Privacy Policy

This policy explains how CatchBack handles information collected through the CatchBack Creators portal. The program is for adults age 18 and older and is not directed to children.

Information we collect

• Account and application information: name, email, phone, country, login identifiers, social handles, follower counts, sample links, platform preferences, referral information, and application answers.
• Program activity: submitted post URLs, public social profile and post information, public view counts, challenge progress, XP, levels, review decisions, monitoring state, referrals, rewards, creator earning records, CatchBack transfer status, and support communications.
• Verification records: automated provider responses, accepted public view counts, provider failures, and administrator review notes.
• Public Instagram comments: comment ID, CatchBack Instagram media ID, normalized public username or Instagram-scoped account ID, and event time. We do not retain comment text for creator challenges.
• Connected CatchBack account: the verified CatchBack account ID, email, connection time, creator earning amounts, and transfer identifiers. The creator portal does not store your CatchBack password or CatchBack authentication session after the account connection completes.
• Technical information: authentication sessions, cookies or local storage needed for sign-in and preferences, security and diagnostic data, page and interaction analytics, browser information, and IP-derived request data handled by our infrastructure providers.

Public social information and verification

Submitted posts and their public engagement metrics are public information, but we still use them only for legitimate program operations. CatchBack uses HikerAPI for public Instagram Reel data, Bright Data for public TikTok posts and Facebook Reels, and the YouTube Data API for public YouTube Shorts without asking for your social-media password or requiring you to connect a creator login. We compare the returned post identifier and author handle, profile ID, or channel ID with the submission before accepting a view count. If automated verification is unavailable, an administrator may open the public post and record its visible view count manually. YouTube and Facebook verification do not require creator OAuth permission.

For Facebook, CatchBack collects only public Page/profile and Reel information needed for application review, identity validation, follower snapshots, and view verification. The creator portal does not publish to Facebook or manage Pages, comments, likes, reactions, Stories, Live video, ordinary Facebook posts, or private content.

For Instagram comment challenges, Meta sends CatchBack events from comments made on CatchBack's connected professional Instagram account. We match the public comment identity to the Instagram handle already on a creator's application. Ambiguous or unmatched handles remain unattributed until reviewed. Creators do not connect their Instagram accounts for this process.

How we use information

We use information to review applications and posts; create and secure accounts; connect your creator identity to your CatchBack account; verify public performance; calculate current-rate earnings and positive true-ups; transfer earnings to CatchBack; operate referrals and rewards; communicate lifecycle decisions; investigate fraud or guideline violations; maintain financial and audit records; improve the portal; and meet legal, tax, accounting, and security obligations.

Service providers

We use separate Supabase projects for the creator portal and the main CatchBack service. The creator project handles program authentication, applications, submissions, automated verification records, and earning audit records. The main CatchBack project authenticates the account you connect and holds the balance used for packs and eligible withdrawals. We also use Vercel for hosting and privacy-controlled product analytics, Resend for program and authentication email, HikerAPI for Instagram verification, Meta for public Instagram comment events, Bright Data for TikTok and Facebook verification, Google's YouTube Data API for YouTube Shorts verification, and Meta and Google for measuring which of our ads bring in applicants. These providers receive only the information reasonably needed to perform their services and operate under their own terms and privacy practices.

Cookies, local storage, and analytics controls

The portal uses cookies or similar browser storage for authentication, session continuity, referral capture, and necessary preferences. We use Vercel Analytics and custom funnel events on public routes only. We also use anonymous performance measurements across public and portal routes to identify slow loading and interaction issues; private query strings, fragments, and creator identifiers are removed before those measurements are sent. All analytics and performance measurements are disabled when the browser communicates Do Not Track or Global Privacy Control.

This site does not load Meta, TikTok, or Google advertising or tracking scripts in your browser. When you arrive through a link or ad, we record which one brought you here in a first-party cookie and save it with any application you submit. When you submit an application, and again if it is approved, we send Meta a hashed (scrambled) copy of your email and phone number, along with your IP address and browser type at submission, and we send Google the ad click ID, so we can measure which ads bring in applicants.

When you submit an application or a post, we record the network it came from and a random identifier stored in a first-party cookie on your browser. We use them only to notice when more than one application or account comes from the same person, and we do not share them with advertisers.

When information is disclosed

We may disclose information to the providers above, between the creator portal and main CatchBack service to connect your account and transfer earnings, when you direct us to, to protect CatchBack or others, to investigate misuse, in connection with a business transaction, or when required by law. We do not sell creator application information.

Retention and security

We keep information for as long as reasonably needed to operate the program, maintain earning and transfer records, document content rights and verification decisions, resolve disputes, prevent repeat abuse, and satisfy legal, tax, accounting, and security obligations. Retention can differ by record type. We use access controls, row-level database policies, and other administrative and technical safeguards, but no online service can guarantee absolute security.

Your choices and privacy requests

You can update certain profile information in the portal and manage wallet or withdrawal details in CatchBack. You may request access, correction, deletion, or information about how your data is handled, subject to applicable law and records CatchBack must retain. You may also enable Do Not Track or Global Privacy Control in a supported browser. Requests should come from the email associated with your account so we can verify them.

Changes and contact

We may update this policy as the program, providers, or legal requirements change. The updated date above identifies the current version. For privacy questions or requests, email partnerships@catchback.com.