Privacy
Privacy Policy
Last updated September 7, 2026
Byline Agent is run by Linchpin Resources LLC, an Oklahoma company. This page explains what the app collects, why it holds each thing, every company it sends data to, how long we keep it, and how you get all of it back or delete it.
Two things up front. We do not use your content to train any AI model, and Anthropic, which does the writing, does not train on it either. We do not sell your personal information and we do not share it for advertising.
What we collect
Your account
Your name, your company, your LinkedIn address, and the expertise areas, audience, and topics you enter during setup. Your email address and password live with Supabase Auth, our sign-in provider. We also store your Stripe customer reference and whether your subscription is active.
Your writing and material
The writing samples you paste and the voice profile built from them. Your Story Core interview answers. Every draft the app makes for you: newsletter issues, long-form pieces, social posts, video scripts, briefings, and authority audits. Your publication settings and the sources you choose. The transcripts of voice sessions you hold with the Editor.
Your subscriber list
The email addresses of the people on your list, a record of which issues went out to them, and the opens and clicks on those issues.
How you use the app
Daily usage counts and rate limit counters that keep the service fair, the items you schedule, the automation runs behind them, and, if you arrived through one, your invite code or early access request. We also record the IP address a request comes from, which is what makes the rate limits and the bot check work. It is not tied to your drafts.
Connected accounts
The app supports six platforms: LinkedIn, X, Threads, Bluesky, Instagram, and Facebook. If you connect LinkedIn, X, Threads, or Bluesky, we store the access token for that account so the app can post the drafts you approve. Instagram and Facebook have no token to store. For those two the app prepares the post and opens the platform for you. Facebook has one other route: if you turn on the posting helper we run, a scheduled Facebook post can be sent for you from a browser session signed in as you on a machine we control, rather than through a stored token. That helper is off unless you ask for it.
Files you upload
Brand assets and logos you upload, and the audio editions the app generates from your issues.
Why we hold each one
Account details
So you can sign in, so the drafts carry your name and your context, and so we know your subscription is current.
Your writing and material
So the app can learn how you write, draft in your voice, and let you return to any piece later. This is the product.
Your subscriber list
So you can send an issue to the people who asked for it, and see whether they opened it.
Usage records
So we can keep the service running, hold everyone to the same limits, and fix what breaks.
Connected account tokens
So the app can post to a channel you connected, and only the post you approved.
Card details
We do not hold them. Your card goes straight to Stripe. Byline Agent never sees or stores a card number.
Who we send it to
Byline Agent runs on other companies. Here are the companies that receive your data and what reaches each one.
Vercel
Hosting. All traffic to the site and the app passes through Vercel.
Supabase
Database, sign-in, and file storage. Everything the app stores lives here.
Anthropic (Claude)
The writing itself. Drafting, editing, the interview, and the quality checks send your material and your voice samples to Anthropic. The Anthropic API does not train on this content.
Google (Gemini)
Transcription and masthead images. When you record audio or video in the app, that recording goes to Google to be turned into text. When you generate a masthead image, the prompt for it goes to Google.
Firecrawl
Research. Firecrawl receives the URLs and search terms the app uses to find source material.
Resend
Email delivery. Resend receives the content of an issue and the addresses on your own list, plus the account email we send to you.
Stripe
Payment. Your card details go straight to Stripe. We receive a customer reference and your subscription status back.
ElevenLabs
The voice Editor and audio editions. ElevenLabs receives your speech during a voice session and the text you want spoken aloud.
Cloudflare Turnstile
The bot check when you sign up, sign in, reset your password, or run the free audit.
LinkedIn, X, Threads, Bluesky, Instagram, and Facebook
Only when you publish, and only the post you approve. For LinkedIn, X, Threads, and Bluesky, the app sends that post through the account you connected. For Instagram, the app prepares the post and opens the platform for you, so you are the one who sends it. Facebook works the same way unless you turn on the posting helper described above, which sends a scheduled Facebook post for you.
Your browser also fetches files from public content networks. Fonts come from Google on every page, including this one. Opening the Recording Studio pulls down code and a model file, and the voice Editor may pull one small piece of code the same way. Those networks see that a browser asked for a file, along with the usual request details such as your IP address. They do not receive your name or anything you wrote.
We do not sell personal information, we do not share it for advertising, and we do not use your content to train any model.
If you use the free audit without an account
The authority audit is open to anyone. If you run it, we store your answers and, if you give one, your email address, so we can send you the result. If you later create an account with that same audit link, the audit moves into your account and is covered by everything else on this page. If you want an audit deleted before then, email us and we will remove it.
How long we keep it
We keep your data for as long as your account is open, because the archive is the point. When you delete your account we remove your account, everything you wrote, your subscriber list, the files you uploaded, any social account connection, and any authority audit you ran before you signed up. Deleting your account cancels your subscription first, so you are not charged again.
Stripe keeps the payment records it is legally required to keep. The other companies listed above hold what we sent them under their own retention schedules.
Your rights, and the two buttons that make them real
You do not have to ask us for these. Both live in the Brand and Setup area of the Studio, under Your account.
- Export everything. Download a single JSON file with everything Byline holds for you: your profile, your voice profile, your interview, every draft, your sources, your contacts, your send history, and your schedule. For a connected social account it lists the platform and when you connected it, never the access token.
- Delete your account. This removes your account, everything you wrote, your subscriber list, the files you uploaded, any social account connection, and any authority audit you ran before you signed up. It cancels your subscription first, so you are not charged again. Deletion is permanent and cannot be undone. Stripe keeps the payment records it is legally required to keep.
You can also correct anything in your profile at any time, or write to us with a question about your data at dgardenhire@linchpinresources.com.
How we protect it
- Your data is encrypted in transit and at rest.
- Access to your rows is scoped to your own account and enforced in the database itself, not only in the app.
- The browser cannot write to the database at all. Every write goes through a server route that checks who you are first, with one exception: an image you upload goes straight from your browser into your own folder in file storage.
- Passwords are handled by Supabase Auth. We never see yours.
- File storage is public to anyone holding the link. A logo you upload or an audio edition the app generates can be read by anyone who has its URL, on purpose, because those files have to load inside an email and a podcast feed. Do not put anything private in them.
We want to be straight with you about the limits of that. Byline Agent holds no SOC 2 report, no ISO certification, and no HIPAA compliance, and we do not claim any. Do not put protected health information or other regulated data into the app.
Children
Byline Agent is for adults. You must be 18 or older to create an account. We do not knowingly collect anything from a child. If we learn that an account belongs to someone under 18, we delete it.
Changes to this policy
When we change this page we update the date at the top. If a change matters to you, meaning it changes what we collect, who we send it to, or what we do with it, we email the address on your account before it takes effect.
How to reach us
Write to dgardenhire@linchpinresources.com. A person reads it. Byline Agent is operated by Linchpin Resources LLC, an Oklahoma limited liability company.