Privacy Policy

1. Who I am

Lightbulb Moment Labs, Inc. ("the Company", "I", "me") runs hellotrillion.ai and the Trillion project from Montana, in the United States. Kevin Fremon is the person behind it and the one who answers the email.

Questions about this policy, or a request about your own data, go to [email protected].

2. What I collect, and why

Nothing here is collected speculatively. Each item exists because a specific part of the site needs it.

• Waitlist: your email address, and the nickname and GitHub username if you choose to give them. Also the page that referred you and your browser's user agent string, which tell me where signups come from. The email address is what the verification link is for, and what a future launch announcement would go to.
• Collaborator applications: your name, email address, a link to your intro video, your operating system, your GitHub username, a social profile link, any project links, and whatever you write in the pitch. This is the application itself; I read it by hand.
• Accounts: if you sign in to the roadmap, Clerk handles the sign-in and I store the account id it gives me, along with your display name, avatar, GitHub username, and your email address for notifications. I never see or store your password, and sign-in through GitHub or Google means there is no password here at all.
• Roadmap activity: the ideas you submit, the comments you post, the items you vote for, and anything you add to a crew profile such as a photo, a short bio or a link. Ideas and comments are public by design.
• Email records: for each message sent, whether it was delivered, bounced, was marked as spam, or was unsubscribed from. This is what keeps me from emailing an address that does not want it.
• Anti-abuse: when you submit the waitlist or collaborator form, your IP address is recorded briefly so the same address cannot flood the form. Cloudflare Turnstile also runs a challenge on those forms to tell people from bots.
• The crew agreement: if you sign it, the signature record includes your typed name, the time, your account id, your IP address and your browser's user agent. A signature needs to be evidence of who signed and when.
• Prompt pages: page views and clicks on Copy prompt, Download, unlock and the ad. These are stored with no IP address and no cookie. The identifier attached to them is a one-way scramble of your network address, browser and the date, so it changes every day and cannot be turned back into you or followed across days.

3. What I do not do

I do not sell personal information, and I do not share it with anyone for advertising or for building profiles of you.

There is no third-party analytics product on this site, no advertising network, and no tracking pixel following you from page to page.

I do not use your data to train an AI model.

4. Cookies and browser storage

There are no advertising or analytics cookies on this site. What exists is functional:

• A session cookie set by Clerk when you sign in, which is what keeps you signed in.
• A cookie set by Cloudflare Turnstile on pages with a form, as part of telling people from bots.
• A few values your own browser keeps locally, such as whether you unlocked the prompts and whether you already joined the waitlist. These never leave your device and I cannot read them.

5. Who else handles your data

The site runs on services that process data on my behalf. Each one sees only what its job requires, and none of them may use it for their own purposes:

• Supabase: the database and file storage where the above is kept.
• Clerk: sign-in and account management.
• Resend: sending email, and reporting what happened to each message.
• Cloudflare: Turnstile, the bot challenge on the forms, and the network in front of the site.
• DigitalOcean: the servers the site runs on.
• These providers are based in the United States, which is where your data is stored and processed.

6. Email you get from me

There are three kinds. A verification email when you join the waitlist, which is the only way to confirm the address belongs to you. Notifications about your own roadmap ideas, when their status changes or somebody comments, which you can switch off in your account. And occasional updates about Trillion to people on the waitlist.

Every one of them carries an unsubscribe link that works without signing in, and unsubscribing takes effect immediately, including for a message that is mid-send.

7. How long I keep it

Waitlist entries and collaborator applications are kept until you ask me to remove them, or until the project no longer needs them. Unverified waitlist entries are kept so the same address is not asked to verify twice.

Roadmap content stays up as long as the board does. If you delete your account, your ideas and comments stay but are detached from you and shown without your name, so a conversation does not lose half its shape.

Signed agreements are kept as a record of what was agreed, for as long as the licence they granted matters.

Anti-abuse records are short-lived, kept only long enough for the rate limit windows to work.

The prompt-page counts are kept indefinitely, because after the daily identifier rotates they are just numbers.

8. Your choices

Email [email protected] and ask for a copy of what I hold about you, a correction, or a deletion. I will do it, and I will not make you fill in a form to ask. If you are in a place whose law gives you specific rights over your data, such as the UK, the EU or California, those rights apply and this is how you exercise them.

You can also act without asking: unsubscribe from any email using its link, turn off idea notifications in your account, and delete your roadmap account, which removes your profile and detaches your content.

9. Security

Everything in the database is reachable only by the site's own server. The key that ships to your browser can read nothing and write nothing. Connections to the database require encryption, and the site is served over HTTPS.

No system is perfectly safe, and I will not pretend otherwise. If something happens that affects your data, I will tell the people affected rather than wait to be asked.

10. Children

This site is not intended for children under 13, and I do not knowingly collect their information. If you believe a child has given me data, email me and I will remove it.

11. Links away from here

The site links to other places, including Instagram, TikTok, GitHub and an advertisement for AppBully, another product I build. Once you follow a link you are on somebody else's site, under their privacy policy, not this one.

12. Changes

If this policy changes, the version and date at the top change with it. A change that materially affects people already on the waitlist will be announced by email rather than quietly published.