DeadlineFox is a platform that makes it easy to create deadlines for marketing
campaigns and display them as countdown timers in emails and on web pages. We are
committed to protecting your privacy, and this policy explains how we collect and
process personal information about you when you visit our website (deadlinefox.com),
when you use our products and services (our "Services"), or when you otherwise do
business or contact us. Please read this policy carefully to understand how we
handle your personal information.
If you have a question about anything here, write to
support@deadlinefox.com.
1. Who this policy covers
DeadlineFox handles personal data in two different roles. Please read the part that
applies to you.
-
Customers. People who create a DeadlineFox account and run
campaigns. For customer data we are the controller: we decide what is collected
and why, and this policy governs it directly.
-
Contacts. People who receive a customer's emails or visit a
customer's website and are shown a deadline. For contact data we are a processor
acting on that customer's instructions. The customer is the controller, their own
privacy policy governs the relationship, and requests about that data should be
directed to them.
2. What we collect from customers
| Data | Why we hold it |
|---|
| Name and email address | To create and sign you in to your account, and to send service email such as password resets and payment receipts. |
| Password credentials | Handled by our authentication provider. We never see or store your password. |
| Plan and subscription status | To give you the features you paid for and enforce plan limits. |
| Stripe customer reference | To connect your account to your payments. Card numbers are handled by Stripe and never reach our servers. |
| Administrative records | A log of administrative actions taken on accounts, kept for security and accountability. |
| Usage records | How many visitors your campaigns serve each month, and which website domains load your timer script, to apply plan limits and protect the service. |
| Support messages | What you send through our contact form or by email, including any screenshots, so we can answer you. |
3. What we do not collect
We do not:
- store the email addresses of our customers' contacts (see section 4);
- use advertising trackers, or share data with advertising networks;
- track people across websites that are unrelated to the campaign they entered;
- sell personal data, or share it for cross-context behavioral advertising, under
any definition of those terms.
4. What we hold about contacts
When a customer runs a campaign, each contact has a deadline and therefore needs to
be identified if they return later. We do this while holding as little as possible.
| Data | What it actually is |
|---|
| Identifier hash | An irreversible keyed hash (HMAC) of the contact's email address or email-platform contact ID. The original value is never written to our database, and the hash cannot be reversed to recover it. |
| Visitor token | A random identifier stored in a cookie so a returning visitor can be shown the correct deadline. |
| Deadline and timestamps | When the contact entered the campaign, their original and current deadline, any extension, and the time of a conversion if one is tracked. |
Because only a hash is stored, we cannot reproduce a list of a customer's contacts,
and neither can the customer.
IP addresses. Our servers see the IP address of anyone who loads a
timer, follows a tracked link, or visits our website. We use it only to protect the
service from attacks and spot problems, such as unusual traffic or a misconfigured
link, and the records we keep for that expire automatically within two days. If an
address sends unusual traffic, we may receive a security alert that includes it. We
do not store IP addresses in our database. Our hosting provider also keeps standard
server logs for a limited period.
5. Cookies
DeadlineFox sets a small number of cookies. None of them are advertising cookies.
Our own website, deadlinefox.com, also measures how it is used with Vercel Web Analytics.
It counts page views and button clicks without setting cookies and without identifying
individual visitors.
| Cookie | Purpose | Lifetime |
|---|
ec: campaign id | Holds the visitor's deadline, its status, and their visitor token. | Until cleared |
ec_pass, ec_fp, ec_fpu | Remember a visitor's Flash Pass and related offer state for a campaign. | Until cleared |
ec_last | Remembers the most recent campaign this browser viewed, used by customers' test links. | Until cleared |
| Sign-in cookies | Keep a signed-in customer signed in. Account holders only. | Up to 400 days |
| Dashboard preferences | Remembers a signed-in customer's dashboard choices. Account holders only. | Until cleared |
dfx_attr | On deadlinefox.com only: remembers which link or page brought a visitor to our site. Never shared with advertising networks. | Until cleared |
| Stripe cookies | Set by Stripe on our payment form to help prevent fraud. | Set by Stripe |
6. Who we share data with
We use a small number of service providers to run DeadlineFox. Each one processes
data only to provide its service to us. We do not sell data to anyone.
| Provider | What it does for us |
|---|
| Supabase | Database and account authentication |
| Vercel | Application hosting, content delivery, and cookieless analytics of our own website |
| Upstash | Caching and background job queueing |
| Stripe | Payment processing |
| Resend | Sending account, transactional, and support emails |
| SnapRender | Generating preview images of campaign pages |
| ImprovMX | Forwarding email sent to our support address |
| Google | Email hosting for our support inbox |
We may also disclose data where the law requires it, or to establish or defend legal
claims. If the business is ever sold or reorganized, data may transfer as part of
that, and this policy will continue to apply to it.
7. Where data is stored
Data is stored with the providers listed above, in the United States (AWS region
us-east-1, Northern Virginia). Some of our providers operate globally, so data may be
processed in other countries.
8. How long we keep it
- Account data is kept while your account is open, and for a
reasonable period afterwards to meet tax, accounting, and legal obligations.
- Campaign and contact data is kept while the campaign it belongs
to exists. Deleting a campaign removes it.
- Cached deadline state expires automatically, shortly after the
deadline it describes has passed.
9. Your rights
You have rights to access, correct, delete, or object to our use of your personal
data, and to withdraw consent where we rely on it. To make a request, write to
support@deadlinefox.com.
-
Erasing a contact. Customers can erase a contact from the app.
Doing so removes the contact record and permanently strips the identity from the
associated campaign entries.
-
Closing an account. Account closure is handled by us on request
rather than by a button in the app. Write to us and we will confirm when it is
done.
10. The law that governs us
We are based in New Zealand, which makes us an "agency" under the Privacy Act 2020.
That Act governs how we handle personal information no matter where you are, and it
sits alongside, rather than instead of, the rights described above.
We handle personal information in line with the information privacy principles in
that Act. Where we disclose personal information to a provider outside New Zealand,
we do so on the basis that the provider is subject to comparable safeguards, which is
what principle 12 requires. The providers we use are listed in section 6, and all of
them operate outside New Zealand.
11. Complaints
If you think we have handled your data badly, please tell us first so we can put it
right. You can also complain to a regulator. In New Zealand that is the Office of the
Privacy Commissioner. If you are elsewhere, you can complain to your local data
protection regulator.
12. Security
Data is transmitted over encrypted connections. If you connect an email platform, its
API key is encrypted before it is stored and is never returned to the browser. Contact
identifiers are stored only as keyed hashes. The deadline cookie is signed and
encrypted, and is not readable by scripts running on the page.
13. Children
DeadlineFox is a business tool and is not directed at children. We do not knowingly
collect personal data from anyone under 16. If you believe we have, contact us and
we will delete it.
14. Changes to this policy
We may update this policy as the product changes. The date at the top always shows
the current version, and if a change materially affects customers we will tell them
by email rather than relying on them noticing.