Privacy notice
Last updated 29 October 2026
This notice explains how Doddle Software Limited processes personal data in connection with Scrollhound (the "Service"): what we collect, why, on what legal basis, how long we keep it, who receives it, and the rights you have. It covers three groups of people: people who use the Service (sections 2 to 4), people whose publicly available posts the Service reads (section 5), and people who visit scrollhound.com (section 6). Terms defined in our terms of service have the same meaning here.
1. Who we are
Doddle Software Limited is a company registered in England and Wales under company number 16256282, with its registered office at 127 Foundry Lane, Southampton, SO15 3LD, England. We are the controller of the personal data described in this notice. For any question about this notice or your personal data, email hello@scrollhound.com.
2. Personal data we collect from users
| Personal data | Purpose | Legal basis (UK GDPR Art. 6(1)) |
|---|---|---|
| Email address | Creating and identifying your Account; sending sign-in codes; sending messages about your Account, billing and changes to our terms | (b) contract |
| Sign-in codes (stored only as hashes) and the IP address that requested each code | Signing you in; detecting and limiting abuse of sign-in | (b) contract; (f) legitimate interests in securing the Service |
| Browser sessions and API tokens (stored only as hashes), and the device names you approve | Keeping you signed in on the website, the command-line tool and Connected Applications; listing your signed-in devices so you can revoke them | (b) contract |
| Connected Applications: the name of each application you authorise, the date of authorisation and the permissions granted | Letting Claude, ChatGPT and other Connected Applications use the Service for you; listing them so you can disconnect them | (b) contract |
| Request log: the action requested, a short summary of the input (a link or search terms), Reads used, time taken and result | Counting Reads and limits; showing your usage; support; diagnosing faults; preventing abuse | (b) contract; (f) legitimate interests in operating and protecting the Service |
| If you connect X: access and refresh tokens (encrypted) and your X bookmarks | Synchronising and searching your bookmarks at your request | (b) contract |
| Purchases: what you bought, amounts, dates, the country used for tax, and Stripe's customer, subscription and payment references | Adding Reads and Plans to your Account; processing refunds; keeping accounting records | (b) contract; (c) legal obligation (accounting) |
| Emails you send us | Answering your enquiry | (f) legitimate interests in providing support |
We do not sell or share your personal data for advertising, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We do not receive or store your card details; Stripe processes them.
3. How long we keep users' data
| Personal data | Retention period |
|---|---|
| Email address | Until your Account is deleted |
| Sign-in codes and their IP addresses | 24 hours after the code expires (each code is valid for 10 minutes) |
| Browser sessions | Until you sign out, or 30 days after sign-in, whichever is earlier |
| API tokens | Until you revoke them, or one year after they are issued, whichever is earlier |
| Connected Application authorisations | Until you disconnect the application or your Account is deleted |
| Request log | While your Account is open. On deletion we erase the input summaries and keep only usage counts that are no longer linked to you |
| X tokens and bookmarks | Until you disconnect X or your Account is deleted. Once every 24 hours we also delete any bookmarked post that X reports as deleted or edited, or as belonging to an account that has been protected, suspended or deactivated |
| Purchase records | Six years from the end of the financial year in which the purchase was made, as required by UK accounting law |
| Support emails | Two years from our last reply |
4. Who receives users' data
- Our hosting and infrastructure provider, which runs the Service and our website analytics (section 6) and stores our data in Western Europe, as our processor.
- Our email delivery provider, which sends sign-in codes and Account messages, as our processor.
- Platforms and Data Providers. When you make a request, we send the link or search terms to the Platform's Official Interface or to a Data Provider, and, for videos without captions, to a speech-to-text provider. They receive the request only; we do not send them your email address or any other information that identifies you.
- YouTube and Google. The Service uses YouTube API Services to search YouTube and read videos, channels and comments. Google receives the request, not your identity, and processes it under the Google Privacy Policy. We do not request access to your Google or YouTube account.
- X, if you connect your X account. X receives the read-only authorisation you grant and returns your bookmarks to us. You can revoke it on the Connections page of your Account or in your X settings.
- Stripe and its Onelink service, the Merchant of Record for our sales, which process your purchase, payment details, tax and invoices as an independent controller under Stripe's privacy policy. We receive your email address, what you bought and when, the country used for tax, and Stripe's references, and never your full card details.
- Connected Applications that you authorise, which receive the results of your requests and process them under their providers' own terms.
- Professional advisers, such as our accountants and lawyers, under a duty of confidentiality.
- Courts, regulators and law enforcement authorities, where the law requires us to disclose data.
Our processors may use personal data only on our documented instructions.
5. People whose publicly available posts the Service reads
This section gives the information required by Article 14 of the UK GDPR and the EU GDPR to people whose content the Service reads but who may not use the Service themselves.
5.1 What we process. When a user asks the Service to read a post, thread, profile or video, we obtain the publicly available content from the Platform concerned. This may include your username, display name, profile description, follower and engagement counts, the text of your posts and comments, the date they were published, and the transcript of what is said in your public videos. We do not obtain content that is available only to logged-in users, private messages, or content from private or protected accounts.
5.2 Sources. The content comes from Reddit, X, YouTube, TikTok, Instagram, LinkedIn and Hacker News. We obtain it through those Platforms' Official Interfaces and through Data Providers, which are companies that supply access to publicly available content from the Platforms.
5.3 Purpose and legal basis. We process this content to return it, with a link to its source, to the user who requested it, so that they can read and cite public discussion accurately. Our legal basis is legitimate interests (UK GDPR Art. 6(1)(f)): our interest and our users' interest in accessing public discussion that the author chose to publish. We do not use it to build profiles of individuals, and our terms prohibit users from doing so.
5.4 Retention. We keep a temporary copy for the following periods, then delete it:
| Content | Kept for |
|---|---|
| Hacker News front pages, items and searches | 5 to 15 minutes |
| Reddit listings, posts and comments | 10 minutes to 1 hour |
| Search results and comments on X, YouTube, TikTok, Instagram, LinkedIn and Reddit | 6 to 12 hours |
| Posts, threads, profiles, company pages, ads, video details and subreddit rules | 24 hours |
| Video transcripts | 30 days |
A deletion job removes expired copies once every 24 hours.
5.5 Recipients. The content is returned to the user who requested it and to the Connected Application they use. It is stored by our hosting provider as described in section 4.
5.6 Your rights. You may object to this processing at any time, and you have the other rights described in section 9. To ask us to delete our copy of your content and to stop reading it, email hello@scrollhound.com with a link to the content or your username on the Platform. We will delete our copy within 5 working days of receiving your request.
6. Visitors to scrollhound.com: website analytics
6.1 We run our own website analytics on scrollhound.com, including its documentation and blog. It is operated by Doddle Software Limited on its own system, hosted on Cloudflare, and is used only for Scrollhound's own analytics. It does not run on the Account pages at api.scrollhound.com.
6.2 When you visit scrollhound.com, the analytics records:
- the pages you view and the links you follow, including links to sign up and to choose a Plan;
- where your visit came from: the referring website and any campaign details in the link you followed;
- your approximate location (country, region and city), derived from your IP address; and
- your device type, browser and operating system.
6.3 With your consent: the analytics sets one first-party cookie, hq_vid, on scrollhound.com. It contains a random identifier, lasts one year, and lets us recognise your browser on later visits. We set it only after you choose Accept in the cookie banner. You may withdraw your consent at any time under Cookie settings at the bottom of any page; the cookie is then no longer used.
6.4 Without your consent: no cookie is set and nothing is stored on your device. To count each visitor once a day, the analytics creates a code from your IP address, your browser details and a random value that is deleted after two days. In both cases, it never stores your IP address or your full browser details.
6.5 If you are signed in to your Account and have chosen Accept, the analytics links your visits to the email address of your Account, so that visits from different browsers are recognised as yours.
6.6 We keep visit records for 13 months. After that we keep only daily totals, which identify no one.
6.7 The analytics does not run, and the cookie banner is not shown, when your browser sends a Global Privacy Control signal.
6.8 Our legal basis is your consent (UK GDPR Art. 6(1)(a)) for the hq_vid cookie and for linking visits to your Account, and legitimate interests (UK GDPR Art. 6(1)(f)) for counting visits without a cookie: understanding which pages and channels bring visitors to Scrollhound. You may object to the processing based on legitimate interests at any time by emailing hello@scrollhound.com, or by turning on Global Privacy Control in your browser.
7. International transfers
Some of our processors and the Platforms and Data Providers we use process data outside the United Kingdom, including in the European Economic Area and the United States. Where a transfer is made to a country without UK adequacy regulations, we rely on the UK–US data bridge (where the recipient is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Email hello@scrollhound.com for a copy of the safeguard that applies.
8. Cookies and browser storage
8.1 We use four cookies:
sh_session, set by and readable only on api.scrollhound.com, keeps you signed in. It is strictly necessary and lasts 30 days, or until you sign out.sh_csrf, set by and readable only on api.scrollhound.com, protects the forms on your Account pages against cross-site request forgery. It is strictly necessary and lasts until you close your browser.sh_signed_in, set by api.scrollhound.com and readable on scrollhound.com and its subdomains, makes the website header show "Dashboard" instead of "Sign in". It contains only the value "1" and no personal data, and lasts 30 days, or until you sign out.hq_vid, set on scrollhound.com only after you choose Accept, is our website analytics cookie described in section 6. It contains a random identifier and lasts one year. Withdraw consent under Cookie settings at the bottom of any page.
8.2 The documentation remembers which sidebar sections you have opened in your browser's session storage, which is cleared when you close the tab, and your cookie choice in your browser's local storage (sh_consent), so the banner is shown once. We use no advertising cookies. Stripe's checkout page sets its own cookies, described in Stripe's privacy policy.
9. Your rights
9.1 Under UK data protection law, and the EU GDPR where it applies, you have the right to: access the personal data we hold about you; have it corrected; have it erased; restrict or object to its processing; and receive it in a structured, machine-readable format or have it sent to another controller. Where we rely on legitimate interests, you may object at any time.
9.2 To exercise a right, email hello@scrollhound.com. We may ask you to confirm your identity. We will respond within one month of receiving your request. If your request is complex, we may extend that period by up to two further months, and we will tell you within the first month if we do.
9.3 You can also act directly: revoke devices and disconnect Connected Applications on the Connections page of your Account, run scrollhound logout, and disconnect X, which deletes the X tokens and every stored bookmark. To delete your Account, email us from your Account's email address.
9.4 You have the right to complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint) or, if you live in the European Economic Area, to the data protection authority of your country. We ask that you contact us first so that we can try to resolve your concern.
10. Security
All data is transmitted over HTTPS. Sign-in codes, session cookies and API tokens are stored only as hashes, and X tokens are encrypted with AES-256-GCM. Access to production data is limited to the people who operate the Service.
11. Children
The Service is not available to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe we hold such data, email hello@scrollhound.com and we will delete it.
12. Changes to this notice
We update this notice whenever our processing changes and show the date of the latest version at the top. If a change affects how we use your personal data, we will notify you by email before it takes effect.