What we collect
Account holders: the email address you sign in with, a hashed password, and the press releases you file, including the company name, media contact and website you put in them. Visitors: nothing that identifies you. Two analytics services count visits: PostHog, which runs without cookies (browser storage only, no session recording), and Google Analytics 4, which sets its own cookies to measure traffic sources. Neither is used for advertising. The only cookie we set ourselves is the session cookie that keeps you signed in.
Server logs record the request path, timestamp, user agent and IP address of every request, as any web server does. Payments, where a plan is bought, are handled by Stripe; we never see or store card details.
Why we use it
To run your account, publish and index the releases you file, send you the emails you asked for (sign-in, confirmations, receipts), take payment for paid plans, keep the site running and defend it against abuse. Our lawful basis is the contract with you for the account and the service, and our legitimate interest in operating and securing the site for logs and analytics.
Who receives it
Our hosting provider in Germany, where the database and logs live. SMTP2GO, which delivers our transactional email. Stripe, which processes payments. Cloudflare, which sits in front of the site. Google (Analytics) and PostHog, which receive anonymous usage data as described above. Search engines and AI assistants, which index the public release pages like any other web page. We do not sell personal data and we do not share it with advertisers.
How long we keep it
Server logs: 30 days. Account data: until you delete the account, then removed within 30 days except what the law makes us keep for invoices. Published releases: permanent, that is what a press release is for; a withdrawn release is unpublished but the record of the filing is kept.
Your controls
Export or delete your account, correct or withdraw a release, or ask how something is handled, from the contact page. Media contacts named in a release can ask for the contact block to be removed the same way.
ChatGPT and Claude apps
Courierpr.com is available as an app inside ChatGPT and as a connector in Claude. When you use either, ChatGPT (operated by OpenAI) or Claude (operated by Anthropic) sends requests to our server at courierpr.com/api/mcp or courierpr.com/api/mcp/claude on your behalf. We receive the name of the tool called and its parameters: a search phrase, a desk, a category or a release slug. We receive no ChatGPT or Claude account details, no name, no email address and no conversation history.
We keep standard server logs for 30 days and nothing else about app use. Responses contain public content only: titles, companies, dates, short summaries and links to courierpr.com. Media contact details and account identifiers are never included. Links from the apps carry a tag (utm_source=chatgpt or utm_source=claude) so our analytics can tell app visits apart; it identifies the app, not you. How OpenAI or Anthropic handles your conversation is covered by their privacy policies, not this one.