How Mysterious Income, at withscale.xyz, handles your information.
What we collect
If you continue with Google: the name and email address of your Google account. We ask Google for nothing else, and we cannot read your Gmail, contacts or files.
If you create an account with an email and password: your name and email address, stored in our database and in your own browser to prefill the payment form. Your password itself is never stored: we keep only a scrambled version of it (a salted hash) that cannot be turned back into the password.
If you save your first and last name on the Account page: those names and the email address of your account, stored in our database.
If you add a profile photo: a small copy of it, stored in our database and shown only to you. You can remove it at any time from the Account page.
If you buy: your payment is made on Whop's form, so your card details go to Whop and never reach us. We receive the status of your payment and membership.
When you browse the site, measured with PostHog: the pages you visit, the site, campaign or affiliate link that brought you, which buttons, plans and ideas you clicked, your type of device, browser and screen, an approximate location (country and city, worked out from your IP address) and any error the page runs into. Your visits are tied together across pages and days by a random identifier and, once you have an account, to that account through an internal ID (a keyed hash of your email address, from which the address can't be read back).
We never send your name, email address or password to PostHog, we don't record your screen, and what you type into forms is never collected. Single-use links (password reset, email confirmation) are blanked out of page addresses before anything is sent.
When you create an account, sign in, confirm your email, pay, renew, cancel, are refunded or dispute a payment: our server records the event in PostHog under that same internal ID, with the plan and the amount paid before tax, and how you found us. Your payment details stay with Whop.
For security, when you sign up, sign in or ask for an email: a keyed hash of your IP address is counted for a few minutes to stop automated abuse, and deleted within a day.
Why we use it
To sign you in, to confirm that you have paid, and to give you access to the members' area, including on a new device.
We use your email address to confirm it, to send messages about your account and purchases, and to send news and offers about our product. You can stop news and offers at any time with the unsubscribe link in those emails or by writing to us.
To understand how the site is used and improve it: which pages people read, where they stop, which links bring visitors, and what breaks.
Our legal bases: your account and purchases (to perform our contract with you); audience measurement, the account and payment events above and abuse prevention (our legitimate interest in running, measuring and securing a paid service). You can turn audience measurement off at any time (see below).
We do not sell your information and we do not use it for third-party advertising.
Cookies and browser storage
Always on, because the site needs them: one cookie keeps you signed in, one proves your access to the members' area, one ties a purchase to the browser that made it, and one remembers which affiliate link brought you here (for up to 30 days, so the right partner is credited). Your browser also keeps your name and email to prefill the payment form, and your cookie choice. Whop's payment form may set its own cookies.
For audience measurement, unless you turn it off: PostHog's cookie (named ph_…, kept up to one year) and its copy in your browser's storage, holding a random identifier; our own record of your visit's sources and path through the site, in your browser's storage (mi-analytics); and, for ten minutes when you continue with Google, a cookie (mi_ctx) that says whether you were signing up or signing in and how you found us, so the account is counted correctly. Turning measurement off erases these, and the site works the same.
Who handles your data
Google, when you sign in with Google. Whop, which processes payments and keeps purchase records. Vercel, which hosts this site. Neon, which hosts our database. Resend, which sends our emails. PostHog, which measures how the site is used, on its servers in the European Union.
Your browser sends the audience measurement to withscale.xyz/relay, our own address, which passes it on unchanged to PostHog in the European Union.
Your session is held in a signed cookie, and your purchase is held by Whop.
Your choices
You can sign out at any time, clear this site's cookies in your browser, or remove this site's access from your Google account settings. To ask for a copy of your data or for its deletion, write to us at the address below.
Turn audience measurement cookies off (or back on) at any time, with Cookies at the bottom of every page. To object to the measurement done by our server, or to have your analytics data deleted from PostHog, write to us at the address below.