Privacy Policy

Last updated: October 19, 2026

This explains what ShowMRR (showmrr.com) collects, why, who else handles it, and what you can ask us to do. Questions or requests: support@showmrr.com.

What we collect

• Your account: email, name and a password (stored only as a one-way hash). If you add them: avatar, X/Twitter handle and bio.
• Your startups and listings: name, tagline, description, website, category, tech stack, and anything you put in a marketplace listing or inquiry (buyer name and email).
• Your co-founder profile, if you create one: what you are looking for, your skills, your commitment and a short bio.
• Revenue data: if you connect Stripe, Lemon Squeezy or Polar, we store the API key you give us, encrypted, and the totals we read with it: monthly recurring revenue, number of customers, and a daily history of those numbers. We do not store your customers' names, emails or individual payments.
• Public revenue pages: for some listings we read a revenue figure that the founder publishes on their own website, once a day, respecting that site's robots.txt. We store the number, the address of the page and the date we read it.
• How the site is used: pages you view and actions you take (see "Analytics and recordings" below), and error reports when something breaks.

What we use it for

• To run your account, show your public profile and the revenue labels described in the Terms.
• To read your connected provider's revenue totals and keep them up to date (about hourly).
• To send emails you need, such as account and verification messages.
• To find and fix bugs and understand which parts of the site are used.

We don't sell your data and we don't use it for advertising.

What is public

Startup profiles, revenue figures with their verified or self-reported label, and the founder name shown on a listing are public. A co-founder profile is public too, with your name and X handle. Your email address and password are not. A marketplace inquiry is sent to the seller of that listing with the buyer's name and email.

Who else handles data

• DigitalOcean hosts the server and the database, and stores our nightly database backups (in DigitalOcean Spaces).
• Lemon Squeezy processes payments for paid plans. We never see your card number.
• PostHog provides analytics and session recordings.
• Bugsly (bugsly.dev) receives error reports. It is run by the same people who run ShowMRR.
• AISend (aisend.app) sends our emails. It is also run by the people who run ShowMRR.
• Google, when our server loads a startup's website icon from Google's favicon service. The request names the startup's website, not you.
• The payment provider you connect, which answers the requests we make with your key.

We may also disclose data if the law requires it.

Analytics and recordings

We use PostHog to count visits and to record sessions: a replay of what happens on the screen as you use the site, including clicks and page changes, plus browser console messages. Password fields are masked. Other text you type on the site, such as a startup description, can appear in a recording. If you sign in, recordings can be linked to your account. Your browser keeps a sign-in token and an analytics identifier in local storage or cookies. You can block these with your browser settings or an ad blocker; ShowMRR still works, but you may be signed out on each visit.

How long we keep it

We keep your account data until you ask us to delete it. Revenue history stays as long as the startup is listed. Nightly database backups are kept for 7 days and then expire, so data you ask us to delete can remain in a backup for up to 7 days.

Your choices

• Disconnect revenue: disconnect a provider in ShowMRR, or delete the API key at the provider. Either stops our access.
• See, correct or delete your data: email support@showmrr.com from your account address and we will do it by hand. This includes deleting your account and your startups.
• Remove a listing about your product: if you own a product that appears unclaimed, email us and we will change or remove it.

Security

Passwords are hashed, provider API keys are encrypted, and traffic is sent over HTTPS. No system is perfectly secure; if something that affects you goes wrong we will tell you.

Children

ShowMRR is for people who run or evaluate businesses and is not meant for children. We don't knowingly collect data from them.

Changes

If we change this policy we update the date above and, for significant changes, tell account holders.