Privacy policy
Draft pending legal review. This document is a working draft and will be reviewed by qualified counsel before public launch. The exact language may change; the principles will not.
Introduction
Fairly (“Fairly,” “we,” “us”) operates a consent-first consumer data marketplace at https://www.joinfairly.com. This privacy policy explains what personal information we collect, why we collect it, how we protect it, and your rights to access, download, and delete it. Fairly is currently in an invite-only beta. We have written this policy in plain language. If anything is unclear, email [email protected].
What we collect
The categories below are the maximum we can collect — what we actually hold for you depends on which consent toggles you have turned on.
- Account data. Email, password hash, display name, country, region, timezone, account-creation date.
- Phone number. Verifying a phone number is required before you can cash out or join a paid research session. We keep only the last 4 digits and a scrambled code made from your number — never the number itself. If you delete your account, the last 4 digits are deleted with it; the scrambled code is kept, with your name removed, so the number can't be used to verify a new account. Your number is used only to send you a verification code by text message. To send that text, we pass the number to Twilio, our text-message provider; apart from that we never share it, we never sell it, and we never use it for marketing or any other messaging.
- Profile data — standard categories. The demographic, financial and lifestyle answers you give (your city and state are demographic answers — we never collect your precise location from them), and your purchases (see “Receipts and invoices” below). Each category has its own toggle and its own consent record.
- Profile data — sensitive categories. Race / ethnicity, religion, political affiliation, sexual orientation, gender identity, health conditions, detailed financial. Kept in a separate table from the rest of your profile. Sensitive details are only used to match you when you've turned on sharing for that category. Advertisers never see your individual answers, and access to them is logged.
- Wallet activity. Credits, debits, cash-out requests, the PayPal email address you cash out to, and PayPal's reference for each payment.
- Receipts and invoices. When you upload a receipt or invoice, we read it and keep the store or vendor, the date, the amounts, the items, and any name or billing address printed on it, plus two one-way fingerprints of the image used to spot the same document being uploaded twice. We do not keep the image itself. To read it, the image is sent to Anthropic's AI model; to check it hasn't been copied from the web, it is sent to Google Cloud Vision. We compare new uploads with receipts already on Fairly, including other members', to catch duplicates.
- Surveys and research sessions. Your survey answers, and your invitations to and participation in research sessions.
- Estimates about you. We estimate some things about you from your purchases and answers — for example, that you probably have a pet. You can see these in your profile on the website and tell us when one is wrong.
- Browser extension. The Fairly browser extension isn't available yet. This policy will describe what it collects before it launches.
- Email-derived purchase data. Not currently offered to new members. If you connected Gmail or Outlook, the structured details of order confirmation emails — store, order number, date, amounts, items. The emails themselves are never stored. See Connecting your email.
Connecting your email
Connecting your email is not currently offered to new members. This section describes how it works for members who connected an inbox before it was paused.
Fairly can read order confirmation emails from your inbox so your purchases count toward your profile and earnings without you photographing a receipt. This is entirely optional. Fairly works without it, and you can disconnect at any time.
What you are agreeing to
When you connect Gmail, Google asks you to approve read-only access to your mail. When you connect Outlook, Microsoft asks the same. Fairly requests the narrowest access that lets it read a message:
- Gmail.
gmail.readonly— read your email messages and settings. - Outlook.
Mail.Read— read your mail.
Fairly cannot send, delete, or change any email, and never asks for permission to do so.
What this means: the permission Google and Microsoft grant covers your whole mailbox, because neither company offers a permission limited to “just receipts.” What limits Fairly is not the permission — it is what Fairly actually asks for, described next.
What Fairly actually reads
Fairly does not scan your mailbox. It runs a specific search and only opens the messages that search returns:
- Messages received in the last 6 months when you first connect, and in the last 7 days on each sync after that.
- Messages whose subject line looks like an order — for example “order confirmation,” “your order,” “shipping confirmation,” “thank you for your order.”
- Messages your mail provider has not classified as promotional or social.
Everything else in your mailbox is never requested and never opened. Personal correspondence, work email, and anything that does not match that search stay untouched.
What Fairly keeps
Fairly opens a matching message, reads it, and keeps only the structured facts about the purchase: the store name and sender address, the subject line, the order number, the purchase date, the amounts (subtotal, tax, shipping, total), the items on the order where the email lists them, and a score for how confidently the email was read.
Fairly does not keep the email itself. The message body is held in memory only long enough to read those fields, then discarded. It is never written to disk, never stored in a database, and cannot be retrieved later — not by you, not by Fairly staff, not in response to a support request. Attachments are never downloaded.
Reading the email
Most order emails are read by pattern matching that runs entirely on Fairly's own servers.
When Fairly does not recognize a store's email format, the text of that message is sent to Anthropic, which provides the AI model Fairly uses, so the purchase details can be extracted. Only the message text is sent — up to roughly the first 10,000 characters — along with the subject and sender. Anthropic processes it to return the purchase fields. Fairly keeps only the extracted fields; Anthropic is not given your name, your Fairly account, or any other profile data.
What Fairly never does with your email
- We never show your emails, or any individual detail from them, to advertisers.
- We never sell email data, and never transfer it to a data broker, information reseller, or advertising network.
- We never use email content to build advertising profiles outside the consent categories you have turned on.
- We never use email content to train AI models.
- No human at Fairly reads your email — access is limited to what the automated parsing requires.
Turning it off, and what happens then
You can disconnect at any time in the Email section of your settings. When you disconnect, Fairly cancels its access with Google or Microsoft, erases its access tokens immediately, and deletes the order details it read from your emails. The copies of those purchases in your purchase history stay until you turn off the Email Receipts category or delete your account. Credits you already earned stay in your wallet.
You can also revoke Fairly's access directly from your Google Account or your Microsoft account. Revoking there stops all future access; turn off the Email Receipts category in Fairly as well if you also want the purchases imported from your emails deleted.
Deleting your Fairly account removes this data on the same 7-day schedule as the rest of your account, described under “Data retention and deletion” below.
Google Limited Use
Fairly's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use it
- To match you with surveys, research sessions and offers that brands run inside Fairly, using only the categories you have turned on. Brands see how many people match, never who.
- Sensitive categories are used only to invite you to surveys and research sessions — never to show you offers.
- Some estimates are built from what you buy — for example, whether you may have children at home. Because an estimate like that could reveal something private, such as a pregnancy or a new baby, we don't use it to choose which offers you see unless you have confirmed it yourself. We may still use it to invite you to surveys and research sessions. When an invitation's audience includes parenthood, the email or notification we send won't say who it's from or what it's about.
- To make the estimates about you described above.
- To compute earnings and cash-outs, and to work out how the annual charity pool is divided across the causes users pick.
- To detect abuse and protect the integrity of the wallet and consent system.
- To send transactional emails (verification, security alerts, payout confirmations).
Marketing emails are sent only with explicit opt-in (see Notifications in your settings) and can be revoked at any time.
What we never do
- We do not sell raw user data to anyone. Period.
- We do not give advertisers your name, email address, phone number or profile. When you answer an advertiser’s survey, they receive your answers without your name or contact details. If you join a research session, the advertiser will see and hear you on the call they host.
- We do not collect data from anyone under 18 (Fairly is 18+ only).
How we protect it
- Encryption in transit and at rest. All traffic is TLS; the database is encrypted at rest by the underlying managed Postgres provider.
- Closed database. Only Fairly's servers and authorized Fairly staff can read or write the database; its public interface grants no access to any table.
- Sensitive-data isolation. Sensitive answers are kept in their own table, apart from the rest of your profile, and access to them is logged.
- Append-only audit logs. Consent records and wallet transactions are append-only — a revoke is a new row, not an update. This means we (and a future auditor) can reconstruct exactly what you authorized at any moment in time.
Your rights
- Access & download. In your account settings, choose Download your data to get a file of everything Fairly holds about you.
- Withdraw consent. Turn a category off in your profile (Profile on the web, Data sharing in the app). Withdrawal is effective immediately: the answers you gave for that category are deleted, estimates based on it stop being used (except ones you confirmed yourself, which stay until you change them), and you are removed from related audience segments within 24 hours. Receipts and invoices you already uploaded stay until you delete your account (see Data retention).
- Delete your account. In your account settings, choose Delete your account to schedule a permanent deletion in 7 days. During the grace window you can sign back in to cancel or to cash out. Deleting your account permanently removes everything tied to it — your profile, data-sharing choices and their history, wallet and cash-out history, receipts, survey answers and sign-in — 7 days after you ask. We keep only a scrambled code made from your phone number and any PayPal address you cashed out to, with your name removed, so they can't be used on a new account. Any balance left when deletion completes, including pending money, is lost.
- California residents (CPRA). You have additional rights including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing of personal information. We do not sell personal information; the opt-out of sharing is available via the consent toggles described above. To be explicit about what those toggles cover: they govern the profile data used to build audience segments. Your phone number is not part of that. It is never sold, it is shared only with Twilio to deliver your verification text, there is no toggle that exposes it, and the only thing it is ever used for is sending you a verification code.
Third parties
Fairly relies on a small set of service providers: Supabase (managed Postgres + authentication), Railway (runs our servers, which keep request logs), Vercel (hosts our website), Cloudflare (our domain's DNS and the address our email links pass through), SendGrid (email), Google Workspace (our own email, including privacy requests you send us), Apple (push notifications on iPhone and our TestFlight beta), Twilio (verification text messages), PayPal (payouts), Stripe (advertiser billing), Anthropic (the AI model that reads receipt and invoice images and order-email text — see Connecting your email), Google Cloud Vision (checks whether a receipt or invoice image has been copied from the web), Sentry (error monitoring on the website and in the app), Expo (app updates and push notifications for the mobile app), Google reCAPTCHA (spam protection on the contact form), and PostHog (product analytics inside your account on the website — no name, email or IP address). Each only receives the minimum necessary data for its role. Anthropic also runs the optional check-in chat. When you use it, your messages are sent to Anthropic's model along with your first name and a short summary of your profile (for example your age range, state and hobbies), so the conversation is relevant to you. Nothing from a conversation is added to your profile until you review and apply it. Your conversation is stored encrypted and deleted within 6 months. Suggestions you don't apply are deleted within 7 days (24 hours for an unfinished chat, or at the end of the month for an unfinished check-in). To make the estimates described above, Anthropic's model is also given a summary of your recent purchases — the kinds of stores, your most-visited stores, and your average monthly spending — without your name or contact details. Apart from Supabase, which hosts our database, and what is described in this section, no provider receives your profile data. Anthropic does not use what we send it to train its models. Its privacy center says: “By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models” (Anthropic Privacy Center).
Emails we send
Our emails are delivered by SendGrid. They contain a tiny image that tells us when an email is opened, and the links in most of them pass through a tracking address so we know when a link is clicked. We use this to see whether our emails arrive and whether they are useful. Emails that carry a one-time link, such as the one that verifies your email address, and our account-deletion notices are sent without link tracking. SendGrid keeps this activity for a limited time under its own policies. To stop open tracking, turn off automatic image loading in your email app.
Which email brought you here
Links to our website in our emails also carry a short tag naming the email they came from. Your browser keeps that tag for a day. If you then sign in, complete a survey or accept a research session on the website, we record which email led you there, so we can tell which emails are useful. We don't record it if you've turned analytics off in your account settings. We keep this record for 90 days, delete it with your account, and include it in Download my data.
Data retention and deletion
We keep your data while your account is open. Turning a category off deletes the answers you gave for it right away. Receipts and invoices you uploaded, your wallet history and your consent history are kept while your account is open. Receipt and invoice images are never kept. Account deletion has a 7-day window in which you can change your mind. Deleting your account permanently removes everything tied to it — your profile, data-sharing choices and their history, wallet and cash-out history, receipts, survey answers and sign-in — 7 days after you ask. We keep only a scrambled code made from your phone number and any PayPal address you cashed out to, with your name removed, so they can't be used on a new account. Any balance left when deletion completes, including pending money, is lost.
Deleted data can remain in our encrypted database backups for up to 7 days. The IP address and browser details recorded when you sign in are kept for 90 days, and security records, such as failed sign-in attempts, for one year.
Purchases imported from a connected inbox are deleted when you turn off the Email Receipts category. Order emails themselves are never stored at all. See Connecting your email.
Children's privacy
Fairly is for adults — accounts are gated by an 18+ verification step during onboarding, and we do not knowingly collect data from anyone under 18. If you believe a minor has created a Fairly account, please contact us so we can investigate and delete.
Changes to this policy
We will email every account holder at least 14 days before a material change to this policy takes effect. The email says what is changing and the date it takes effect, and until then this page links to the new version. If you create your account after a change is announced, we email you about it right away. When it takes effect, we will ask you to review and accept it the next time you use Fairly.
Changes that aren't material — for example, fixing a typo or making a sentence clearer without changing what we do with your data — take effect when we post them, without an email. The date at the top of this page shows when the version you are reading took effect.
Contact
Privacy questions, and requests to access, download, correct, or delete your data: [email protected]. For anything else, [email protected]. We respond within five business days.
You can also use our contact form, which reaches the same inboxes. The addresses above always work on their own.