Privacy Policy

This Privacy Policy explains how Hypothesis Lab (“we”, “us”) collects, uses, and shares information when you use Hypothesis Lab (the “Service”).

1. Information we collect

When you sign in with Google, we receive your name, email address, profile image, and a unique identifier from the OAuth provider. We do not receive your password.

When you use the Service, we store:

• The hypotheses, claims, pre-mortems, and resolution notes you create.
• Your team membership, role (PM, Head of Product, Reviewer), and invite history.
• Standard server logs (IP address, user agent, request timestamps) for security and abuse prevention.

2. How we use information

We use the information we collect to:

• Operate and maintain the Service.
• Authenticate you and route you to the correct team and dashboard.
• Send transactional notifications you have not opted out of.
• Investigate and prevent abuse, fraud, and security incidents.

3. Hypotheses marked private

Hypotheses you mark as private are visible only to you and are permanently excluded from team dashboards and the learning library. We will never expose private hypotheses through any team-level view, export, or API surface.

4. Sharing of information

We share information only:

• With service providers who host or operate the Service on our behalf (hosting, database, email).
• When required by law, valid legal process, or to protect rights, safety, or property.
• In connection with a merger, acquisition, or sale of assets, where the acquiring party agrees to honor this Policy.

5. International data transfers

We process and store data using our hosting providers Vercel and Neon, both based in the United States. If you are located outside the United States, your data is transferred to and stored in a country that may not provide the same level of data protection as your country.

6. Data retention

We retain your account data for as long as your account is active. You can delete your account at any time from the team management page; deletion is immediate and irreversible. Your hypotheses, comments, and team memberships are removed in the same operation, except where retention is required by law or to resolve disputes.

7. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data. You can delete your account and all associated data at any time from the team management page. For any other request, reach us via our contact form.

8. Cookies

We use a small number of essential cookies to keep you signed in and to protect against forgery (CSRF) attacks. We do not use advertising cookies or third-party trackers.

9. Children

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to this Policy

We may update this Policy from time to time. We will indicate the date of the most recent revision at the top of this page.

11. Contact

Questions about this Policy: please use our contact form.