punch

Privacy Policy

Last updated: March 10, 2026

1. Who We Are

Punch is operated by CF Innovation Labs ("we", "us", "our"). We are committed to protecting your privacy and handling your data transparently.

Data Type	Purpose	Retention
Email address	Account authentication, notifications	Until account deletion
Name, company name	Account personalization	Until account deletion
WhatsApp number (optional)	Approval notifications	Until account deletion
Social media OAuth tokens	Publishing content on your behalf	Encrypted; until disconnected
Generated content	Queue management and publishing	Until account deletion
Payment info	Processed by Lemon Squeezy (we never see card numbers)	Per Lemon Squeezy's policy
Usage data (credits used)	Billing and service delivery	Until account deletion

To provide and operate the Service (content generation, scheduling, publishing).
To authenticate you and secure your account.
To process payments via our Merchant of Record (Lemon Squeezy).
To send service-related notifications (approval requests, account updates).
To improve the Service based on aggregate usage patterns.

We do NOT sell your data, use it for advertising, or share it with third parties for marketing purposes.

We use the following third-party services:

Firebase (Google) — Authentication. Privacy Policy
Google Gemini — AI content and image generation. Your prompts are sent to Google's API.
Lemon Squeezy — Payment processing. Privacy Policy
Vercel — Hosting. Privacy Policy
Turso — Database hosting. Privacy Policy
Meta, LinkedIn, Twitter/X — Social media publishing (only when you connect your accounts).

All data is transmitted over HTTPS (TLS encryption).
Social media credentials are encrypted at rest using Fernet symmetric encryption.
Authentication is handled by Firebase with industry-standard security.
We follow the principle of least privilege for data access.

If you are in the EU/EEA, you have the following rights:

Access — Request a copy of your data (use the "Export Data" feature in Settings).
Rectification — Update your data via your Profile.
Erasure — Delete your account and all associated data (use "Delete Account" in Settings).
Portability — Export your data in JSON format.
Objection — Contact us to object to specific data processing.

To exercise any right, email us at hello@cfinnovationlabs.com or use the self-service options in your account settings.

We use the following cookies:

punch_token — Session authentication cookie. Essential for the Service to function. Expires when you log out.

We do NOT use tracking cookies, analytics cookies, or advertising cookies.

We retain your data for as long as your account is active. When you delete your account:

The Service is not intended for children under 18. We do not knowingly collect data from minors.

We may update this policy from time to time. Material changes will be communicated via email to registered users.

For privacy-related questions or concerns:
Email: hello@cfinnovationlabs.com
CF Innovation Labs