Privacy policy

Your ideas. Your data.

What EPISH collects, why, who receives it, how long it is kept, and how to have it deleted.

Last updated 12 November 2026

Who is responsible

EPISH (epish.co) is operated by X Projects ApS, CVR 41736720, Denmark. X Projects ApS is the data controller for the personal data described here. Write to hello@epish.co about anything on this page.

Your account

Your email address identifies your EPISH account. We sign you in with a one-time code sent to it; there is no password. We store your chosen public name, profile, projects, drafts, saves, interest, introductions and messages. Your sign-in email is not part of your public profile. EPISH is for adults aged 18 and older.

What other people see

Published projects and profiles are visible to anyone who visits EPISH. Drafts, funding plans and working documents are available to you and the project members you invite. Introduction details and conversations are visible to their participants. Feedback is visible to its author and the project team it was given to.

Pledges and payments

Stripe handles your card details when you back a campaign or buy AI credits. EPISH never sees or stores card numbers. We store the pledge itself: the campaign, the reward, the amount, its status, refunds, and the email address your receipt goes to. The creator of a campaign you back receives what they need to deliver your reward.

If you tick the reminder box at checkout and leave before finishing, we send one email with a link back to your pledge. It is sent only because you asked for it, and it has a one-click way to stop it.

Email

We send sign-in codes, pledge receipts and the notifications you switch on. Our email providers, Resend and AgentMail, receive your email address and the message so they can deliver them. Every notification email has an unsubscribe link.

AI assistance

Using an AI drafting action sends the text you review in that form to OpenAI. Images are sent only when you select the image option. When you ask EPISH to make an image or a film, your prompt and the reference images you choose are sent to Higgsfield. Private conversations are not sent. Suggestions need your review and are never published automatically.

Measurement and advertising

EPISH counts visits to campaigns, where they came from and which steps people take, so creators can see what works. EPISH and the creator of a campaign you visit may also use advertising and analytics tools from Meta, Google, TikTok, Pinterest, Snapchat, Reddit, X, LinkedIn and Microsoft. These tools set cookies and receive your activity on that campaign, your IP address and your browser details. If you back a campaign, a scrambled (hashed) copy of your email is included so the platform can match the pledge to an ad.

In the EU, EEA, United Kingdom and Switzerland none of this happens until you agree, and you answer separately for analytics (Google Analytics) and for advertising (the other platforms). Elsewhere it is on unless your browser sends a Global Privacy Control signal or you switch it off. You can change your choice at any time under Privacy choices in the footer of epish.co.

Without your agreement EPISH still counts the visit itself, for the creator’s own report. That count uses no cookie and no stored ID, and nothing is sent to an advertising platform.

Funnel events are deleted after 400 days. Copies queued for an ad platform have their personal details erased once they are delivered, and are deleted after 30 days.

Who is responsible for these tools. EPISH is responsible for the tools it runs across the site. On a campaign page the creator may add their own advertising accounts; that creator decides which accounts receive data and is responsible for how they use it. When data is collected and sent to Meta, the sender and Meta Platforms Ireland Ltd. are jointly responsible for that step, and Meta alone is responsible for what it does with the data afterwards. The other platforms act under their own privacy policies once they receive data.

Cookies and similar storage

EPISH keeps a small amount of information in your browser. Some of it is needed for the site to work; the rest is used only with your agreement where the law asks for it.

• Needed for the site to work. A sign-in cookie that keeps you signed in. Short-lived entries that remember the page you were on, an unfinished draft, an invitation you opened and the pledge you are returning to from Stripe. A record of the answer you gave about measurement and advertising (epish-consent). Stripe sets its own cookies on its checkout pages to prevent fraud.
• Analytics and advertising, each only with your agreement. A random visitor ID (epish-visitor), kept until you withdraw your agreement or clear your browser, and the link or ad that brought you (epish-touch), kept for 30 days so a pledge can be credited to it. Cookies set by the platforms that EPISH or the campaign’s creator use: Meta (_fbp, _fbc), Google (_ga, _gid, _gcl_*), TikTok (_ttp), Pinterest (_pin_unauth), Snapchat (_scid), Reddit (_rdt_uuid), Microsoft (_uetsid, _uetvid), X (_twclid) and LinkedIn (li_fat_id). They last from one day to about two years, as each platform decides.

When you withdraw your agreement under Privacy choices, EPISH removes its own entries and the platform cookies listed above, and reloads the page without the tools.

Ad accounts that creators connect

A creator can connect their own Meta ad account or Google Ads account to a campaign, by signing in at Meta or Google and choosing what to share. This section describes the data EPISH receives from Meta and Google through that connection.

• What we receive. From Meta: the name and ID of the Meta login. From Google: an ID for the Google login, without its name or email address. From both: the name, ID and currency of the ad account the creator chooses, and daily figures for that account’s ad campaigns: campaign name and ID, amount spent, impressions, clicks and purchases or conversions, and from Meta also reach. We do not receive ad creative, audiences, payment methods or any information about the people who saw the ads.
• Why. Only to show that creator, and the editors they invite to the campaign, what their ads cost next to the pledges those ads brought.
• What we never do. EPISH only reads ad reports. It does not create, change or pause ads. Google offers no read-only permission for Google Ads, so its sign-in asks for access to the account as a whole; EPISH uses that access only to list the creator’s accounts and read campaign reports. EPISH’s use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not sell this data, share it with other creators, combine it across creators, or use it for our own advertising.
• How it is stored. The access token is encrypted and never sent to a browser. Daily figures are kept for 400 days.
• How it ends. The creator can disconnect on the campaign’s Tracking page. EPISH then deletes the imported figures at once, and removes its access at Meta or Google when no other campaign uses that login. The same happens automatically when the creator removes EPISH in their Facebook settings. When the creator removes EPISH in their Google Account, EPISH can no longer read anything; the figures already imported are deleted when the creator disconnects, and otherwise 30 days after access ended.

Who else receives data

EPISH runs on Cloudflare, which hosts the site, its database and uploaded media. Stripe processes payments. Resend and AgentMail deliver email. OpenAI and Higgsfield receive what you send to an AI action. The advertising and analytics platforms named above receive data only as described under Measurement and advertising. We also share data to deal with fraud or a dispute about a pledge.

We share data with a public authority only when the law requires it. Before we do, we check that the request is lawful, we contest it if it is not, we hand over only the minimum it requires, and we keep a record of the request and our answer. We tell you about it unless the law forbids that.

We do not sell personal data for money. Some US state laws call sharing data with advertising platforms a “sale” or “sharing”. You can switch that off under Privacy choices, and EPISH treats a Global Privacy Control signal from your browser as that choice.

Why we are allowed to use your data

• To do what you asked (contract): your account, projects, pledges, receipts, messages and AI actions.
• Because you agreed (consent): advertising and analytics tools, the hashed email sent with a pledge, checkout reminders and the notifications you switch on. You can withdraw at any time; that does not undo what happened before.
• Because we have a good reason that does not override your interests (legitimate interest): keeping EPISH secure, preventing fraud, moderating campaigns, and counting visits without cookies or IDs.
• Because the law says so (legal obligation): bookkeeping and tax records for payments.

Where your data is processed

Several of the companies named on this page are based in the United States or process data there. When personal data leaves the EU, EEA, United Kingdom or Switzerland, it is covered by the EU–US Data Privacy Framework where the company is certified under it, and otherwise by the European Commission’s standard contractual clauses. Write to us for a copy of the safeguards.

How long we keep it

Your account, projects and messages are kept until you delete them or your account. Records of pledges and payments are kept for five years after the end of the financial year, as Danish bookkeeping law requires. Measurement data is kept as described under Measurement and advertising. Sign-in codes expire within minutes.

Your rights

You can ask for a copy of your data, have it corrected or deleted, have its use limited, receive it in a form you can take elsewhere, object to how it is used, or withdraw a consent you gave. You can export your workspace from the account menu. To have your account and its data deleted, see Delete your data. We answer within one month and never treat you differently for asking. EPISH makes no decisions about you by automated means alone.

You can also complain to a data protection authority: in Denmark Datatilsynet, in the United Kingdom the Information Commissioner’s Office, in Switzerland the Federal Data Protection and Information Commissioner, and elsewhere in the EU or EEA the authority where you live.

Changes

When this policy changes we update the date at the top. If a change affects how data you already gave us is used, we tell you by email or on the site before it takes effect.