The Bason
The Bason

Privacy Policy

Effective: September 29, 2026

1. Information we collect

  • Account data: Google OAuth identifier, email, name, and profile image.
  • Service data: posts, drafts, schedules, settings, and credit transaction records.
  • Integration data: optional Notion token, Slack webhook URL, and custom domain settings.
  • Payment data: Lemon Squeezy order, product, and payment-status identifiers. The Bason does not store card numbers.
  • Technical data: access time, IP and device/browser information, error logs, and security logs.

2. Purposes and legal bases

  • To perform the service contract: authentication, content generation and publishing, billing, and support.
  • For legitimate interests: abuse prevention, diagnostics, security, and service reliability.
  • For legitimate interests: Google Analytics, Vercel Analytics, and Microsoft Clarity to improve the service and measure advertising performance.

3. Service providers

  • We use Supabase (auth, database, storage), Vercel (hosting and optional analytics), Google (OAuth and optional Analytics), Sentry (error and performance diagnostics; signed-in user identifiers and IP addresses are recorded, session replay is not collected), Anthropic (AI writing), Google Gemini (AI images and OCR), Lemon Squeezy (Merchant of Record and payment processing), and user-connected Notion or Slack services.
  • Providers process data only as needed to deliver their services. Data may be processed internationally depending on provider infrastructure.

4. Analytics and cookies

  • Essential authentication cookies support login and security. A first-visit banner tells you which analytics tools we use; it is a notice and does not turn measurement on or off.
  • Google Analytics uses cookies to identify visits and measure product usage and advertising performance, Vercel Analytics collects visit and performance statistics, and Microsoft Clarity records screen interactions such as clicks and scrolls to provide session replay and heatmaps. All three run on every visit.
  • Analytics data is used only to improve the service and measure advertising performance, and is never sold to third parties.
  • Whether you dismissed the banner is stored for 180 days in the bason_analytics_consent cookie and is used only to avoid showing the banner again. Delete that cookie in your browser and the banner reappears.
  • If you prefer not to be measured at all, you can use your browser tracking protection or a Google Analytics opt-out add-on, or email [email protected] to request that we stop processing your data.

5. Retention and deletion

  • Account data is retained while you use the Service. Deleting your account in Settings removes the auth account, posts, drafts, settings, and stored integration data.
  • Payment records required by law, security logs, and provider backups may remain for the limited period required by law or provider retention cycles.

6. Your rights

  • You can update your profile, delete posts, disconnect integrations, and delete your account in Settings.
  • Request access, correction, deletion, restriction, or privacy support at [email protected].

7. Browser extension (The Bason — SNS post performance)

  • The extension shows post performance on Threads (threads.com, threads.net), X (x.com, twitter.com) and Reddit (reddit.com), and on thebason.com it only marks that the extension is installed. It does nothing on any other site.
  • The metrics shown in your feed are read from pages and responses those sites have already delivered to your own browser. There is no crawling and no automated interaction with the sites, and outside the two cases below, those values are used only to render the on-screen chip and are not transmitted.
  • Post information is sent to your The Bason account in two cases. (1) You press "Collect" on a post. (2) The tab is a Threads search results tab that you opened from the search button in The Bason — on that tab, up to 30 public posts shown on screen are sent automatically. Nothing is sent automatically on pages you open yourself or in your normal feed. What is sent: the post identifier and URL, the author handle and identifier, the post text (the title on Reddit), view count, like, upvote, reply and repost counts, the author follower count (Threads), the computed performance grade, and — if you collected it from a search results page — that search term.
  • On Coupang (coupang.com) search results pages, product information is sent to your The Bason account in two cases. (1) You press the "Save these products to The Bason" button on the page. (2) The tab is a Coupang search results tab that you opened with "Collect on Coupang" in The Bason — on that tab, up to 40 products shown on screen are sent automatically. On Coupang pages you open yourself, nothing is sent until you press the button. What is sent: the product number, product name, sale price, product image URL, star rating, review count, whether it is an ad listing, and the search term. The extension does not access your Coupang credentials, orders, cart or recently viewed items.
  • The extension stores your The Bason connection token and server address in browser sync storage. It does not store your browsing history or any post that was not sent.
  • Collected posts are visible only to you and are deleted when you delete your account. To delete individual collected posts, email [email protected].
  • The extension never accesses your Threads, X or Reddit credentials, and never posts, follows or reacts on your behalf.

8. Social account connection and autopilot

  • When you connect a Threads or Instagram account we store the access token issued by Meta, the account identifiers and the username. Tokens are stored encrypted and used only to publish posts you scheduled or enabled autopilot for.
  • When autopilot is on we use the Coupang Partners API keys you entered (the secret key is stored encrypted) to look up products and create your own affiliate links. Product names, prices and image URLs are used only to write posts and keep the publishing history.
  • Bluesky accounts are connected with an app password that you create in Bluesky settings. Account passwords are not accepted. The app password is stored encrypted and used only to publish the posts you send. It stops working once you disconnect the account or delete that app password in Bluesky settings.
  • We use Anthropic to write posts, Upstash (QStash) to run schedules, and the Meta (Threads, Instagram) APIs and the Bluesky API to publish.
  • If you remove The Bason app in Threads or Instagram we delete the stored token immediately, and if you request data deletion through Meta we delete the connection, publishing history and autopilot settings. You can also disconnect at any time on the account connection page in Settings.

9. Security and contact

  • We use encrypted transport, access controls, row-level security, request limits, and upload validation. No system is perfectly secure; incidents will be handled under applicable law.
  • Privacy contact: [email protected]
Contact support