Security and data
What FishOut collects, what it never collects, how long it keeps things, and how to get it all back or delete it.
FishOut collects public posts on your behalf, which makes two questions worth answering plainly: what is held, and who it belongs to.
The Privacy Policy is the authoritative version. This page is the practical one.
What FishOut never collects
- Anything from a private account, closed group or DM, or anywhere that needs a login to read.
- Audio or video. FishOut does not record anything.
- Your email or calendar. There is no integration that reads either.
- Any account of your own on a monitored platform. FishOut does not connect to your Reddit or X account, because it never posts.
What it does collect
Your account and workspace, the Brief, keywords, labels and agents you configure, notification destinations, and hashed API keys. Plus, for each mention: the post text, the author's public handle, the platform and source, timestamps, the permalink, public engagement counts, and the surrounding thread where the platform exposes it.
Two kinds of data
Data about you is yours. Data about the people whose public posts get collected is different: you are the controller of it, FishOut is your processor. You chose the keywords, so you decide what happens to what comes back — including honouring a request to remove something.
If someone asks you to delete a post of theirs from your workspace, delete the mention. If they contact us directly, we will pass it on and remove it on your behalf where we can. See Data Deletion.
AI processing
Triage, reply drafting, the Daily brief and the website read at sign-up send the text of a post, its context and your Brief to the model provider performing the inference. Your data is not used to train our models.
Notification messages to chat apps, push and email carry links and triage results, never the post text itself.
Retention
| Kept | |
|---|---|
| Mentions, Free plan | 1 year |
| Mentions, paid plans | 5 years |
| Anything you delete | Gone from the product immediately, purged from backups within 30 days |
| Your account | Until you ask us to delete it |
Archived mentions are kept for the same period as any other — archiving hides, it does not delete.
API keys
Keys are shown once and stored hashed; nobody, including us, can recover the original. Scope them narrowly, set an expiry, and revoke them under Settings → API & MCP when an integration is retired. See API permissions.
Getting your data out
The REST API and the MCP server return everything the dashboard shows, and saved reports download a snapshot of the figures. Get what you need before deleting anything — deletion is permanent and there is no undo.
Deleting
Delete a keyword or a project from the app, and an organisation from its settings — every project, keyword, agent and mention in it goes too.
To delete your account, go to Account → Delete account and choose Request account deletion. It opens an email to help@fishout.ai; we confirm it is you, then remove your profile and sign-in. Mentions, keywords and agents stay with their organisations, so transfer or delete any organisation you own first.
The full procedure, including what we are legally required to keep, is on Data Deletion.