Your voice, your data, your control.

We built VoiceMoat assuming creators will be paranoid, and rightly so. Here’s exactly how we handle your data.

[ our principles ]

Four commitments we won’t walk back.

Your voice profile is yours alone.

We never use your posts, voice profile or generated content to train shared models, and we never sell data. Your content is yours. Public posts your extension reads go into a shared library, described below.

Explicit, minimal data collection.

We only collect what we need to run the product: account details, your connected Twitter/LinkedIn accounts, your voice profile training data, and your drafts. No tracking scripts sold to ad networks. We store public posts with their author’s public name and photo, never private profile data.

Encryption by default.

All traffic uses HTTPS. Data at rest is encrypted by Supabase. Social access tokens are also encrypted by us (AES-256-GCM) before they are stored. Secrets and API keys live in Vercel’s encrypted environment settings, never in the code repository.

Data deletion from Settings.

Delete your account from Settings and any scheduled posts are canceled at once. Signing back in with the same Google account within 30 days restores the account; after that, your voice profiles, drafts and analytics are permanently deleted. There is no self-serve export yet: email founder@voicemoat.com for a copy of your data.

[ under the hood ]

The security stack, in public.

Hosting

Vercel (US / EU edge network)

Database

Supabase managed Postgres with RLS enforced per user

Auth

Supabase Auth. Google is the only way to sign in. Twitter and LinkedIn are connected separately, through their own OAuth.

Error tracking

Sentry. PII scrubbed before transmission.

Analytics

Vercel and Ahrefs (cookieless; Ahrefs on marketing pages only), plus GA4. PostHog (EU-hosted) for in-dashboard product analytics and session replay. No ad-targeting or data resale.

Secrets

Stored in Vercel’s encrypted environment settings

Payments

Dodo Payments (merchant of record). We never store card details.

[ the extension ]

It only ever works in your own session.

It works only through your own session.

The extension works only through your own signed-in session and only on the page you have open. It reads your own posts, comments and analytics. When you press a VoiceMoat button on a post, it sends that post’s text to draft a reply, comment or remix, or to save it to your Library; Draft from my timeline or feed sends the text of a few posts on your screen. When you refresh Inspiration or Replies, or track a creator, it also reads a small batch of public LinkedIn posts from your home feed, that creator, or a hashtag, and adds them to a shared library of public posts that every VoiceMoat user can browse. With each post it keeps the author’s public name and photo and the public counts, never who showed it to you. It never reads your messages.

Never sends your login cookie.

It never sends your Twitter or LinkedIn login cookie to VoiceMoat or anyone else, and it never posts on LinkedIn for you: it only fills LinkedIn’s own comment box or Start a post window, and you press Comment or Post. Reads stay slow and human-paced, so your account stays safe.

[ responsible disclosure ]