How this actually works.
Written for the person doing due diligence before handing over a client roster or brand deal — no marketing language, just what’s actually built. For the full legal version, see the Privacy Policy.
Where your data lives
Accounts, profiles, metrics, and goals are stored in Supabase (Postgres), hosted in the EU. Files — avatars, cover images — go through Supabase Storage. The app itself runs on Vercel. We don’t run our own servers or databases.
Row-level security, not just application logic
Every table that holds user data has Postgres row-level security enabled, enforced at the database layer — not just checked in application code. An account can only read or write rows it owns. Admin-only queries route through dedicated database functions rather than relying on the client to behave.
Payments
Billing is handled entirely by Stripe. Card numbers are never sent to or stored on our servers — Stripe Checkout collects them directly. We store a Stripe customer ID and subscription status, nothing more.
API keys
Public API keys are shown once at creation. We store a SHA-256 hash and a short prefix for identification — the raw key itself isn’t recoverable from our database if it’s ever accessed. Revoking a key takes effect immediately.
In transit and at rest
All traffic runs over HTTPS. Data at rest is encrypted by Supabase and Vercel’s underlying infrastructure as a platform default, not a custom implementation we maintain ourselves.
Platform connections
Connecting YouTube, Instagram, Spotify, and the rest uses each platform’s own OAuth login — we never see or store your password for any connected platform. We request the minimum scopes needed to read public metrics, and you can disconnect any platform at any time.
What we don't do
We don’t sell data. We don’t run third-party advertising trackers. We don’t train models on your data.
Questions
If you’re doing due diligence for an agency, brand, or client and have a specific question this page doesn’t answer, email mark@initialone.co.uk directly.