Privacy Policy

Last updated 19 October 2026.

This policy covers FishOut, the social listening service at fishout.ai and app.fishout.ai, operated by Covariant Labs ("we", "us"). It explains what we collect, why, and how long we keep it.

FishOut monitors public posts and comments on third-party platforms and brings the ones matching your keywords into one inbox. Two different kinds of personal data are involved, and they are treated differently: the data of the people who use FishOut, and the data of the people whose public posts FishOut collects. Both are covered below.

What FishOut does not do

Stating this first, because the answer is short and people ask. FishOut does not:

• post, comment or message anywhere on your behalf — it drafts replies, and you send them yourself from your own account;
• record or process audio or video;
• read your email, your calendar, or any private account you hold on a monitored platform;
• collect posts from private accounts, closed groups, or anywhere that requires a login to view;
• sell your data, or share it with anyone for their own marketing.

Data about you, as a FishOut user

Account and workspace

• Your name and email address, and a hashed password or the identifier from the provider you signed in with.
• Your organisation, its projects, its members and their roles.
• Your plan and billing status.

What you configure

• The keywords you track, their kind and Means line, their filters and the platforms each one runs on, and each project’s Brief, labels and Voice.
• Your agents — their conditions, thresholds and actions.
• Notification channels and their destinations: a chat channel or group (Slack, Microsoft Teams, Google Chat, Discord, Telegram, Mattermost, ntfy, Feishu/Lark, DingTalk or WeCom), an email address, a Zapier hook, or a webhook URL you supply.
• API keys you create. These are shown once at creation and stored hashed; we cannot recover the original value for you.

How you use the product

Which mentions you open, assign, snooze or archive, so the product can show you a queue that reflects your team's work. Plus ordinary operational logs — request times, error traces and IP addresses — kept for security and debugging.

We also use PostHog for product analytics in the app: which pages you visit and actions such as creating a keyword, tied to your account and workspace, so we can see how FishOut is used and improve it.

The website

fishout.ai uses Plausible Analytics, which is cookie-free and does not track visitors across sites, and Google Tag Manager. If you subscribe to the newsletter, your email address is processed by our form provider for that purpose only, and you can unsubscribe from any email.

Data about other people, from public posts

This is the part specific to a social listening tool, and worth reading carefully.

When one of your keywords matches a public post, FishOut stores that post as a mention: its text, the author's public handle and display name, the platform and source, the timestamp, the permalink, public engagement counts, and — where the platform exposes it — the parent post and surrounding replies for context. FishOut also generates data about that post: a relevance rating and the reasons for it, labels, a sentiment, a language, a Reply call and a draft reply.

We collect this only from content the platform publishes openly, and only where the platform's own terms and API permit it. We do not attempt to identify anyone beyond the identity they have already made public, and we do not build profiles of individuals across platforms.

For this data you are the controller and FishOut is your processor: you choose the keywords, and you decide what is done with what comes back. If someone asks you to remove a post of theirs from your workspace, you can delete it, and you can ask us to do so on your behalf.

AI processing

Relevance, labels, sentiment, language, the Reply call and reply drafting are done by large language models. To produce them, the text of a mention and the context around it is sent to the model provider that performs the inference. We do not use your data, or the mentions in your workspace, to train our own models.

Who else processes your data

FishOut runs on third-party infrastructure. That includes hosting and database providers, an email delivery provider, a payment processor, analytics as described above, and the AI providers that perform inference. Each processes data only to deliver the service, under contract. For a current list of sub-processors, or to be told when it changes, get in touch.

We also send data where you tell us to — to the Slack channel, webhook or other destination you configure. Once it arrives there, that service's own privacy policy governs it.

How long we keep things

• Mentions: one year on the free plan, five years on every paid plan. Archived mentions stay searchable for as long as they are kept.
• Anything you delete: removed from the product immediately and purged from backups within 30 days.
• Your account: kept while the account is open. See Data Deletion to close it and remove everything.
• Operational logs: a short rolling window, then discarded.

Your rights

You can access, correct, export or delete your data at any time — most of it directly in the app, and the rest by asking us. Depending on where you live you may also have the right to object to or restrict processing, and to complain to your local data protection authority. We do not charge for any of this and we will not make the product worse for you because you asked.

Security

Data is encrypted in transit and at rest. Access is limited to the people who need it to run the service. API keys are stored hashed. No system is perfectly secure, and we will not pretend otherwise — if a breach affects you, we will tell you.

Children

FishOut is a business tool and is not directed at children. We do not knowingly collect account data from anyone under 16.

Changes

If this policy changes in a way that affects you, we will say so before the change takes effect rather than quietly updating the date at the top.

Contact

Questions about this policy, a request about your data, or a request about a post of yours that appears in someone's FishOut workspace: contact us.