Privacy Policy

LaunchAmp is a very small, clearly defined service, and this privacy policy is correspondingly short. We use no tracking, no advertising networks, no analytics services and no social media plugins. Public pages of launchamp.eu load no content whatsoever from third-party servers — no fonts and no JavaScript libraries from a CDN either. Your IP address is therefore not transmitted to anyone outside our hosting provider when you visit this website.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the operation of this website and of the LaunchAmp service is:

Christopher Richter
Kirchweg 7a
21244 Buchholz
Germany
Email: hello@launchamp.eu

We have not appointed a data protection officer; the statutory conditions of Section 38 BDSG (German Federal Data Protection Act) are not met. For all data protection enquiries, please use the email address above.

2. What LaunchAmp does

For a single Product Hunt launch, LaunchAmp generates social media graphics as well as two embeddable widgets which display the real public metrics of that launch: the "Proof Wall" (upvote count, up to three public comments and the aggregated Product Hunt rating) and the compact "Proof Badge" (product name and upvote count). The widgets update these values automatically for 90 days from purchase and thereafter permanently keeps the values last retrieved. The price is a one-time 14 € per launch; there is no subscription.

Understanding this scope explains everything else in this document: we need an account in order to assign your purchased content to you, a payment process in order to collect the purchase price, and access to the public Product Hunt interface in order to fetch the figures shown in the widget. Nothing more happens.

3. Hosting and email delivery

This website, the database and the email mailbox are operated at:

STRATO AG
Otto-Ostrowski-Strasse 7
10249 Berlin
Germany

The servers are located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO AG. Emails sent by LaunchAmp (e.g. replies to support enquiries) are routed via the STRATO mail server smtp.strato.de and therefore likewise via German infrastructure.

As with any web server, our hosting provider records technical access data in server log files when a page is retrieved, including the IP address. These log files are created and administered by STRATO AG; we do not evaluate them and do not combine them with other data. The scope and retention period of these host-side logs are governed by STRATO AG's own information.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website).

4. Data we store ourselves

4.1 Account data

• Email address — to identify your account, for signing in and for messages concerning the purchase.
• Password only as a hash — stored using bcrypt (PHP password_hash()). The plaintext password is never stored at any point and is not known to us.
• Username — generated automatically from the part of your email address before the @ sign plus a random number. You do not enter it yourself.
• Time the account was created.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

4.2 Resetting your password

If you use "Forgot password?" on the sign-in page, we generate a one-time link and email it to the address stored for your account. For this we store, for that link: a cryptographic hash of the token, the account it belongs to, its expiry time and the time it was used.

The token itself — the part in the emailed link — is not stored, only its hash. Anyone reading our database therefore cannot use it to take over an account. The link expires after one hour and works exactly once. Requesting a new one immediately invalidates any earlier link.

The page answers identically whether or not an account exists for the address you enter. This is deliberate: otherwise the form could be used to find out which people hold an account with us.

These records are deleted together with your account (see section 13).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — restoring access to your account) and Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the sign-in process).

4.3 Signing in with Google (optional)

You can alternatively sign in with a Google account. If you do not use this option, no data is transmitted to Google at any point — no Google scripts, fonts or tracking pixels are embedded on our pages.

If you click "Sign in with Google", you are redirected to Google and sign in there. We subsequently receive from Google your email address and the unique Google account identifier (the so-called sub). We store both in your LaunchAmp account so that we recognise you the next time you sign in. We do not store further profile data such as your name or profile picture.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may involve a transfer to Google LLC in the USA. The redirect to Google takes place solely as a result of your express action.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — access to the account); with regard to the third-country transfer, Art. 6(1)(a) GDPR (consent by clicking the sign-in button) in conjunction with Art. 49(1)(a) GDPR. Google's privacy policy: policies.google.com/privacy.

4.4 Launch data

For every launch you create, we store the details you enter or that follow directly from them:

• the Product Hunt URL of your launch that you entered,
• the product name and tagline of the launch,
• an internal short identifier derived from it (slug),
• the contact email address of the launch,
• the address of your own website, if you enter one in the dashboard — it is used solely as the link target behind your product name in the "Recently Featured" list on our homepage, and can be removed there again at any time,
• the public metrics retrieved from Product Hunt: upvote count, aggregated rating and up to three public comments (see clause 6),
• the payment status, the time of purchase and the time of the last update via the Product Hunt interface.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

5. Payment processing via Stripe

For the purchase of a Launch Pass we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When making a purchase you are redirected to a payment page operated by Stripe. You enter your payment details exclusively there. Card numbers, bank details or other payment method data are never transmitted to LaunchAmp and are consequently not stored by us.

In order to create the payment, we transmit to Stripe:

• your email address (as the buyer identifier in the payment process),
• the name of the product and the amount paid,
• internal identifiers for assigning the payment to your launch (the internal launch number, your user number and the slug of the launch).

From Stripe we receive back only the confirmation that the payment was successful. In our database, this confirmation sets the payment status of the launch concerned to "paid" and records the time of purchase. We do not store a Stripe customer number or payment ID.

Stripe belongs to a group of companies headquartered in the USA (Stripe, Inc.), so a transfer to a third country may take place. Stripe bases this transfer on the European Commission's standard contractual clauses and is certified under the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for the third-country transfer, Art. 46(2)(c) GDPR (standard contractual clauses). Stripe's privacy policy: stripe.com/privacy.

Invoices and payment records are kept at Stripe and retained there in accordance with commercial and tax law retention periods.

6. Retrieval of public data from Product Hunt

So that your widget can display real rather than invented figures, LaunchAmp retrieves data via Product Hunt's official GraphQL interface. Important for understanding this:

• This query originates from our server and uses our own developer token. Your visitors' browsers never contact Product Hunt themselves. No website visitor's IP address is therefore transmitted to Product Hunt.
• Only the launch whose Product Hunt URL you yourself provided is queried — never anyone else's data.
• What is retrieved and cached in your record: the upvote count, the aggregated rating and up to three public comments on your launch, each consisting of the publicly displayed name of the commenting person, the comment text and the creation date.
• Retrieval happens at most once per hour and only within the first 90 days after purchase. Afterwards, the values last stored continue to be displayed unchanged.

The comments are content which the persons concerned have themselves published publicly on Product Hunt. We cache them in order to display them in the widget in the same form in which they are publicly visible on Product Hunt.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in accurately presenting publicly available responses to a launch; no non-public data is processed). If, as a commenting person, you do not wish your comment to be displayed via LaunchAmp, an informal message to hello@launchamp.eu is sufficient — we will then remove it from the cache.

7. Prospect list for approaching new customers

For our own customer acquisition we maintain an internal list of recent Product Hunt releases. It stores exclusively publicly available information that Product Hunt's official interface provides about a published product: product name, tagline, Product Hunt URL, the product's own website, the publicly displayed name of the maker, the maker's public Product Hunt profile URL, the maker's public X (Twitter) username, the upvote count and the time of retrieval. No email addresses are collected — Product Hunt's interface deliberately does not expose any, and we do not invent any. This list is visible only to the operator and is not published, not sold and not passed on to third parties.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in approaching potential business customers in a B2B context on the basis of publicly accessible information). You may object to this storage at any time under Art. 21 GDPR; we will then delete the entry concerned without undue delay. An informal message to hello@launchamp.eu is sufficient.

8. Reach measurement without personal reference

We count how often our public pages are called up. This is deliberately built so that no personal data arises. Exactly one row is stored per page view, containing:

What is stored	Example
the path called up, without the query string	/pricing.php
only the host of the referring page, not the full referrer URL	google.com
a coarse device category, not the user agent	mobile or desktop
the time	2026-08-12 09:14:22

What is expressly not stored:

• the IP address — neither in full, nor truncated, nor as a hash. A hash of an IP address remains personal data, because the IPv4 address space is small enough to try out every possible value. We therefore do not store it at all.
• any visitor identifier, session identifier, fingerprint or other characteristic that could link several page views by the same person,
• the full user agent string,
• the full referrer URL (which could contain a search query),
• the query string of the page called up.

There is therefore no way to reconstruct from this data what a particular person did on this website. It is a pure page-view counter, not visitor analytics. No cookie is set for this measurement, and no information on your device is accessed in any other way either. Section 25 TDDDG (formerly TTDSG) therefore does not apply and no consent is required — which is why LaunchAmp shows no cookie banner.

Requests from recognisable search engine crawlers, preview bots and script clients are not stored in the first place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in usage statistics), insofar as one would classify the stored information as personal data at all.

9. Cookies

LaunchAmp uses exactly two cookies, neither for advertising nor analytics purposes:

• Session cookie (PHPSESSID) — technically necessary in order to recognise you after signing in and to protect forms against cross-site request forgery. It is set with the HttpOnly and SameSite=Lax flags, is transmitted exclusively via cookies (not via the URL) and additionally carries the Secure flag on the live website. It is deleted when you close your browser or sign out.
• Operator opt-out cookie (la_notrack) — serves solely to ensure that the operator's own page views are not counted in the statistics described in clause 8. It can only be set from within the password-protected administration area, contains no personal information whatsoever and is never set in the browser of ordinary visitors.

No consent is required, as only strictly necessary cookies within the meaning of Section 25(2) no. 2 TDDDG are used.

10. No third-party services embedded on public pages

• Fonts, stylesheets and JavaScript libraries (including Tailwind CSS and Alpine.js) are served entirely from our own server. No content delivery network is embedded.
• There are no Google Fonts, no analytics tools, no advertising networks, no social media plugins, no tracking pixels and no embedded videos.
• Merely calling up a public page of launchamp.eu therefore creates not a single connection to a third-party server.

11. The embedded widget on our customers' websites

Customers can embed the "Proof Wall" and the "Proof Badge" in their own website. Both are served by the same script, and what follows applies to either. Technically, the browser of the visitors to that site thereby loads a script and data from launchamp.eu. As with any retrieval of a file from a web server, the IP address of those visitors is thereby transmitted to our hosting provider and processed there in its server log files (see clause 3).

In doing so we set no cookie, store no visitor identifier and also create no statistics rows for these requests. The data delivered contains exclusively the public launch information of the customer concerned. The respective website operator is responsible for embedding the widget in their own website and for describing this in their own privacy policy.

12. Recipients of data

• STRATO AG — hosting of the website, the database and the email mailbox (processor, servers in Germany).
• Stripe Payments Europe, Ltd. — payment processing (see clause 5).
• Google Ireland Limited — only if you actively use the sign-in with Google (see clause 4.3).
• Product Hunt, Inc. — receives only our server-side request for the public data of your launch; no data of your website visitors is transmitted (see clause 6).

Beyond this we do not pass on any data. We do not sell personal data and do not use it for automated decision-making or profiling.

13. Retention periods

• Account data: until the account is deleted. You can do this yourself at any time under "Account" in your dashboard, without asking us and without giving a reason. The deletion takes effect immediately and removes the account together with every launch it contains, including paid ones, and any password reset records (clause 4.2). It cannot be undone, and it does not trigger a refund — see the note on payment records below.
• Launch and widget data: for as long as the purchased widget is meant to work. Since the Launch Pass expressly includes permanent access to the frozen values, this data is not deleted automatically. You can delete an individual launch, or your entire account, yourself in the dashboard at any time — the corresponding widget will then cease operating and the graphics will stop being generated.
• Payment records: are kept at Stripe and retained there in accordance with the statutory retention periods (up to 10 years, Section 147 AO, German Fiscal Code).
• Reach measurement rows: contain no personal data (see clause 8) and are retained permanently as pure counter values.
• Prospect list entries: until the purpose ceases to apply, at the latest 24 months after retrieval, or without undue delay following an objection.
• Server log files of the hosting provider: according to STRATO AG's specifications.

14. Your rights

You have the following rights vis-à-vis us:

• right of access to the data stored about you (Art. 15 GDPR)
• right to rectification of inaccurate data (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing that we base on a legitimate interest (Art. 21 GDPR) — this concerns clauses 7 and 8 in particular
• right to withdraw a consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to hello@launchamp.eu is sufficient to exercise these rights. We reply within the statutory period of one month.

You do not have to wait for us in order to exercise your right to erasure (Art. 17 GDPR): under "Account" in your dashboard you can delete your account and all launches in it yourself, taking effect immediately. The same section lets you change your password. What we cannot delete on request are the payment records held at Stripe, which are subject to the statutory retention periods stated in clause 13.

Independently of this, you have a right to lodge a complaint with a data protection supervisory authority. The authority responsible for our place of business is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
(State Commissioner for Data Protection of Lower Saxony)
Prinzenstrasse 5
30159 Hannover
Germany

15. Data security

• Transmission between your browser and our servers is encrypted via SSL/TLS.
• Passwords are stored exclusively as a bcrypt hash, never in plaintext.
• All database access uses prepared statements and is bound to the respective session.
• Forms in the administration area are protected against cross-site request forgery; payment notifications from Stripe are cryptographically signature-verified before they unlock a purchase.
• Operator accounts are completely separate from customer accounts and live in their own table.

16. Changes to this privacy policy

We adapt this policy when the scope of LaunchAmp's functionality or the legal requirements change. The current version is always available at launchamp.eu/legal/datenschutz. The version published at the time of your visit is the authoritative one.