Privacy Policy | Ensoul Lab

Who we are

Ensoul Lab makes browser extensions and apps, including Creel, and runs ensoullab.com. This policy covers the website, your Ensoul Lab account and the extensions we publish. A product that has its own privacy policy is covered by that policy instead; currently that is Pet Day, under the Pet Day Privacy Policy. If you have a question, write to support@ensoullab.com.

Your Ensoul Lab account

When you create an account we store:

Your email address and name, and your profile picture if you sign in with Google.
A hashed password if you sign up with email and password. We never store the password itself.
Sign-in sessions, with the IP address and browser of each session, so we can keep you signed in and protect your account.
Your purchases and licences: which product and plan you bought, when, and whether it was refunded.

We use this to sign you in, deliver what you bought, answer support requests and keep the service secure. New accounts are added to our product newsletter. Every newsletter has an unsubscribe link, and you can also ask us to remove you.

Payments

Payments are processed by Stripe, which acts as the merchant of record for your purchase. Stripe collects your card or other payment details, handles tax, and sends you the receipt. Ensoul Lab never sees or stores your card number. Stripe tells us the result of the payment so we can unlock your licence. Stripe's own privacy policy covers the data it processes.

Extensions, including Creel

Our extensions do their work in your browser.

Your X data stays in your browser. Creel collects posts, bookmarks, likes, followers and other data from the X session you are already signed into. Those records, your settings, and the files you export are kept in your browser and saved to your own computer. They are never sent to Ensoul Lab.
What the extension stores for your account. When you connect Creel to your Ensoul Lab account, the extension keeps an account token, your email and name, your plan, and when it last checked your licence, in your browser's extension storage.
Requests to ensoullab.com. Creel contacts ensoullab.com to check your licence and to sign out, and both requests carry only the account token. It also downloads a small service notice file (/creel/status.json) from time to time, so it can tell you about outages or needed updates. That is a plain GET request with no cookies, no account token and nothing you collected; like any visit to this site, it reaches our host Cloudflare with your IP address and the headers your browser sends automatically, and it appears in our request logs. None of these requests include X data, records, task details or export contents.
Requests to X. Collection, profile pictures and the media you choose to download are requested from X-owned domains, as if you were browsing X yourself.

You can use Creel's Free plan without an Ensoul Lab account. Disconnecting the account in the extension clears it from that browser and asks ensoullab.com to end that sign-in. If the extension is offline at that moment, the sign-in can stay active on our side until you write to us to end it or delete the account.

Services we rely on

We use a small number of providers to run the service, and share with each only what it needs:

Cloudflare hosts the website and the database.
Stripe processes payments.
Resend sends account emails, replies to support requests and the newsletter.
Google handles sign-in when you choose "Continue with Google".

We do not sell your data, and we do not use advertising or tracking cookies. See the Cookie Policy for the cookies the website uses.

How long we keep data

We keep your account and purchase records while your account exists, and delete them with the account. Stripe keeps transaction records as tax and accounting law requires. Signed-out sessions are deleted.

Your choices

You can update your name and email in your account settings.
You can delete your account in Settings. This deletes your profile, sessions, licences and our record of your purchases. Stripe keeps its own record of each transaction under its policy, as tax and accounting law requires.
You can ask us for a copy of your data, or for a correction or deletion, at support@ensoullab.com.

Changes to this policy

If we change this policy we will update this page and its date. If a change matters to how your data is used, we will also tell you by email.