How we handle your data

Pain Monkey is operated by Evan Herbstman, an individual in New York, United States. In this policy, “we” means that operator, who is responsible for the personal information described here. Contact evherbstman@gmail.com for privacy questions or requests.

Information we collect and why

Account information: your email, account identifier, sign-in/session records and report allowance, to authenticate you, prevent abuse and provide saved reports.
Research: the idea, audience, problem and optional context you submit; generated reports; source links and short passages; request IDs; processing usage; and start, completion and report-access timestamps. We use these to deliver, save and troubleshoot your research.
Acceptance records: the research notice/terms version and acceptance timestamp associated with a report request.
Product updates: your email, signup time, the signup notice version when supplied by the form, and any signup answers you provide, to record the request and understand interest in the beta. An opt-out can leave a minimal email and timestamp record used to prevent unwanted updates; submitting that address to the public form does not remove its opt-out.
Optional report feedback: your usefulness answer, chosen next step, optional note, notice version and submission times, linked to your report. If you choose to share it, we use it to evaluate and improve the product. It is not a public testimonial or a marketing signup. You can remove it from the report; deleting the report or account also removes its feedback from our active database.
Support: messages and information you send us, to answer questions and resolve requests.
Technical records: hosting and authentication services may process IP addresses, browser/device details, request times, errors and security logs to deliver and protect the service. We also keep short-lived request counters keyed by a protected hash of an email, account ID or access token to limit abuse. These counters contain no raw email addresses or tokens, expire within an hour, and expired counters are cleared as that endpoint processes new traffic.

Account information and the three required idea fields are needed for account research. You can view the example and use the separate local planner without an account. Marketing signup is optional and separate from sign-in.

AI processing and public sources

Starting research sends your idea and research context to Anthropic through its commercial API for AI processing and web search. Its search service processes queries derived from your idea. Results can include publicly available statements, source titles, links and limited passages about other people. Public availability does not remove those people’s privacy or copyright rights.

Do not submit passwords, financial account details, health records, government IDs, children’s information, other people’s private information, or confidential business material. Describe customer groups rather than named individuals. We do not use your submissions to train our own AI model. Provider retention and processing are governed by their applicable service terms; we do not promise zero retention or immediate erasure from their systems.

The app generates research suggestions, not decisions about your legal rights or eligibility for employment, credit, housing or other important services. We do not use reports to make those decisions about you.

Who receives information

Vercel hosts the website. Supabase handles authentication, accounts, reports and the waitlist. Anthropic processes research. Product-update signup emails and answers are also copied to a private Slack signup channel for the team. Contacting the temporary Gmail support inbox sends your message through Google’s email service. A configured sign-in email delivery provider also processes the address and delivery information needed to send your link.

Account reports are accessible to your account and authorized operators who need access to run or support the service. A report link alone does not grant access. We do not sell your personal information, rent the update list or share it for cross-context behavioral advertising. We may disclose information when legally required or when necessary to investigate abuse, protect rights or respond to a security incident.

Account settings lets you download your active account research data, acceptance records and optional feedback. A broader request can include separate waitlist or support data where applicable; contact us so we can verify and address that scope. The download is not a complete copy of infrastructure or provider logs and backups.

Browser storage and tracking

The research workspace stores a sign-in session in your browser. The separate free planner and evidence worksheets store their work locally. Choosing “Make a free test plan” temporarily copies the idea and suggested offer into this tab’s session storage so you can review them in the planner; it does not create a saved test until you choose to save. Some research tools contact public source APIs when you ask them to search. Sign out on shared devices and download local backups before clearing storage. Downloaded files remain under your control.

The app does not install advertising pixels or cross-site behavioral tracking. It does not change its behavior in response to legacy Do Not Track signals. Because it does not sell or share information for behavioral advertising, a Global Privacy Control signal does not require changing those practices. Service providers may use storage needed for authentication, security and delivery. We will review and disclose new tracking before adding it.

How long information stays

Saved research remains in your account so you can return to it, until you delete it or the service is retired. Account records support access for that period. Product-update records remain while you request updates; you can unsubscribe by contacting us. Support and security records are kept as needed to resolve the issue, prevent abuse or meet legal obligations. We review continued need rather than treating these as permanent archives.

Deletion removes active app records. Provider backups, security logs and already-running AI requests have separate retention schedules and exceptions. Removing an account does not delete your downloaded files, local planner, separate waitlist signup or its Slack notification. Contact us to include the waitlist, Slack and support records in a deletion request. A minimal suppression record may be retained to honor a marketing opt-out. We do not promise a fixed deadline for erasing infrastructure backups.

Your choices and privacy requests

Use Download brief, Delete report, or Delete account and all research in your workspace. Deletion does not restore research allowances. For a copy of other personal information, correction, deletion, an objection, restriction, portability, withdrawal of marketing consent or an appeal of our response, email evherbstman@gmail.com. These rights may depend on your location and applicable exceptions. You can also request correction or removal of personal information appearing in a source passage.

Tell us what you need and, if relevant, a report ID or source URL. Do not send a password, access token or ID document with the initial request. We may verify ownership using your account email and request proportionate additional information if necessary. We will explain any limitation and respond within applicable legal deadlines. We do not penalize you for exercising applicable privacy rights. You may complain to your local data protection authority.

International users and legal grounds

We operate from the United States. Our providers may process information in the United States and other countries whose laws differ from yours. Contact us for information about the safeguards applicable to your data. This policy is not a request to waive transfer protections or mandatory privacy rights.

Where European or UK data protection law applies, providing the requested account and research relies on performance of our agreement with you; protecting the service and handling ordinary support relies on legitimate interests; optional marketing and optional report feedback rely on consent; and required legal disclosures rely on legal obligations. Any use of publicly sourced personal information requires a lawful basis and respect for the rights of the people described. Withdrawing marketing or feedback consent does not affect earlier lawful processing or prevent you from using the service.

Age and policy changes

This beta is for adults aged 18 or older and is not directed to children. Please contact us if you believe a child has provided personal information so we can investigate and remove it as appropriate.

We will update the effective date when this policy changes. Material changes will be highlighted in the app or communicated by email as appropriate; where required, we will request fresh consent before a new use. A future company formation does not silently change the operator identified above. See also the beta terms.