Privacy Policy

Would You Buy It? (“WYBY”, “we”) is a pricing-research tool: a creator describes an offer and up to five prices, and people who visit the shareable link each see exactly one of those prices and say yes or no. This page explains what we collect, from whom, and why.

The short version

• Answering a price test doesn't require a name, email, or account.
• A test creator never sees who answered what — only aggregated numbers per price.
• We don't sell data, run ads, or use advertising or marketing trackers of any kind.
• There is no AI anywhere in this product, and none of your data is used to train one.

If you're answering a price test

We don't ask for your name or email to answer. We set one anonymous cookie on your browser so the same person can't vote twice on the same test — see the Cookie Policy for exactly what it stores. We record your yes/no answer, the price you were shown, and, if you choose to give them, an optional confidence level and an optional price suggestion. None of that is linked to your name or email, because we never collect one.

The test creator's report is aggregated statistics — purchase-intent rates, modelled revenue, that kind of thing — not a list of individual answers. Even the CSV export a creator can download deliberately leaves out any per-respondent identifier.

We also record a few technical signals to keep results trustworthy and catch abuse: a coarse device category (mobile, tablet, or desktop — not your exact browser or device), and, if present, where the link was shared from (a referring page or campaign tag). We never store your IP address itself — only a one-way, salted hash of it (see “Keeping results honest” below). None of this is shown to the test creator; it's visible only in our own internal dashboard, used to run the product, never sold or shared.

If you're creating an account or a test

You can create and share a price test without an account. Creating an account (to save tests to a dashboard, unlock a report, or manage billing) collects:

• Your email address, from Google sign-in or from clicking a magic link we send you.
• The offers and prices you create — title, description, images, and price points.
• Payment records when you unlock a report — the amount, date, and status of the charge. We never see or store your card number, billing address, or tax details; the payment itself is sold and billed by Paddle as merchant of record (see below).

Who we share data with

We use a small number of third-party services to run WYBY, and only for the purpose named:

• Google — if you choose to sign in with Google, to verify your identity.
• Paddle — our Merchant of Record. When you unlock a report, Paddle is the seller of that transaction, not just a processor passing a card number through: it collects your payment details and the billing information it needs to charge the right VAT or sales tax for your country, issues the invoice, and is the controller of that payment data under its own privacy policy. We never receive or store your card details — only a record that the payment succeeded, plus the amount, date, and status.
• Our transactional email provider — to send sign-in links, if you sign in by email instead of Google.
• Cloudflare (Turnstile) — an invisible bot-check on the voting page, so a test's results reflect real people rather than automated scripts. Cloudflare's widget runs in your browser, and when you vote we send it a one-time verification token together with your IP address to confirm you're not a bot — see Cloudflare's privacy policy. It never shows a checkbox or interrupts you if it can verify you silently.

We do not sell personal data to anyone, and we do not use third-party advertising or marketing trackers. Product usage analytics happens two ways: detailed funnel events (which step of the flow people reach, results-page views, that kind of thing) are stored first-party in our own database; and general site traffic (page views, referrers, browser/device mix) is measured with Umami, an open-source analytics tool we run ourselves on our own server — it's cookieless, uses no persistent identifier, and never sends your data to an outside analytics company.

Keeping results honest

To stop the same person voting twice on a test or abusing sign-in/upload endpoints, we compute a one-way, salted hash (SHA-256) of your IP address and use that hash for rate-limiting and duplicate-vote checks. Your actual IP address is never written to our database — only this hash, which can't be reversed back into an address, and which we never show to test creators. Logged-in sessions store the same hash, alongside your browser's user-agent string, purely for account security (recognising anomalous activity) and to support “Log out everywhere” from Account.

How long we keep it

Account data is kept for as long as your account is active. You can delete your account at any time from your account page — this immediately removes your sign-in identities and ends every active session. Tests you created and payment records are retained after that (disassociated from your account) for accounting and product-integrity reasons, the same way a receipt outlives a closed store account.

Answers to a price test (and the anonymised traffic data behind stats like “answer rate”) are kept for as long as the test itself exists, since they're what the creator's pricing report is built from — that's the whole product. Deleting a test deletes its answers and traffic data with it, immediately and permanently. Sign-in sessions and magic-link emails are single-purpose and short-lived by design (a session expires after 30 days of inactivity, a login link after 15 minutes) and are automatically erased from our database roughly a month after they stop being usable, whether or not you ever delete your account.

Your choices

• Delete your account and sign-in data any time from Account.
• Sign out of every device at once from the same page.
• Clear the anonymous respondent cookie any time via your browser's cookie settings.

Questions

Reach us at support@wouldyoubuyit.app for anything about this policy or your data.