This Privacy Policy explains how DIVISION99 LLC ("TrendGap", "we", "us"), the company behind TrendGap.io, collects, uses, shares, and protects information when you visit our website or use our services (the "Service"). By using TrendGap, you agree to the practices described here.
1. Information We Collect
We collect the following categories of information:
- Account and sign-in information. Your name, email address, and password (stored only as a one-way hash) when you sign up, and whether you confirmed your email address. If you sign in with Google, we receive your name, email address, and profile picture from Google, along with the sign-in tokens Google issues for your account. For each signed-in session we keep its IP address and browser details, to keep you signed in and to protect your account.
- Sign-in and sign-up protection. To slow down password guessing, we count failed sign-ins for an email address under a keyed hash of that address, never the address itself, and we limit how many sign-in requests come from one network. When you sign up with an email address, we check that its domain can receive email and is not a disposable email service; that check looks up the domain only.
- Billing information. Plan, billing cycle, subscription status, billing period dates, any free trial, and the identifiers Polar gives your customer record and subscription. Payments are handled by Polar, our merchant of record; your card details go directly to Polar and its payment processor and never touch our servers. When you open Settings, we read your invoices and the brand, last four digits, and expiry date of your saved cards from Polar to show them to you; we do not store them. If you tell us why you are cancelling, your answer and any comment are sent to Polar with the cancellation.
- Credits. Your credit balance and a record of every credit added, spent, returned, or taken back, including credit packs you buy and referral rewards.
- Content you create in TrendGap. What you save and set up: tracked niches, lists, hidden niches, and votes; watches, alert rules, saved searches, keyword monitors, and your alerts inbox; webhook addresses you add; ideas you validate, kept in your private idea vault; your Ask TrendGap questions and their answers; projects and the results of build tools; the inputs and results of tool runs; share links you create; builder claims (the display name, stage, proof link, and private note you give); votes, flags, and notes on report sections; and removal requests you send. If you fill in your founder profile, it holds your goal, the tracks and categories you care about, your skills, hours a week, budget band, and region.
- Feedback you send us from the app. Your rating, the kind of feedback, your message, the page you sent it from, and whether we may email you about it. If you add screenshots, we keep the screenshots you take of TrendGap pages with the in-app tool (and the page each was taken on); fields you typed into and personal details are hidden automatically before a screenshot is taken. Only our team can see them. We delete them after 180 days at the latest, and with your account.
- Referrals. If you invite people, your referral code, which accounts signed up through your invitation (as account IDs), and the rewards granted.
- Connected apps. If you connect an AI tool to TrendGap (through MCP), the app's registration details, the permissions you granted, its access tokens (stored only as hashes), and a daily count of its requests.
- Email preferences and delivery records. Which optional emails you agreed to, when, and where you made the choice (for example, during onboarding, in Settings, or through an unsubscribe link); which optional emails we sent you (as IDs, not their content); a delivery log of our account emails (the address, the kind of email, and whether it was sent); and a list of addresses we must not email.
- Usage data. Records of what you do in the app, such as opening a report or making an export, linked to your account; when you last visited, so we can show what changed since then; and whether you finished or closed the product tour. We use them to run and improve the Service.
- Device and log data. IP address, browser type, referring URL, and timestamps. Used for security, debugging, and analytics. Our server logs record IDs and short codes, not what you type.
- Analytics. The pages you visit, the site or campaign link that brought you, and the steps of sign-up and checkout, counted by PostHog, and, only if you allow analytics and attribution cookies, by Google Analytics (see Sections 4 and 10).
- Cookies and similar technologies. Used for sign-in and security, and, only if you agree, to remember your preferences and how you first found us. See the Cookies section below and our Cookie Policy.
Contact form. When you write to us through the form on our Contact page, we collect your name, your email address, the topic you choose, and your message, and we use them to answer you and to protect the form from abuse. Cloudflare Turnstile checks that you are a person (Cloudflare receives your IP address for this check). To stop floods of messages, Cloudflare's rate limiter briefly counts recent messages under keyed hashes of your network and of your email address, never the addresses themselves. Your message is sent by email, through our email provider Zoho ZeptoMail (EU region), to our support mailbox, which Zoho also hosts, and we reply from there to the address you gave. We do not store your message in our database or write it to our logs; we record only the outcome of each attempt (for example, sent or failed) and when, never what you wrote. Our legal basis is our legitimate interest in answering the questions people send us or, when your question is about your account or a purchase, taking the steps you ask for under our contract with you. We keep the conversation in our support mailbox for as long as we need it to help you and to handle follow-up questions, and no longer than 24 months after our last message, unless the law requires us to keep it longer. You can ask us to access, correct, or delete your messages, or object to this use, at any time by emailing privacy at trendgap.io.
The free weekly report. If you ask for our free weekly report without an account, we collect your email address, where on the site you asked, and when. We send one email with a link to confirm the address, and nothing else until you click it. We then send the report once a week. Cloudflare Turnstile checks that you are a person (Cloudflare receives your IP address for this check), and to stop abuse we count requests under keyed hashes of your network and of your address, never the addresses themselves; those counts are deleted at the next daily cleanup. The confirmation email is sent through Zoho ZeptoMail (EU region) and the report through SendPulse. Our legal basis is your consent, which you can withdraw at any time with the one-click unsubscribe link at the end of every email. We delete an address that was never confirmed, and an unsubscribed address, within about three months. If you also have a TrendGap account with the same address, deleting the account deletes this too, and if your account already gets our Monday email, you get only that one.
2. How We Use Information
- Provide, operate, secure, and improve the Service;
- Authenticate you and maintain your session;
- Process payments and manage subscriptions, free trials, and plan limits;
- Generate the AI answers, evaluations, and results you request;
- Match opportunities to the founder profile you fill in (your fit score);
- Send transactional emails (email confirmation, password resets, billing notices, and important changes to the Service), and the alert emails you switch on;
- Answer the messages you send us through our contact form or by email;
- Read the feedback you send us and use it to improve the Service;
- Send marketing emails — only if you opt in, and you can unsubscribe at any time;
- Detect, prevent, and respond to fraud, abuse, and security incidents (for example, one free trial and one set of welcome credits per email address);
- Comply with legal obligations.
3. Legal Bases (EEA / UK Users)
If you are in the European Economic Area or the United Kingdom, we process your data under the following legal bases:
- Performance of a contract: creating and running your account, signing you in, the features you use (including sending what you enter to the AI and data services that produce the results you ask for), subscriptions, trials and credits, transactional emails and the alert emails you switch on, and answering questions about your account or a purchase;
- Our legitimate interests: keeping the Service secure and preventing abuse (bot checks, rate limits, sign-in protection, and the one-trial and one-welcome-credit rules), counting visits without storing anything in your browser, improving the Service, answering other messages, reading your feedback, and keeping the records we need to enforce our Terms and defend legal claims. You can object to these uses (see Section 8);
- Your consent: marketing emails, optional cookies and browser storage (preferences, and analytics and attribution, including Google Analytics), and including an idea in a share link. You can withdraw your consent at any time; this does not affect what we did before;
- Compliance with legal obligations: for example, keeping accounting records and answering lawful requests from authorities.
4. How We Share Information
We do not sell your personal data. We share data only with:
- Service providers who help us run TrendGap, under contracts that require them to protect your data and use it only on our instructions:
- Cloudflare — hosting, database, file storage, bot protection (Turnstile), rate limiting, and website analytics; when our AI requests pass through Cloudflare's AI gateway, it records our internal account ID and the feature used, for cost tracking, and does not store the text of features that carry what you typed; PDF rendering and the loading of public web pages some tools read; and the lookup of email domains at sign-up;
- PostHog (data kept in its EU data center) — product analytics: the pages visited, the site or campaign link that brought you, and the sign-up and checkout steps. For every visitor this runs without cookies or browser storage; only if you allow analytics and attribution cookies does it recognise your browser across visits and, when you are signed in, link it to your account ID (never your name or email address). If we turn on session replays, they are recorded only with that same consent, with all text and form fields hidden;
- Google Analytics 4 (Google Ireland Limited, Ireland, and Google LLC, USA) — usage statistics for our website and app, used only after you allow analytics and attribution cookies; until then its script is not loaded. It collects pseudonymous usage data: the pages you visit (each address cut to the page and its campaign link, never what you typed), the site that sent you, your device and browser type, and an approximate location that Google derives from your IP address. Google Analytics 4 does not store IP addresses. Google signals and ad personalisation are turned off, so the data is not used for advertising. You can withdraw your consent at any time in the cookie settings, which stops it and deletes its _ga cookies;
- Zoho — delivery of our transactional emails through Zoho ZeptoMail (EU region), and our support mailbox;
- SendPulse (SendPulse Inc., New York, USA) — delivery of the marketing emails you opt in to, such as the weekly digest, Gap of the Week, and the daily pick. We share your email address, your name if you gave one, the emails themselves, which of them we sent you, and whether you unsubscribed;
- OpenRouter, and the providers of the AI models it routes our requests to — the AI behind our AI features (see below);
- A search and keyword data provider — search, keyword, ranking, and app store data for our research tools and watches. We send the keywords, domains, apps, or brand names you enter, never your name, email address, or account details.
- Polar (polar.sh), our merchant of record, which sells our subscriptions, issues invoices and receipts, and handles sales tax and VAT. Card payments are processed for Polar by its payment processor, Stripe. To start a checkout we send Polar your name, email address, account ID and chosen plan, and, if you allowed analytics and attribution cookies, how you first found us; to open its billing portal for you we send your account ID. Polar's own privacy policy also applies to the details you enter at checkout and in its portal.
- Google, if you choose "Continue with Google" — Google confirms your identity and shares your name, email address, and profile picture with us.
- Sites and sources you name — when a tool reads a public page, app listing, or discussion you point it to (for example, an App Store or Google Play listing, a WordPress.org plugin, a website, or a keyword search on Hacker News, GitHub, or Stack Exchange for a source scan), we send that address, name, or keyword to that site or to the data provider that answers it.
- Tools you connect — if you add a webhook, we send your alerts to the address you gave. If you connect an AI app through MCP, it receives the TrendGap data it asks for on your behalf. If you send an opportunity to an AI builder or coding tool (“Build with”), your browser opens that tool with a prompt built from the opportunity, and that tool's own terms and privacy policy apply.
- People you share with — a share link shows the sections you picked to anyone who has the link, until it expires or you revoke it. An idea from your vault is included only if you explicitly agree when you create the link.
- Other members — if a builder claim of yours is approved and public, other members see its display name, stage, and proof link on that opportunity's report. Counts such as how many members watch an opportunity are shown only when at least five members are counted, and never say who.
- Images from other sites — some pages load images (such as logos and badges) from the sites that host them, so those sites receive your IP address and browser details when your browser fetches them.
- Legal and safety — when required by law, valid legal process, or to protect the rights, property, or safety of TrendGap, our users, or the public.
- Business transfers — in connection with a merger, acquisition, or sale of assets, in which case continuity of this Policy will be required.
Our AI features send requests to OpenRouter (directly or through Cloudflare's AI gateway), and OpenRouter passes them to the provider of the AI model that generates the answer. When you use a feature that works on your own text or results (the idea evaluator and quick checks, Ask TrendGap, the build and launch tools, the tools that write from what you enter, and what your source scans and keyword monitors found), that text and the details of the item it is about are sent for processing; your name, email address, and account details are not. When you submit an idea to the AI evaluator, the idea text and the feedback style you chose are sent. Niche blueprints (competitors, name ideas, and validation checklists) are generated from the niche's own details only and contain no information about you. We do not authorize providers to use your submissions to train their general-purpose models.
5. Data Retention
We keep account data for as long as your account is active. You can delete many items yourself at any time, for example an idea in your vault, an Ask TrendGap conversation, a list, or a share link. If you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, accounting, or fraud-prevention purposes. Aggregated and anonymized data may be retained indefinitely.
When you delete your account in Settings, we first end any active subscription with Polar, then delete your account and the data stored with it from our database in one step. Our database backups (Cloudflare D1 Time Travel) keep earlier copies for up to 30 days. A few records stay after deletion, without your name or email address: keyed hashes of your email address, so the same address does not get a second free trial or a second set of welcome credits and an address that must not be emailed stays blocked; a keyed hash of your account ID that records the deletion, so a late billing message cannot recreate your data; and removal requests you sent about public evidence, without their link to you or your note, so the removal still happens. Polar keeps its own records of your purchases, such as invoices, as its policy and the law require. Google Analytics keeps the usage data it collected for 14 months, then deletes it. PostHog and our email providers keep what they processed for us under their own retention settings; email privacy at trendgap.io if you want it deleted there too.
Records of failed sign-ins are short-lived: they are deleted when you sign in successfully or reset your password, and cleared over time once untouched for a day.
6. Public Sources We Analyse
To find product opportunities, we read public reviews and discussions, such as App Store and Google Play reviews, Hacker News, GitHub issues and discussions, Stack Exchange questions, WordPress.org plugin forums and reviews, and public Reddit discussions. Some of these, including all Reddit discussions, reach us through third-party data providers.
- What we keep. For each item we cite: a short excerpt of at most 300 characters or a summary in our own words (always our own summary for Reddit), its title where it has one, a link to the public page, and the date. Handles (such as @name or u/name) and email addresses in the excerpt are replaced. We never store the usernames or profiles of the people who wrote them.
- How long. We keep an item for as long as the opportunity it supports is listed on TrendGap. The text of a Reddit discussion is read only to write our summary and is never stored. After a valid removal request, we stop showing the item within 48 hours and never add it back.
- Removal. To ask us to remove an item (for example, one you wrote), use the “Request removal” link next to it or email support at trendgap.io.
7. Security
We use industry-standard safeguards including encryption in transit (TLS), passwords and the tokens of share links and connected apps stored only as one-way hashes, role-based access controls, and server-side checks that give each user access only to their own data. No system is perfectly secure, but we work hard to protect your data and we will notify affected users promptly if a breach occurs that materially impacts them.
8. Your Rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data; restrict or object to certain processing; and withdraw consent at any time. To exercise these rights, email privacy at trendgap.io. You also have the right to lodge a complaint with your local data protection authority.
In particular, if you are in the European Economic Area or the United Kingdom, you have the right to:
- access the personal data we hold about you and receive a copy of it;
- have inaccurate or incomplete data corrected (rectification);
- have your data deleted (erasure);
- have our use of your data restricted;
- receive the data you gave us in a structured, machine-readable format, or have it sent to another company (portability);
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, without affecting what we did before;
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you think an infringement took place (in the UK, the Information Commissioner's Office). We would appreciate the chance to help first.
You can do much of this yourself: change your name in Settings, under Profile; reset your password from the sign-in page; turn optional emails on or off in Settings, under Email, or with the unsubscribe link at the bottom of any optional email; change your cookie choice with “Cookie settings”; delete ideas, Ask TrendGap conversations, lists, and share links, and disconnect connected apps, where they are listed; and delete your whole account in Settings, under Profile, with “Delete account”. For anything else, email privacy at trendgap.io. We may ask you to confirm a request from your account's email address. We answer within one month; if a request is complex, we may take up to two more months and will tell you why.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks protect the Service (for example, refusing sign-ups from disposable email addresses, or pausing sign-in after repeated failed attempts); if you think one has wrongly affected you, contact us and a person will look at it.
9. International Transfers
TrendGap is operated from the United States. Our database is hosted by Cloudflare, primarily in the eastern United States, and the Service runs on Cloudflare's global network, so your requests may be handled in a data center near you. Our transactional emails are processed by Zoho ZeptoMail in the European Union. Marketing emails you opt in to are sent through SendPulse, whose servers are in the United States and Germany; it processes this data under its data processing agreement, which relies on the European Commission's Standard Contractual Clauses for transfers out of the EU. Product analytics are processed by PostHog in its EU data center. If you allow analytics and attribution cookies, Google Analytics data is processed by Google Ireland Limited and Google LLC and may be transferred to the United States under the EU-U.S. Data Privacy Framework, in which Google LLC participates, and the European Commission's Standard Contractual Clauses. Polar, OpenRouter and the AI model providers it uses, and our search and keyword data provider may process data in the United States and other countries. If you access the Service from outside the United States, your information will be transferred to and processed in the U.S. and other countries where we or our service providers operate. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.
10. Cookies
We use a small number of cookies and similar browser storage. Some are strictly necessary and always on: they keep you signed in, protect sign-in and our forms from abuse, make the features you use work, and remember your cookie choice. Others are optional and used only if you agree: preferences (for example, that you closed a notice) and analytics and attribution (how you first found us, which is saved with your subscription if you subscribe). We do not use advertising cookies. Our website analytics (Cloudflare Web Analytics, and PostHog unless you allow analytics and attribution) count visits without cookies and without storing anything in your browser; with your consent, PostHog also keeps a random identifier in your browser so it can recognise it on later visits. Google Analytics runs only with that consent: it sets its _ga cookies (a random identifier and the state of your visit, kept for up to 2 years) and stops, with those cookies deleted, when you withdraw it.
We honour Global Privacy Control (GPC) and Do Not Track. If your browser sends either signal, Google Analytics is not loaded, and PostHog keeps nothing in your browser and does not link your visits to your account, even if you allowed analytics and attribution; only the counting without storage described above runs.
Our Cookie Policy lists every cookie and storage item we use, what it does, and how long it lasts. You can change or withdraw your choice at any time with “Cookie settings” at the bottom of our website pages, in Settings in the app, or on the Cookie Policy page. Turning analytics and attribution off later does not remove what was already saved with a subscription; email privacy at trendgap.io and we will delete it.
11. Children's Privacy
TrendGap is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, please contact us and we will delete it.
12. Changes to This Policy
We may update this Policy from time to time. If we make material changes, we will give you reasonable notice through the Service or by email before they take effect. The "Last updated" date above always reflects the most recent revision.
13. Contact
Questions or requests about your privacy? Email privacy at trendgap.io.
DIVISION99 LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA.
