Your data

Privacy

Threshby reports what a franchise costs to open. This page says what we keep when you use it, who handles it, and how to ask us to delete it.

Notice dated

October 22, 2026

It changes in the same release as any change to what the site collects.

What we store

If you create an account, your email address. It is held by our authentication provider, Supabase, so it can send you sign-in links. We also record the country your request came from. We work that out from the request itself and never ask you for it.
If you arrived by clicking one of our Google ads, the ad's click id is kept with your account, so we can tell which click led to the signup.
While you are signed in, the brands whose full breakdown you opened. That list is what the Your record page shows you.
If you ask to be told when a brand's filing is added, your email address and that brand.
Any privacy request you send from this page: your email address, the kind of request, your message if you wrote one, and the country the request came from.

We use PostHog to record a small set of named events: visits to the landing page, report views, signup steps, a request to be told about a brand, a return visit more than a day after your last one, and feedback you send. We also record the ad campaign you arrived from, meaning its utm parameters and the Google click id.
Automatic click capture, automatic pageview capture and session recording are turned off.
When you sign in, analytics links your visits to an internal account id. It does not use your email address.
Analytics requests are sent through our own domain on to PostHog.
If the site hits an error in your browser, PostHog also receives an error report: the error, where in the site's code it happened, and the page you were on.

What you type into Send feedback goes to our analytics as the text you wrote, together with the page it came from. Do not put anything in it you would not want us to read.

Supabase stores our database and runs sign-in. Sign-in emails are sent by Resend, the email service our sign-in uses.
PostHog receives the analytics events described above.
Google Ads receives the click id of an ad click that led to a signup and when that signup happened, so we can see which ads work. It never receives your email address.
The site is hosted on Vercel.

A sign-in session cookie, once you are signed in.
Analytics identifiers, so a return visit can be recognised.
A last-visit time, kept in your browser's local storage, which is how we tell a return visit.
For the current tab only, the ad campaign you arrived from, in session storage.
While you are signing in from an emailed link, two short-lived cookies: one remembers the page you were on for up to an hour, and one carries your account id to analytics for up to ten minutes. Each is cleared once it has been used.

To have your data deleted, to get a copy of it, or to ask anything else about privacy, use this form.