Influ

Privacy

What Influ stores, where it is held, who can see it, what leaves these servers, and what closing an account does and does not do.

Draft — not reviewed by a lawyer. It describes what the software actually does today. Have it reviewed before Influ is offered more widely.

Last updated 09/2026

Where your data lives

On servers operated for Influ, in Germany.

• The database — Neon Postgres, eu-central-1 (Frankfurt). Accounts, checks, runs, preferences and feedback are here.
• The application — a container on Render, also Frankfurt.
• The cache — Upstash Redis, holding third-party responses so a repeat run skips the network.

An earlier version of this page said everything stayed in a SQLite file on the machine running Influ and that no Influ-operated server existed. That was true of the laptop build and stopped being true when Influ moved to a hosted service. It is corrected here.

What is stored about you

• Account — username, display name, the date you registered, your plan, your role, and a PBKDF2-HMAC-SHA256 hash of your password. The password itself is never stored. If you sign in with Google, the identity Google returns is stored instead of a password.
• Sessions — a random token, in the database and in a cookie on your browser, so you stay signed in. It lasts 30 days. It is the only cookie that identifies you; Streamlit, the web framework, sets one more that protects forms against cross-site submission. Neither feeds analytics or advertising, and there is no third-party tracking on any page.
• Your checks — the narrative text you typed, derived terms and slogans, country, analysis window, and their titles.
• Your runs — when each measurement happened, its score and coverage, how long it took, and which sources were asked and which answered.
• Where a run was started from — the IP address your browser reached us from, and the country it resolves to. Recorded per measurement, not per session. A scheduled re-run records neither, because nobody was at a keyboard to have an address.
• Preferences — default country and window, your source selection, and any presets.
• Feedback — anything you send through the feedback form.

Who can see it

Your own account sees its own checks, runs and feedback, and nobody else's.

An administrator can see the list of accounts and can read and reply to feedback. A Super Admin — the operator of this installation — can in addition see a search history: for every account, what was measured, when, and from which address and country. That record exists so the service can be run and abuse can be spotted. It means the operator can see what you searched for. It is the most sensitive thing in the database after the credentials, and it is restricted in the data layer rather than only hidden in the interface.

What leaves these servers

Running a check sends your search terms to the sources you have enabled. Turning a source off in Settings → Data sources stops it being contacted at all.

It also sends the narrative text you type to an AI provider, because that is what derives the terms, and sends the text of the public posts and articles found to the same provider to be classified. The provider is whichever is configured, in order: Anthropic, then Google (Gemini), then Groq. VADER, the free fallback, runs on the server and sends nothing.

Your IP address is sent to ipwho.is, which returns the country it belongs to, so the search history can show a place rather than a number. Only the address is sent and only the country is kept — never a city or coordinates — and the answer is cached for thirty days so the same address is not looked up twice.

A scheduled re-run does all of this on its own schedule, without anyone at the keyboard, and records no address.

Payment data

None is collected. Billing is not implemented, no payment company is connected, and choosing a plan charges nothing.

Closing your account, and what that does not do

Read this part carefully, because it is not what "delete" usually means.

Closing your account stops it working immediately: you are signed out of every device and you can no longer sign in. Your checks, runs, preferences and feedback are kept, and the account can be restored by the operator. Nothing is erased by pressing the button.

This is deliberate — it makes an accidental or regretted deletion recoverable — but it means closing your account is not erasure, and you should not treat it as such.

Your control

• Delete any individual check from the history list. That one is a real deletion.
• Clear all cached third-party responses from Settings → Data sources.
• Close your account from Settings → Profile, with the limits above.
• For actual erasure — your account and everything attached to it permanently removed — write to labs3375@gmail.com and ask. It is done by hand, so allow a few days. Use the same address for a copy of your data or any other question about this page.

Open Influ