups. The platform stores those values in its membership roster. A completed signup currently grants access immediately unless access has been explicitly blocked by the founder; that blocked status prevents sign-in. The email is used for Supabase sign-in. The landing URL and user-agent string of the request are stored alongside the row for context. The IP address is stored as a hash, not raw.

If you sign in

Triangle Startups uses Supabase Auth for sign-in. Three methods are supported: email-and-password, one-time email codes, and social sign-in (Google, LinkedIn, GitHub when enabled). For email-and-password, the platform stores your email address and a salted hash of your password (Supabase handles the hashing; the platform never sees the plain password). For social sign-in, the provider returns your email, your full name, and a profile picture URL; the platform stores those in your authentication record. Optional onboarding can also store the profile details you choose to provide: role, job title, company, website, LinkedIn URL, school and graduation year, current goals, focus regions, sectors and stages, watchlist, digest preference, and free-form context. If you use the agent-import path, the prompt, response, named tool, and normalized imported profile are stored so you can review and edit what was imported.

Once signed in, the features available to you (a watchlist of companies, private notes against company profiles, weekly-digest preferences) save additional structured data tied to your account. That data is visible only to you and the founder.

Signed-in natural-language searches are linked to your opaque account ID for the same 90-day raw-text window. This helps the founder distinguish repeated unmet demand from one-off searches.

Who else sees the data

• Supabase hosts the database and authentication layer. Your account record, beta signup row, watchlist, and notes live in Supabase Postgres.
• Vercel hosts the application code and processes requests, including form and search content you send to the platform. Its request logs can include the URL, response code, and latency. Persistent user records live in Supabase rather than Vercel.
• PostHog receives product-analytics events (page views, button clicks, search submissions, sign-in attempts). Anonymous events use a hashed IP as the identifier; signed-in events use an opaque account ID or a one-way email hash. Search events include query length and result metadata, not the text you entered. The browser sends these through a same-origin reverse proxy to reduce ad-blocking. Query strings are stripped from analytics URLs, session recording and PostHog exception capture are disabled, and PostHog never receives raw IPs or raw email addresses.
• Sentry receives error and performance telemetry so failures can be diagnosed. Default collection of personally identifying data is disabled. Sentry may receive a route URL without its query string, error type, stack trace, browser or runtime metadata, and timing information.
• Anthropic receives the text of a signed-in natural-language search only when the deterministic parser cannot handle it and the AI fallback is enabled. If the company-question feature is enabled in the future, Anthropic will receive the question and the bounded company context needed to answer it. Anonymous directory searches do not use the AI fallback.
• Google / LinkedIn / GitHub see only the fact that you initiated an OAuth sign-in. They do not receive a list of who else uses Triangle Startups.
• Email providers(Supabase's authentication mail service and Resend) handle the actual delivery of sign-in, newsletter, and notification emails. They see the recipient address and the email body.

The platform does not sell, license, or otherwise share user data with third parties beyond the infrastructure vendors named above.

Cookies and similar

The site uses Supabase session cookies to keep you signed in. PostHog sets a first-party `distinct_id` cookie for the same-origin analytics proxy. There are no advertising cookies, no third-party tracking pixels, and no remarketing tags. The site does not load Facebook Pixel, Google Ads, or similar.

Your rights

• Access: email adam@triangle-startups.com from your account email and the platform will reply with the data on file.
• Correction: same address. Send what is wrong and what it should be.
• Deletion: same address. Account, beta-signup row, watchlist, notes, and analytics events tied to your hashed identifier are removed within seven days. Aggregated counts (the “25,000 visitors this week” type) are not reversible because they are not tied to individual records.
• Export: a CSV of your watchlist and notes is available on request.

Retention

Account data is retained while your account exists. Analytics events older than 24 months are aggregated and the per-event records are deleted. Beta-signup rows that are explicitly declined are retained for 90 days for audit purposes, then deleted. Raw natural-language search text and parsed filters are redacted after 90 days along with the one-way query hash and any account link; de-identified result metadata remains. Raw IPs are never persisted to a long-term application store.

Children

Triangle Startups is intended for founders, operators, investors, students, and reporters working in or covering the Triangle startup landscape. The platform is not directed at children under 13 and does not knowingly collect data from children under 13. If you believe a record on the platform describes someone under 13, email adam@triangle-startups.com and the record will be removed.

Changes

This policy can change. Material changes show on this page; the date at the top tracks the last edit. Significant changes that affect signed-in users will also surface as an in-app notice on your next sign-in.