What we hold, and what we do with it.

Two different people are covered here

Almost every privacy policy is written for one audience. This one has two, and they are owed different things.

Founders are people who connect a repo and buy a test. They chose to be here and have an account with us.

Visitors are people who saw an ad, clicked it, read a landing page we host, and possibly left an email address. They never chose us and in most cases have never heard of us. Everything below that concerns them is written on the assumption that they did not sign up for this.

Who we are

go/no-go is operated by [legal entity name], at [registered address]. We are the data controller for everything described here.

For anything in this policy, including a request to see or delete your data, write to privacy@gonogotest.com.

If you are a founder

What we collect

• Your GitHub identity. Your numeric id, username, display name and avatar URL, from signing in with GitHub.
• Read access to the repos you pick. Through a GitHub App you install and can uninstall. We read source files to work out what you built and who might pay for it. We never write to your repo: no pull request, no commit, no branch.
• What you tell us. The audiences you keep or switch off, the budget you choose, and anything you type into the app.
• Payment records. What you paid and when. Card details go to Stripe and never reach us.

Why, and on what basis

To perform the contract you entered into when you bought a test. Reading your code, writing the pages, buying the media and returning a verdict is the service; we cannot do it without this data. Payment records we keep because tax law requires it.

Your code

Source we read is sent to Anthropic’s API to be analysed and to write ad and page copy. It is not used to train anyone’s model. We keep the conclusions — what the product is, who might pay for it — rather than the files, and we do not keep a copy of your repository.

If you left an email on one of our pages

You reached a page at gonogotest.com/apps/… after clicking an ad. That page was built by us to test whether a particular product is worth building. It is not the product itself.

What we collect

• Your email address, and anything else the form asked for, as you typed it.
• Google’s click identifier (a gclid), if you arrived from a Google ad. It identifies the ad click, not you.
• What you did on the page. How many seconds it was actually in front of you, how far down you got, which sections you read, and whether you pressed the button. This is tied to a random reference generated for that one visit.

What we deliberately do not collect

• No cookies are set on these pages, and nothing here reads one. Our own marketing site and the app founders sign in to do use Google Analytics; it is switched off on these pages deliberately, because this is where strangers who never chose us end up.
• No device fingerprint, and no advertising or analytics pixel.
• No name, no company, no profile bought from anywhere, and nothing that links your visit to any other visit.
• Our application does not record your IP address. Our hosting provider’s request logs do, briefly, as every web server’s do.
• Your browser’s user-agent string is read once, to work out whether a visit came from a bot rather than a person. It is not stored — only the yes-or-no answer is.

Why, and on what basis

Your email is passed to the founder whose product the page was testing, so they can contact you about it. That is what the form was for and it is said on the page. Where consent is the right basis for this, submitting the form is that consent, and you can withdraw it at any time by writing to us.

The behaviour measurements exist to tell a founder which argument landed. They are our legitimate interest in knowing whether an ad campaign worked, and they are collected in a form that cannot be traced back to a person.

Cookies

There is exactly one, and only founders get it: gng_session, set after you sign in with GitHub. It is encrypted, unreadable by JavaScript, and expires after seven days. It exists to keep you signed in and does nothing else.

We run no analytics product, no advertising cookies, and no third-party tags on any page we serve.

Who else sees it

Only these, and only for what is listed:

• The founder whose test you responded to — your email address, so they can get in touch.
• GitHub — sign-in and repo access.
• Anthropic — source code and product description, for analysis and copywriting.
• Google Ads and Meta — we run the campaigns on our own accounts. They see the ads and the clicks. We do not send them your email address.
• Stripe — founder payments.
• Google Cloud — hosting and database, in the United States.

We do not sell personal information for money, and never have. If go/no-go is ever sold or merged, whoever buys it inherits this policy until they publish a replacement.

California: selling and sharing

Under California law, “sharing” covers passing data to an ad platform for cross-context behavioural advertising even when no money changes hands. Reporting an ad click back to Google as a conversion can count.

To opt out, write to privacy@gonogotest.com with the email address you used. We will stop, and it costs you nothing else — we do not charge different prices or withhold anything from people who opt out.

How long we keep it

• Leads and visit measurements — for the life of the test and twelve months after it ends, then deleted.
• Founder accounts — until you close the account, then thirty days.
• Payment records — as long as tax law requires, currently seven years.
• Source code — not retained. Only the conclusions drawn from it are.

Where it is processed

In the United States. If you are in the UK or the EEA, that is a transfer out of your region, and it is made under the UK IDTA and the European Commission’s standard contractual clauses with each provider named above.

Your rights

Wherever you are, you can ask us for a copy of what we hold on you, ask us to correct it, ask us to delete it, or tell us to stop. In the UK and EEA you can also object to processing, ask for it to be restricted, and ask for your data in a portable form. In California and the other US states with these laws, you can ask what we collected and who got it, and appeal if we refuse.

Write to privacy@gonogotest.com. We answer within thirty days, or forty-five where the law allows longer and the request is complicated. We will not charge you and we will not make you create an account to ask.

If we get it wrong, you can complain to your data protection regulator. In the UK that is the Information Commissioner’s Office.

Children

go/no-go is for people building software commercially. It is not for anyone under 16, and we do not knowingly collect anything from them. Tell us if we have, and it goes.

Changes

The date at the top is the date this version took effect. If a change actually affects you — new recipients, a new purpose — founders get an email before it takes effect, not a silent edit.