Privacy you can verify.

01Who we are

OPT2IN LLC (“Opt2In,” “we,” “us”) is a Florida limited liability company that operates opt2in.com and is the controller of the personal information described here. This policy covers opt2in.com and the pages we operate, not third-party sites we link to.

• Mailing address: OPT2IN LLC, Miami, Florida, USA
• Privacy contact: privacy@opt2in.com
• Founder / operator: Robert Maatougui (robert@opt2in.com)

02What we collect

Data you intentionally give us

• Account details: only if you create an account: your email (required) and, optionally, your name — though if your export carries a name, that is the one we keep. From your parsed report we also store your gender, primary city, and Instagram handle if present, plus your answer to the optional “How did you hear about us?” question if you give one. We never ask you for your phone number or your date of birth — but that is not the same as never holding them. Your Instagram export carries identity pages of its own, and when a report is saved they are saved with it: your phone number, your date of birth, and the postal address Instagram had stored to autofill your checkouts — street lines, city, state, postcode, country — whichever of them your export contains. Those sit inside the saved report rather than on your account record, on the website and in the iOS app alike — except the phone you link by texting us, described in the next bullet, which does sit on your account record. Deleting one saved report removes that report and its cached summary; it does not touch your account details, and if we ever took a pre-strip backup copy of that report, only deleting your account removes that (section 9). Sign in with Google instead and we receive your email, name, profile picture, and a Google account ID. In the iOS app you can also sign in from the opening screen, before any report exists: with Apple (we receive the name and email you approve — a real address or a Hide My Email relay — plus Apple’s identifier for you), with Google, or with a 6-digit code we email you. Separately, and older: until July 26, 2026 the sign-up flow also put a phone number and a date of birth on the account record itself, so accounts created before that date may still carry them there. Nothing in the product reads them, they are a different copy from the export fields described above and a different copy again from the reminder phone in the next bullet, and you can have them erased at privacy@opt2in.com.
• Text reminders, if you text us first: optional. Tap “Text Opt2In” in the iOS app (“Text File” on the website) and your Messages app opens with our number and a short code already typed. You send it. That is how we know the phone is yours. We then store your phone number, the date you linked it, and the date we last texted you, on your account. We use it for one thing: a reminder that your weekly export is due. Your number is never joined to what is inside your report, and no brand or buyer ever gets it. We also keep a small record under the number itself: when you texted us and how many texts went each way, never what they said. Text STOP and we unlink the number and stop texting it. That record stays, with the date you said stop, because it is what keeps us from texting the number again. Deleting your account erases everything else about the phone. Sendblue carries the messages and receives your number and what you text.
• Location, if you switch it on: optional, iOS app only. Turn on Location under Notifications and the app asks iPhone once for your rough position, turns it into a city and region with Apple’s geocoder (Apple sees the position and your IP address), and stores only that city and region on your account, never coordinates. We use it to match you with studies for your region. Switch it off and we erase it; deleting your account erases it too.
• Your saved report: when a report is saved — automatically whenever you run one while signed in, on the website and in the iOS app alike, or when you tap “Save” from a save prompt — we store the analyzed report you see. That’s more than counts, so the honest list: value estimates; the advertisers and off-platform apps in your data, including how many events each app sent Meta, when it first and last sent one, and what kinds of action it reported (a purchase, a checkout, an item added to a cart, a card added); inferred topics and interests, including the targeting categories you had already opted out of and any household-income bracket Meta had put you in; follower and following counts, and the brand accounts among the ones you follow — the individual people on those lists are not stored; but the accounts whose posts actually filled your feed are — for the recent window your export covers we keep up to fifteen creator accounts and fifteen advertiser accounts, each with its handle, display name, profile link, how many of its posts you saw and, where the post carried one, a caption from it and a link to it; the sponsored ads you were shown — for each advertiser its handle, name and profile link, how many of its ads you saw, and for every one of those ads the moment you saw it plus, where the ad carried them, its caption text, its Ad Library link and a link to the post; the pages you opened from inside Instagram by tapping an ad — the full link, the page title and the time you opened it; and when you were on Instagram, by day and by hour of the day; engagement counts (Threads posts viewed, comments you posted, stories viewed and liked) with the individual entries and other people’s names removed; the ads and advertisers you hid, by title and name, and when you hid each one; if Instagram gave your account creator insights, your own performance figures — how many accounts you reached, impressions, profile visits, likes and interactions on your posts, stories and reels, the follower/non-follower split, and the period they cover; what you typed into Threads search — the terms themselves, each with a count, not just a total; your Threads profile as Threads holds it, including its bio, email and phone number; if your account has audience insights, the follower breakdown Instagram showed you (their cities, countries, age bands and gender split); an inventory of your archive’s folders — their names, file counts and sizes, how many records each file held and how big it was, and for a folder we do not recognise yet, the names of the files inside it; the cities Instagram tied to you (city and country names, no coordinates); the address Instagram had saved for you; and profile identifiers: name, email, phone number, date of birth, gender, Instagram handle, device (plus, if your archive carries a camera log, how many device-fingerprint events were in it and over what dates — counts and dates only, never the identifiers themselves), when you signed up, your last login, the first country code on the account, whether contact syncing was on, whether the account was private, and a persistent Meta ID (an FBID) that links your activity across Instagram, Facebook, Threads, and ad measurement; and facts about the export itself — when you asked Instagram for it, when Meta finished it and how long that took, the format and quality you picked, the window it covers and how big the file was. The address needs saying plainly. If your export carries the details Instagram fills in for you at checkout, we keep that address whole, on one line: house number, street, city, state, postcode and country. Not a city. Not a rough area. The doorstep. And the same goes for the phone number and the date of birth: we never ask you for any of the three — there is no form and no box to type them into — but they sit inside the export you upload, and saving keeps them along with everything else. We don’t store your raw messages or photos — only how many messages, conversations and pending message requests your archive held — never their contents, and never who they were with. Two things in your report are never stored at all: the precise GPS coordinate your export may carry, and your synced-contacts list. In the iOS app both are removed before the report leaves your phone; on the website both travel inside the report and are deleted during processing, before anything is written. Of your contacts we keep only the counts — how many contacts Instagram had synced from your phone, how many of those were phone numbers and how many emails, and how many people are on your close-friends list — never a single name or number. If you are signed out, no report is uploaded unless you create an account from a save prompt — though the “a report was run” event below is sent either way.
• Cohort-share consent: optional. On the website you can share aggregated, non-identifying signals (category/app/advertiser totals, location buckets, never raw data, contacts, messages, or identifiers) by ticking the box when you save. Leaving it unticked still saves your report. The iOS app does not ask and never sends it. It’s recorded on your account; change or withdraw it anytime at privacy@opt2in.com.
• Paid research: optional, running now, and separate from everything above. Section 11 sets the whole thing out. Nothing here happens unless you join the research panel, and you join by signing in, on the website or in the iOS app, under the sentence above the sign-in buttons that says so. You can leave whenever you want. When you have joined, we keep three kinds of thing. First, your answers: what you tell us each week about the ads and advertisers in your own report, and about any extra ad we choose and send you, including anything you type in your own words when we ask which advertisers you remember, anything you say in a voice note in the iOS app (your phone turns it into text before anything is sent; the audio itself never leaves your phone and is not kept), and your answers to the optional profile booster sections. In the iOS app the Grade tab may also show a short list of unpaid political ads: live US political or issue ads that we choose by hand each week from Meta’s public Ad Library. The list is the same for everyone that week. Nothing from your report is used to choose it, and nothing about you is sent to Meta. The ad’s words, its details from Meta’s Ad Library (who paid for it, when it started, Meta’s spend and impressions ranges, its top regions, its audience size, and its age and gender split) and its picture come from our server, so Meta does not see your phone for those. If the ad is a video, the app plays it straight from Meta’s video servers, muted and starting on its own when the ad is shown, so Meta sees your phone’s IP address then. If you answer the ad’s questions, your answers, any notes you type, and how you viewed the ad (whether it was a picture, a video or text only, whether the video played, how long you watched and how long it runs, whether it reached the end, and how long you stayed on it) are stored on our server with your other research answers, under your email, and earn nothing. Deleting your account removes them the same way as your other research answers. Second, your profile details, which you fill in yourself and can leave blank or answer “Prefer not to say” on: birthday, location, job title, gender, pronouns, race and ethnicity, education, employment, industry, household income and household composition, plus how you want to be paid and the address to pay it to. Third, the records that show a week really happened: for each week you take part we store which report it was, the week it counted for, what was credited, and a short non-reversible code derived from your IP address, so we can tell when several accounts are being run from one place. These live in two stores of their own, apart from your account and your saved reports: one keyed to your email address, holding your answers, your weeks and what you are owed, and one that holds no email at all, holding only counters and the checks that stop the same file being counted twice. Separately, and for everyone who saves a report rather than only for research, a saved report carries a compact index of the ads you were shown: one row per ad with the advertiser’s handle, the moment you saw it, and the ad’s Ad Library id where the ad had one. It is the same ad log described above, in a form that can be compared with your next export. Deleting your account removes your research answers along with everything else, with two exceptions we will not pretend otherwise about: a copy of the answers with your identity stripped out, which is the research itself and cannot be unpicked afterwards, and, if we still owe you for a week, one row holding the amount and the address to pay it to, deleted as soon as you are paid. No brand ever receives your identity. A brand can receive what you answered only with your identity removed; section 11 says how.
• Payment details: if you cash out, or if paid research is running and we owe you for a week, you can set a payment email separate from your sign-in email, and choose how we pay you: through Tremendous, or by PayPal (section 11). We store a record of each payment (section 5). We never see bank or card numbers.
• AI chat questions: sent to Anthropic to answer; see section 5. We don’t store them.
• AI assistants you connect: optional. If you link an assistant such as Muse, we store which assistant it is (the name it gives itself, which we don’t verify) and when you connected it, so the connection can be checked and ended. We don’t store what you ask it. See section 5.
• Emails you send us: kept so we can reply.

Data collected automatically

• “A report was run” event: each time the report renders we log the platform, where you came from (referrer / UTM; we keep only the referring website’s name, never the specific page, post, or search you came from), aggregate counts (advertisers, topics, interests, ads in the last 7 days and how many days the ad log covers, stories viewed, ads tapped), which format your archive was in (JSON or HTML) and whether it contained the ads-and-topics folder, one fixed word describing the shape of the advertisers file (for example “ok” or “absent”), the names of any report sections that failed or came back empty, the names of up to 25 top-level folders in your archive that we do not recognize yet (folder names Meta chose, never anything inside them), a random run ID, your IP address, rough location (city-level), browser and device type, a short non-reversible code derived from your IP and device so repeat runs from the same device can be counted, and your email only if signed in. Your report contents are not included.
• “An export was refused” event: if the file you pick can’t be turned into a report at all — it isn’t a ZIP, it’s larger than we can process (over 1 GB), it’s from another platform, it isn’t an Instagram export, the ZIP is damaged or password-protected, or your device runs out of memory reading it — we log that too, with a short fixed label for which of those it was, alongside the same context as the event above (platform, where you came from, your IP, rough location, browser and device type, and the short non-reversible code derived from your IP and device). It carries nothing from inside the file, and nothing about the file itself — no counts, no folder or file names, not your archive’s name, and not its size, not even in the case where the size is the reason it was refused — and not the on-screen error text either, since that can quote filenames from your archive. It exists so a rejected upload is distinguishable from nobody visiting; without it we could not tell that anyone had tried.
• QR scan on merch: our hoodies and stickers carry a QR code. Scanning one records which garment was scanned (a short code identifying the item, not you), and sends us an internal alert containing your IP address, rough location (city-level), browser and device type, and a short non-reversible code derived from your IP and device so a repeat scan can be told apart from a new person. We keep a running count per garment and a count for the current day; we do not keep a row per scan, a timestamp per scan, or any history tying scans together over time. If you then open your report from that page, the garment code travels with the link so we can tell whether the merch led to a report — it carries nothing about you.
• Recap share counts: if you build or share the animated recap of your own report, we record that it happened — the event name alone (a card was built, a share completed, an image was saved). No identity, no account, and no numbers from your report. The recap image is drawn on your device and is never uploaded, and nothing is recorded when the recap is of the sample report.
• App error notes (iPhone app only): if the app hits an error or runs slowly, it sends us a short technical note: what failed or how long it took, on which screen, the app and iOS version, and the phone model. It carries no name, email or report contents, is not tied to your account, and email addresses, phone numbers and the private part of any web address are removed from it before it leaves the phone.
• Offer-click records: clicking an offer records the offer, a random click ID, and (if signed in) your account, so we can measure interest and match a conversion the brand reports back to us. No offer pays you a commission; the commission, where one exists, is Opt2In’s revenue (section 6). Clicks are logged even with no account, under an anonymous key; for signed-in users we keep a click count and last-seen time.
• Deal views and saves: when a deal card is at least half on screen we record which cards were seen, and tapping Save records the card and whether you saved or unsaved it, so we can tell whether the feature is worth keeping. These records carry the card ids, a label for which part of the product they came from, and (for views) whether you were signed in. They never carry your email or your account, on the website or in the app.
• Survey answers: if the short 3-question prompt appears before your offers, your answers (how accurate the report felt, what you’re currently looking to do, and which deal categories you want to see) are stored so we can gauge report quality and show you relevant deals. They’re linked to your account only if you’re signed in; otherwise they’re stored anonymously. You can Skip it, and it won’t ask again on that device.
• Web logs & abuse limits: our host (Netlify) logs your IP, user-agent, and the page requested; we also use your IP to rate-limit sign-in, save, click, sample-report view, and short-link (/ig, /steps, /r, /h) endpoints against abuse. The limiter stores a hashed form of the IP with its recent request times, not the address itself.
• Aggregate traffic: visitor and page-view counts. No Google Analytics, Plausible, Segment, ad pixels, or cross-site tracking, and no tracking cookies.
• localStorage summary: your browser (not our servers) stores a compact summary so the offers view can personalize: your name and username, top advertiser/app/topic names, the accounts you follow, the value estimate, and the export filename. If you never create an account, this stays on your device. Clear it via your browser’s site data, or “Switch account” in the nav; in the iOS app, deleting the app removes it with the app.
• How you arrived: your browser also keeps one short-lived note of where you came from (for example “reddit” or “receipt”) so the “a report was run” event above can say which channel sent you. It is the referring website’s name only, never the page, link, or search, and it is cleared when you close the tab. It is not a cookie and not an ID that follows you between visits. When you open the sample report, that channel name is also added to an anonymous per-day tally of sample views by channel, with nothing else attached.

03What we don’t collect

• Your raw export. The ZIP stays on your device. We never receive it, store it, or have any way to retrieve it after your session ends.
• Your messages and photos. Read on your device to build the report, never uploaded or stored.
• Your synced-contacts list. Never stored. In the iOS app it is stripped out before a saved report leaves your phone; on the website it travels inside the report and is discarded during processing. We keep only the counts, never names or numbers.
• Your browsing history across other sites. No tracking cookies, no cross-site fingerprinting.
• Ad-tech tracker data. No third-party advertising analytics, social pixels, or remarketing tags.
• Your bank or card details. Opt2In is free; when money moves it moves to you, through Tremendous or PayPal, which handle the financial instruments. We never see them.
• Your data, sold. We don’t sell personal information. This is not a data-broker business.

04How we use it

• Deliver the service: parse your export on your device, render the report, answer your AI-chat questions.
• Run your account: keep saved reports available across devices, sign you in, show your balance.
• Match offers & pay out a balance: use your report’s interests, topics, and apps to surface offers, and (if you ever have a balance) send the payout you request. (Today’s offers don’t fund a balance; see section 6.)
• Run paid research: if you have joined the panel, use your answers and your own saved report to measure how advertising is remembered, and pay you for the weeks you take part (section 11).
• Communicate: sign-in links and confirmations, a notice about a feature you asked to hear about, replies to your emails, and, if you are on the research panel, a weekly reminder that a fresh export is due — as a text if you linked a phone, as an email if you did not, and you can switch either one off.
• Understand & protect: measure usage from aggregate counts; use logs and rate limits to fix bugs and catch abuse.
• Legal compliance: respond to lawful requests and comply with applicable US law.

Your balance and Cash out are the same on the Opt2In website and in the iOS app; the money itself is sent outside the app, by Tremendous or PayPal. Accounts exist in the app too: you can sign in there with Apple, Google, or an emailed code (an Apple “Hide My Email” relay address is its own separate account — we never merge accounts behind the scenes) and save your report. Reports you run in the app save to your account automatically while you are signed in, exactly as they do on the website. The current iOS app contains no offers, deals, or referral links of any kind, and records no offer clicks, saves, or impressions; matched offers are a website feature. Saving a report by itself earns you nothing on either surface: Opt2In no longer pays a bonus for a save. Paid research is the one exception, and it is running now: taking part in a weekly study is paid, and the app shows what a study is worth, what a week credited, and what you are owed, which you can cash out there or on the website. The money itself is sent outside the app, by PayPal or through Tremendous (section 11).

05Third parties we use

A small set of well-known providers, each handling one part of the service and receiving only the data it needs. Automated email comes from noreply@opt2in.com (not monitored for replies: use privacy@opt2in.com to reach a person).

Netlify

Hosting + data store

Hosts the site and runs our functions. Its storage (Netlify Blobs) holds your account, saved reports, payment records, click/activity logs and, for anyone on the research panel, their research answers and profile details. Server logs include your IP and user-agent; traffic stats are aggregate and cookie-free.

netlify.com/privacy →

Anthropic

AI analyst chat

If you use the chat, your question goes to Anthropic’s Claude API with context from your report: your username, home city and the precise GPS coordinate from your export (if present), advertiser and creator names, the topics and hashtags your recent activity clustered into, your device and OS as the export records them, and your gender and date of birth as they appear in your export. This is not anonymized. Nothing is sent until you explicitly allow it in the chat itself, and you can decline. We don’t store these chats; Anthropic processes them under its commercial API terms, which require it to protect this data and do not permit it to use your chats to train its models. Don’t use the chat if you’d rather not share this.

anthropic.com/legal/privacy →

AI assistants you connect

Muse by Meta, and others

Only if you connect one. If you link Opt2In to an AI assistant such as Muse, the assistant’s maker receives the answers to what you ask it about your saved reports: the advertisers whose ads you were shown, when you saw each ad, its caption and Ad Library link, the advertisers Instagram lists as having your information, the categories used to reach you, and our estimate of what your attention is worth. It never receives your location, address, birthday, phone number, messages, contacts or followers, and it cannot change anything. We don’t store your questions. The assistant’s maker handles what it receives under its own privacy policy. Connecting starts on a page on opt2in.com where you say yes. To disconnect, remove Opt2In in the assistant or email privacy@opt2in.com; deleting your Opt2In account also ends every connection at once.

muse.ai/privacy →

Twilio SendGrid

Account email

Delivers sign-in links, save confirmations, deletion-confirmation links, and the weekly research reminder email described in section 2. Receives your email address and the message content.

twilio.com/legal/privacy →

Sendblue

Text reminders

Carries the text reminders described in section 2, and only for people who text us first. It receives your phone number and the messages you and we exchange, which is unavoidable: it is the wire. It receives nothing else — no email address, no account, no report data.

sendblue.com/privacy-policy →

Tremendous

Payouts

Fulfills cashouts, and research payments for anyone who picks it as their rail. Receives your payment email, name, and the amount, then lets you pick how to receive it (gift card, PayPal, Venmo, bank transfer, and more). We never send it bank or card numbers.

tremendous.com/privacy →

PP

PayPal

Research payments

Reached only if you ask to be paid by PayPal. Once we have reviewed the request, we send the payment from our own PayPal account to the address you gave us, so PayPal receives that address and the amount and nothing else: no report, no answers, no profile details. Pick Tremendous instead and PayPal is not involved at all. Nobody is ever charged: money only moves toward you.

paypal.com/legalhub/privacy →

Google

Sign-in · city photos

Two optional uses, each reached only when you choose it: Sign in with Google (loads Google’s sign-in library and shares your email and name only when you click it); and the city photo on the Locations tab, which our server looks up through Google Places so the key never reaches your browser, though your browser then loads the image from Google’s host, which sees your IP address. Our fonts are self-hosted, so Google Fonts is not used.

policies.google.com/privacy →

Apple

Locations map · Sign in with Apple

The map on the Locations tab is Apple MapKit JS, loaded only when you open that tab. Apple sees your IP address and the area shown. Our server issues a short-lived token so no long-lived key is exposed, and the map itself uses no GPS or device location: it is centred on the city Instagram guessed, from your export (the optional Location switch in the iOS app is described in section 02). In the iOS app, a brand’s page in your report can show the ad itself: when you tap “Show ad”, the app loads that one post from Instagram’s public embed page, so Meta sees your IP address and which post was opened. The same post appears on the grading screen: there it loads as soon as that screen opens, after you tap Start on that ad. On a brand’s page and on an ad’s details page it loads only when you tap. The post is shown in a sandboxed frame that tells Instagram nothing about the page it sits in. In the iOS app you can also use Sign in with Apple: Apple gives us a signed token with your name and your chosen email (real or a Hide My Email relay), and we verify it against Apple’s public keys before creating your account.

apple.com/legal/privacy →

Kit (ConvertKit)

Past email list (stopped Oct 17, 2026)

No longer used. Until October 17, 2026, saving a report also added your email address to our Kit mailing list automatically, with four short tags: which platform the report came from, “v2”, “saved-report”, and a value band from your report’s estimated annual attention figure. No report, name, brand or advertiser name was sent. We stopped this on October 17, 2026: saving a report no longer sends your address to Kit. Addresses added before then may still be on that list. To have yours removed, email privacy@opt2in.com.

kit.com/privacy →

DuckDuckGo

Brand logos (toggleable)

Brand logos load from DuckDuckGo’s favicon service, which receives the domain names requested (from your advertiser list) and your IP address. They are on by default, so this happens while your report renders. The “Brand logos” switch at the top of the report (in the iOS app, in the report’s top-right menu) turns them off at any time: letter tiles render instead and nothing is fetched.

duckduckgo.com/privacy →

Telegram

Operator alerts

Almost every event on the site sends us a short internal alert as it happens, over Telegram, and by email as well — through Twilio SendGrid, listed above — for the ones we let make a sound, and for any alert Telegram cannot take. Around seventy kinds are defined in our code, a few of them dormant paths that no longer fire, so listing every one would be unreadable and out of date within a month. The honest version is by category: running a report, saving one, and a save we refuse; a merch QR scan; opening the sample report; a click on one of our own short links; signing up and signing in; deleting your account, whether scheduled or done straight away, and cancelling a scheduled deletion; offers (clicks, saves and conversions); a survey answer; a request for a laptop link; linking a phone for text reminders, and the weekly reminders going out; an email to you failing or bouncing; payouts and every way one can fail; and our own bookkeeping when it breaks. These carry your full email address: signing up and signing in (the sign-in line also says which method you used, how many reports you have saved, and how long it had been since we last saw you), saving a report again, asking for a laptop link, opting in to cohort sharing, a failed or bounced email, every payout and payout problem, an account deleted straight away, a deletion scheduled or cancelled, the note we send when two of your saved reports are collapsed into one, the research lines (a weekly question set finished, a week credited or held, an ad graded or swapped, the questions over a saved report answered), and linking a phone for text reminders. Offer clicks and survey answers carry it only if you were signed in at the time, and a conversion carries it only when the click behind it was attributed to a signed-in click — not always, as an earlier version of this page said. These carry a masked address (first letter and domain, like j***@example.com): the account-deletion machinery — an operator deleting an account from our console, that deletion failing part-way, a purge running twice at once, and a Sign in with Apple revocation erroring out while an account is being deleted. One carries a masked phone number (the last four digits only, like ***1234): the line that tells us somebody linked a phone for text reminders. It carries nothing you texted, and the line that says the weekly reminders went out is a count of texts and emails with nobody named in it. These carry your IP address, rough city and device type: a report run, and the first-ever scan of a given merch item. Both also carry the short non-reversible code derived from your IP and device described above; a report run additionally carries the random run ID and two aggregate counts from your report (how many advertisers, and how many ads in the last 7 days). After the first, a merch scan carries only the item’s code and a count. These carry nothing that identifies you: sample-report opens (our own campaign tag and a count), clicks on our own short links, offer saves (the offer’s name only), the line that says somebody connected an AI assistant (the name the assistant gives itself, and nothing about you), the line that says research has closed itself because the panel is full or its budget is spent, and a refused save — a status, a fixed reason label and the random run ID, never the free-text detail, which stays in our server log. A refused export is different again, and better than this page used to say: it is never sent to Telegram or email, and never reaches our alert log. It is written only to our server log, where the line carries the same fields as the “an export was refused” event above — platform, where you came from, your IP, rough location, device type and that non-reversible code — plus the random run ID; only a count of refusals reaches our daily internal summary. The final purge of a deleted account, once the 30-day grace has run out, sends no alert either: it is a count on that same daily summary and a masked line in our admin activity log. Alerts never contain anything read out of your export beyond the aggregate counts already described above. These are internal notifications, not data shared for the recipient’s own use; a copy of every alert we send is kept in our admin log exactly as it was sent, email addresses included; when you delete your account, your address in that log is masked to that same first letter and domain.

telegram.org/privacy →

Every library and font is served from opt2in.com itself (React, JSZip, Leaflet, DOMPurify, and our webfonts). On a plain visit, no third party is contacted at all. While your report renders, DuckDuckGo is contacted for brand logos unless you switch them off. Google (sign-in, city photos) and Apple (the Locations map) are reached only if you use those features.

06Offers & affiliate links

Opt2In is free because brands pay referral fees. Each offer card shows its bonus or discount, what you must do to qualify, and a note on how the link is tracked.

• What today’s offers are. Every live offer is a brand’s own discount or a signup bonus paid directly by the brand into your account with them. We don’t credit any offer bonus to an Opt2In balance, and no offer pays you a commission; where a commission exists, it is Opt2In’s revenue and is what keeps the tool free.
• Click attribution. For partners that support it (currently AdGuard, NordVPN, NordPass, NordLocker, Coveron, and Ledger), a random click ID is attached to the outbound link so they can report a signup back to us. Other links carry no Opt2In identifier. We never send the brand your name or email.
• Conversions. When a partner reports a conversion we store a record (amount and attribution), linked to your account only if the click was signed in.
• Not ranked by what pays us. Offers are matched to your interests, topics, advertisers, and apps. Payout never changes which surfaces first.

Per the FTC’s endorsement guidelines: Opt2In may earn a referral fee on some links (currently AdGuard, NordVPN, NordPass, NordLocker, Coveron, Optery, and Ledger), disclosed here and in the offers view.

07Your rights

You have the rights below over the limited personal information we hold, under the CCPA/CPRA and equivalent laws in Colorado, Connecticut, Virginia, Utah, Texas, and other states with active privacy laws as of 2026. To exercise any of them, email privacy@opt2in.com.

• Know what we hold about you. With an account: your account details (section 2), saved reports, payment records, consent choices, and the phone you linked for text reminders if you linked one, plus, if you have joined paid research, your profile details, your answers and your weeks (section 11). Without one: usually nothing.
• Delete: from your account page (see section 9) or by email. Payment records stay as business records (section 8), and so do the three research items named in sections 8 and 11: a de-identified copy of your answers, a tombstone of counts, and any research week we still owe you.
• Correct inaccurate personal information.
• Opt out of sale or sharing: we don’t sell or share personal information as CCPA defines it, so there’s nothing to opt out of. If that changes, we’ll update this policy and add a mechanism first.
• Limit the use of sensitive information: the research profile can include race and ethnicity and household income, which California treats as sensitive personal information. You never have to give either. Every sensitive question carries a “Prefer not to say” answer, we use these fields only to describe the panel in aggregate, we never sell or share them, and you can clear any field from your profile at any time.
• Non-discrimination: we won’t deny service, change pricing, or degrade your experience for exercising a right. Paid research is voluntary in both directions: the report is the same free report whether you join, refuse or leave.

We respond to verified requests within 45 days and may ask you to confirm access to the email a request concerns; you may use an authorized agent with proof. EEA / UK: Opt2In is operated from the US and isn’t directed at the EEA/UK, but if you believe GDPR applies to you, email us and we’ll honor equivalent access, deletion, and portability rights on a best-efforts basis.

08How long we keep data

• Export & the report you view: the export is never uploaded and never stored. The report you view stays on your device for the session, unless it is saved to your account — see saved reports below.
• localStorage summary: on your device until you clear it. We can’t see or delete it remotely.
• Account details & saved reports: until you delete them (per report, or all at once, section 9).
• Offer-click & activity records: targeted for deletion after ~180 days (best-effort, so an entry can linger until the next pass); account deletion scrubs them.
• Payout records: kept after deletion as business records (amount, date, delivery status, the payout email and name used, and provider order/reward IDs) for accounting, tax, and fraud. No longer linked to a live account, though the email and name used remain in the record.
• Anti-fraud bounty ledger: hashed, non-reversible records tied to your email (and to the network address a bonus was claimed from) are kept after deletion so the same person can’t re-claim a one-time bonus. No readable personal data.
• Research records: your answers, your booster answers, your weeks and your profile details are kept while your account exists and are deleted with it. Three things outlive the account on purpose (section 11): a copy of your answers with your identity removed and the brand names you typed dropped, a small tombstone of counts so a published total cannot change after the fact, and, if we still owe you for a week, one row holding the amount and the address to pay it to, deleted the moment it is settled. The non-reversible codes that stop one export being counted twice (a fingerprint of the ad log, and the hashed Meta ID and IP codes) are kept with no name attached.
• AI chat questions: not stored by us; retained by Anthropic under its terms.
• Operator alert log: a copy of every internal alert we send ourselves is kept in our admin log exactly as it was sent: an alert that names you carries your address in full unless it was written with a shortened one, and a payout amount, and, for a report run or the first-ever scan of a merch item, your IP address, rough location (city-level), device type and the short non-reversible code derived from your IP and device, sit there as they were sent. When you delete your account, every copy of your email address in this log is masked down to its first character and the domain (j***@example.com); the lines themselves stay. We keep the newest 500 entries and drop older ones, but only when an operator opens that view, so an older entry can linger until then. One thing is not in it at all: a refused export, which sends no alert, so that line exists only in our server-side function log (the refusal is still recorded in the activity records above).
• Server access logs: ~30 days (Netlify). Emails you send us: while relevant, typically under 2 years.

09How deletion works

You can delete a single saved report (immediate) or your whole account. On the website, account deletion is deliberately careful and reversible:

• 1. Request. Click “Delete my data.” Nothing is deleted yet. We email a one-time confirmation link (valid 30 minutes), so no one but you can trigger it.
• 2. Confirm. Clicking the link schedules deletion and starts a 30-day window to change your mind.
• 3. Restore (optional). Sign back in within 30 days to cancel; your data still exists during this window.
• 4. Purge. After 30 days, a scheduled job that runs every hour permanently removes your profile, saved reports, click records, activity, the phone you linked for text reminders and the conversation behind it, and, if you took part, your research answers, booster answers, profile details and weeks. Payout records and the hashed bounty ledger stay as business records (section 8), and so do the three research items named in sections 8 and 11.

In the iOS app it is faster, on purpose. “Delete account” (Profile, then Help) removes your saved reports, your details and the phone you linked for text reminders immediately and permanently, with no email step and no grace period; a link under it starts the emailed 30-day flow above instead, if you would rather have the safety net. We default to the immediate path because an Apple “Hide My Email” relay can silently drop our mail, and deleting your account must never depend on an email arriving. Payout records and the hashed bounty ledger stay either way (section 8).

Prefer email? Write privacy@opt2in.com and we’ll process it.

10How we protect your data

The strongest protection in this product is the one built into its shape: most of your data never reaches us at all. Your export is unzipped, parsed, and turned into a report on your own device, and the file itself is never transmitted. What we do receive and hold — your account details, your saved reports, payout records, the phone you linked for text reminders, and the events named in section 2 — is protected as follows.

• Encrypted in transit. Every connection to opt2in.com, to the iOS app’s backend, and between us and the processors in section 5 runs over HTTPS with TLS 1.2 or greater. We send a Strict-Transport-Security header, so a browser that has seen our site once will refuse to reach us any other way.
• Encrypted at rest. Account records and saved reports are stored in Netlify Blobs, which encrypts stored data at rest with AES-256 or stronger. The infrastructure it runs on is covered by Netlify’s SOC 2 Type 2 and ISO 27001 reports.
• No passwords, anywhere. Opt2In has no password field and stores no password hashes, so there is no password database to steal. You sign in with Google, with Apple, with a one-time emailed link, or with a 6-digit emailed code. That code is written to storage only as a SHA-256 hash, expires in 10 minutes, is destroyed after 5 wrong attempts, and works once. Sign-in links carry 256 bits of cryptographic randomness, expire, and also work once. Sessions expire after 30 days.
• Every account endpoint is authenticated. Nothing about an account is returned without that account’s email and an unexpired session token, re-checked against the stored record on every single request. Opening a saved report additionally requires the report’s storage key to belong to the account asking for it, so a hand-edited request cannot reach anyone else’s report.
• Least exposure by default. What our servers may send back to a browser is an explicit list of permitted fields, not a list of forbidden ones. Session tokens and sign-in codes sit structurally outside it, and any field a future feature adds stays private until someone deliberately publishes it. That is a deliberate design choice: the failure mode of the opposite approach is a new field leaking because somebody forgot.
• Abuse limits. Sign-in, save, offer-click, survey, and AI-chat endpoints each carry per-network-address rate limits and request-size caps, and a tripped limit raises an internal alert. Our host adds automatic DDoS detection and blocking in front of all of it.
• Administrative access is single-person, time-boxed, and separately gated. Opt2In is operated by one person (section 1), and only that operator holds administrative access. The admin console requires a passcode that is never kept in the browser — the browser holds only a signed token that expires after 12 hours — and five failed attempts lock the originating network address out for 15 minutes, before any comparison is made. Anything irreversible or money-moving requires a second, separate passcode entered per action and never cached, so a stolen session cannot move money. Production credentials live only in our host’s encrypted environment settings: never in our code, never in our repository, never sent to your browser. Provider accounts that can reach production are protected with two-factor authentication.
• Private by default in what we publish. The public website is assembled at build time from an explicit list of files. Backend source code, internal notes, and operational tooling are not on that list and are not served on the web. A separate automated scan reads every file that is published, on every release, and stops the release if it finds a personal name, handle, local file path, or credential that should not be public.
• Hardened in your browser. A Content Security Policy limits what may execute on our pages to our own code and a short, named list of dependencies; we forbid framing of our pages (anti-clickjacking), forbid content-type guessing, and limit what is disclosed to other sites when you follow a link. No third-party analytics, ad pixels, or tracking cookies exist to be compromised (section 2).
• Checked before every release. An automated suite covering sign-in, payouts, offer handling, and data retention runs as a gate on every deploy. If it fails, the release stops.
• Reporting a problem. Security researchers can reach us at security@opt2in.com. Our disclosure policy, response times, and safe-harbor commitment are published at opt2in.com/security.html, linked from the footer of every page.

What we don’t claim. Opt2In is a small company and has not completed a SOC 2 or ISO 27001 audit of its own; those certifications belong to the infrastructure we build on, not to us. Your saved report is encrypted in storage but not end-to-end — we can read it, because serving it back to you across devices and matching offers to it requires that we can. We never hold bank or card numbers (section 3). And if we ever discover a breach affecting your personal information, we will notify the users affected and any regulator the law requires, without undue delay.

11Paid research

This is running now. Paid research opened on September 10, 2026, and everything described below is live from that date. None of it happens to anyone who has not joined, and signing in is joining, on the website and in the iOS app, under a sentence above the sign-in buttons that says so. Places are limited by a panel cap and a budget, so joining itself can be closed at any moment. Nothing in the product describes research as running while it is not.

What it is

You can join a small panel and take part in a weekly study about the advertising in your own report: you ask Instagram for a fresh export, run it, and answer questions about the ads and advertisers it found. Taking part is voluntary, you can leave whenever you want, and the report stays exactly as free whether you join, refuse or leave. Joining asks you to consent in plain words and to confirm that you are 18 or over; both are stored on your account with the date you gave them. On the website and in the iOS app, the sentence above the sign-in buttons is that consent.

What a weekly study collects

• Your answers. What you tell us each week about the ads and advertisers in your own report, and about any extra ad we choose and send you: which brands you remember, including anything you type in your own words; how many ads you think you saw; whether an ad was clear or likeable; how likely you would be to buy; and how well the interests Meta guessed match you; and, after your report is on screen, which of its findings you recognize, which of them are wrong, and which brands you use on purpose. Each answer is stored with the question it answered, how long that screen was in front of you, and the order things were shown in, because a study that cannot say how it was asked is not research. We also keep a short summary of which findings you confirmed — counts and your own advertiser handles, never anything you typed — so your report can show it back to you. If you tell us you cannot see an ad, we keep which ad it was, from which report, and when, so it is not offered to you again; this earns nothing and is never shared with a brand.
• Your voice note, as text. In the iOS app, on the last question about an ad, you can tap the microphone and speak for up to one minute instead of typing. Your phone turns the speech into text on the phone itself, using Apple’s on-device speech recognition; the audio is never sent to us or to anyone, and it is not kept. You see the text and can change it before you send. Only the text you send is stored, with that ad’s answers, up to 1,000 characters. On a phone that cannot do this on the phone, the microphone does not appear.
• Your profile details. You fill these in yourself, and every one of them is optional: birthday, location, gender, pronouns, race and ethnicity, education, employment, job title, industry, household income and household composition, plus your name and how you want to be paid. Every sensitive question carries a “Prefer not to say” answer, and picking it is stored as your answer. Where your own export already holds a value (your birthday, your city, your gender) the field is offered pre-filled from it and labelled “from your export,” never guessed from anything else. Nothing is required except the payment choice, which is asked when you cash out.
• Booster answers. Seven short, optional question sections (apps and accounts, demographics, devices, shopping, subscriptions, work, and one about your own report). They pay nothing. Completing one earns points toward a profile score that has no cash value and buys nothing.
• The records that show a week really happened. For each week you take part: which saved report it was, the week it counted for, how many new days of advertising it added, the advertisers in it, what was credited and when, a non-reversible fingerprint of the ad log so the same file cannot be counted twice, a non-reversible code derived from the Meta ID inside your export, and a non-reversible code derived from the IP address the report was saved from. That last one exists for one purpose: to notice when several accounts are being run from one place. It is a hash, not your address, and we cannot turn it back into one.

The index of your ads

A study compares what you remember with what your export actually recorded, so a saved report carries a compact index of the ads you were shown: one row per ad with the advertiser’s handle, the moment you saw it, and the ad’s public Ad Library id where the ad had one, capped at 2,000 rows. It holds nothing your saved report did not already hold (section 2 lists the ad log in full); it is the same information in a shape that can be lined up against next week’s export. It is stored with every saved report, for everyone, not only for people on the panel.

Where it is kept

Research records live in two stores of their own, apart from your account and your saved reports. One is keyed to your email address and holds your answers, your weeks and what you are owed. The other holds no email address at all: only counters, the fingerprints that stop one export being counted twice, and, against a week, the hashed codes described above. Your profile details sit on your account record with the rest of it.

How you are paid

A week’s study is worth $3.00 on the website. That is the week’s study: a verified fresh export and that week’s completed questions, together, credited when you submit them. An export on its own earns nothing, and so do answers with no fresh export behind them. A week whose questions are submitted on the website earns the study only, every week. A week whose questions were submitted in the iOS app before October 9, 2026 (midnight Pacific time) was worth up to $5.00, in two units: the same study, and a bonus unit, $2.00, on every week after your first; in the app a first week is $3.00 and every later week $5.00, even after a missed week. We switched the app’s bonus off on October 9, 2026; from then on, a week whose questions are submitted in the iOS app earns the study only, every week, the same as on the website. A bonus already credited stays credited. On the website and in the iOS app alike, each ad you grade after your weekly export also pays $1, up to two ads a week, so a week is worth up to $5.00 on the website and up to $7.00 in the iOS app before the app’s bonus was switched off, and up to $5.00 there too since then. You are paid when you cash out, on the website or in the iOS app, to the address you gave us, and you pick the rail: Tremendous, which emails you the payment, or PayPal, which we send once we have reviewed the request (section 5 describes both). Either way the money moves outside the app.

If a week looks wrong (several accounts saving from one network address, one Meta account behind two Opt2In accounts, a set answered faster than it could be read, an attention-check question answered wrongly, a set claiming brands your own export shows you were never served, or our research budget running out before your week landed) the credit is held rather than refused: you see “Under review” against it, a person looks at it, and it is released when the check clears. Nothing is declined silently. A file we have already counted is a different thing, and simpler: offering the same export again, or one that adds too few new days to be a fresh week, earns nothing that week. Nothing is credited, nothing is held, there is nothing for anyone to review.

What deletion keeps

Deleting your account removes your research answers, your booster answers, your profile details and your weeks along with everything else (section 9). Three things are kept on purpose, and we would rather say so now than have you find out later.

• A de-identified copy of your answers, with your email removed, re-keyed to a code that does not lead back to you, and with the brand names you typed in your own words dropped entirely. That copy is the research itself. Once your identity is out of it, it cannot be put back, and it cannot be deleted on request, because there is nothing left in it to find you by.
• A small tombstone of counts (how many weeks were credited, how many sets were completed, which version of the questions you answered) so that a published total does not change after the fact.
• One row for money we still owe you, holding the amount, the week and the address to pay it to. Unlike a balance from the older save bonus, a credited research week is not forfeited by deleting your account: the row is carried forward, paid to you, and deleted the moment it is settled.

What a brand gets, and what it never gets

No brand receives your name, your email, your saved report or your profile. What a brand can be shown is a finding across many people, with the number of people behind it and the number excluded from it, never a person; it can include what you answered, including the text of a voice note, after your name, email, handles, phone numbers and anything else that could identify you have been removed, and after a person at Opt2In has read it. Brands pay Opt2In for those findings; nothing that identifies you is sold or shared. Opt2In is not affiliated with or endorsed by any brand named in your report or in a study.

12Children

Opt2In is for adults 18 and older. We don’t knowingly collect personal information from anyone under 18. Joining the panel (signing in, on the website or in the iOS app) asks you to confirm that you are 18 or over, and that confirmation is stored with your consent (section 11). If your newest saved export shows a birthday under 18, no paid research step opens until you turn 18. If you believe a minor has submitted information, email privacy@opt2in.com and we’ll delete it promptly.

13Changes to this policy

We update this policy when our practices change. For a material change we update the “Last updated” date above and, where appropriate, notify current email subscribers. If you strongly disagree with a change, you can delete your data.

14Contact

• Privacy & data requests: privacy@opt2in.com
• Account & payout support: support@opt2in.com
• General: robert@opt2in.com
• Postal: OPT2IN LLC, Miami, Florida, USA (email first for a faster response)

California residents: if we haven’t responded to a rights request in a reasonable time, you may contact the California Attorney General at oag.ca.gov/privacy.