Privacy Policy
Version 1 · Last updated October 28, 2026
pluck reads a Substack publication's public archive and returns product ideas backed by what its readers said. pluck is operated by L2 Inc. This policy covers hellopluck.com and the audits it runs. If you subscribe to a publication, that publication's own privacy policy governs what it does with your address.
What we collect when you run an audit
- Your email address. You give it to start an audit, and we use it to send you the link that starts a free audit and the report itself. If you pay, Stripe collects it too, because checkout runs on Stripe's side.
- The address of the publication you asked us to read: a name.substack.com address or the custom domain it publishes at.
- The report we generate for you: the ideas, the evidence behind them, the market around them, the offers and the tests. This is what you came for, so it is stored and kept.
- A summary line for each post we read: its title, date, and reaction and comment counts. This stays with the report.
- Public comments from online communities such as Reddit, found while researching each idea's market. The commenters' names are dropped; the comment text is sent to the AI model providers and short quotes can appear in your report.
- A working copy of the public posts and their comments, for 30 days. An audit runs in steps, and each step saves what it read so a step that fails can retry without fetching the archive again. Before a comment is saved, the commenter's name is replaced with a scrambled (hashed) id, and readers' names we can match are removed from its text. The whole working copy is deleted 30 days after the audit finishes or fails. Short quotes from comments can appear in your report as the evidence behind an idea, and those quotes stay with the report.
What we do not collect
- Nothing behind a paywall. We read what Substack shows the public, the same pages anyone can open without subscribing.
- No account. There is no login, no password and no profile. Your report is reached through a link only you receive, until you share it.
- Your card details. Payment happens on Stripe's page, and card details never reach our site.
Who processes the data
These providers process data so pluck can work. Each one is sent only what its part of the job needs, and each handles data under its own terms.
| Provider | What it does | What it is sent |
|---|---|---|
| AI model providers | Run the AI models that read the archive and write the report | Post text and comment text, including public community comments found during research, for the run. Not your email address. |
| Search and web-reading services | Search the web and online communities for what already sells in each idea's market, and read those product pages | Search terms written from the archive's topics and ideas, and the addresses of the pages to read. Not your email, your posts or your readers' comments. |
| Stripe | Takes payment | Your email, the publication address and your card details, entered on Stripe's own page. |
| Hosting and database providers | Host the site, run the audits, store the data and route traffic to the site | Your email, the publication address, the report, the per-post summaries, the 30-day working copy, and your IP address and the requests your browser makes. |
| Email delivery provider | Sends the emails | Your email address and the contents of each message. |
| Analytics provider | Counts visits and purchases, and records errors | Which pages you open and when, your IP address and browser details, a random browser id and the value of a purchase. The report link's run id and access token are removed first, and so is any email address, run id or token in an error report. |
| Advertising platforms, such as Meta | Measure whether ads lead to sales | A browser id from the platform's pixel, your IP address and browser details, and, when you enter your email or pay, a one-way scrambled (hashed) version of your email. Sent from the browser and from our server. |
These are the kinds of provider pluck uses, and the companies behind them can change as better ones become available. A change of provider does not change what is collected or why. To ask which companies process your data today, email [email protected].
Analytics and cookies
Advertising pixels run on hellopluck.com's pages, but never on a report itself. The analytics provider also counts report views, with the report link's run id and access token removed from the address before anything is sent. The analytics provider and the advertising pixels set their own cookies for that counting. Besides those, we set one first-party cookie, kept for up to 400 days, to recognise a returning browser. It links your visits, and any email address you type into a form on the site, to the ads you clicked and the audits you run, across the sites L2 Inc. operates. That record is kept until you ask us to delete it.
Payment and refunds
Your first audit is free and shows the first idea in full. Unlocking the other ideas costs the price shown on your report, charged when you pay. The refund rules are in the Terms of Service: all sales are final, except that you pay nothing when a technical error on our side stops you getting what you paid for, or when an audit delivers fewer ideas than you paid for.
How long data is kept
- A finished or failed audit: 36 months from the day it ends. After that the audit and everything on it is deleted.
- The working copy of posts and comments: 30 days after the audit finishes or fails.
- A checkout that was never paid, or a free-audit link that was never opened: 7 days.
- The free-audit check: 36 months. If you run a free audit, we keep your email address on its own so each person gets one free audit. It stays even if your report is deleted.
- Product pages read during market research: a cached copy for 7 days, so the next audit can reuse it.
- Market research: pluck may keep records of what products sell in a category. They carry no run, no publication and no email, so they cannot say which audit surfaced which product.
Thirty-six months is long enough to come back for a report you lost and to sort out a problem with a charge.
The report link
Your report lives at a link with a long random token in it. It is emailed to you and shown in your address bar when the audit starts. The link is made to be shared: whoever holds it can read the report. Your email address is not in the report, but send the link only to people you would show the report to.
Getting a copy or having it deleted
Email [email protected] and we will send you what we hold about you, or delete it, except records we must keep for tax or to stop a second free audit.
To find an audit without a login, use "Find my report" on the audit page. It answers the same way whether or not an address has ever run an audit, so nobody can use it to test whether an address is a customer.
If your publication or comments were read
Anyone can run an audit on a public Substack publication, so pluck may read your posts or your public comments without you being the one who asked. Only public pages are read, commenters' names are replaced before anything is saved, and the working copy is deleted after 30 days.
If you are a writer or a commenter and want your posts or comments removed from a report pluck holds, email [email protected] with the publication's address or the comment, and we will remove them.
Children
pluck is not meant for anyone under 16, and we do not knowingly collect data from them.
Security
We use reasonable safeguards to protect the data pluck holds. No system is perfectly secure, and we cannot promise that data will never be accessed without permission.
Where data is processed
pluck's providers may process data outside your country, including in the United States.
Changes to this policy
We may update this policy, including the provider list. The date at the top says when it last changed.
Contact
Questions about this policy: [email protected]. pluck is operated by L2 Inc., Victoria, BC, Canada.