Privacy policy

This policy explains what Second Source collects about you, why, who else sees it and what you can do about it. It covers the people who use Second Source, and also the people whose public posts and accounts we check.

Who we are

Second Source is run by LookN9, Inc., 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States, which decides how your personal data is used and is responsible for it. Write to [email protected] with any question about this policy or your data.

Second Source is an independent service, not affiliated with or endorsed by X Corp.

What we collect

• Your account. Your name and email address. If you sign up with a password, we keep only a one-way hash of it, never the password itself.
• Signing in with X. If you sign in with X or connect your X account, X tells us your X user ID, your @handle, your display name, your profile picture and, if X has one for you, your confirmed email address. We ask X only for permission to read your profile and email. We can't post, follow, send messages or read anything private on your behalf. X also gives us a short-lived access key, which we keep encrypted and don't use again.
• Staying signed in. A cookie keeps you signed in for up to seven days, renewed while you use the site. With each session we record the IP address and the type of browser and device it came from, so we can spot and stop misuse of your account.
• What you check and keep. The links, posts, articles, claims, accounts and topics you ask us to check, the results, your history, the checks you save, the claims you follow, your notes and your source lists.
• Payments and credits. Stripe handles payments and sells our plans and credits to you through Link, and your card details go to Stripe, not to us. We keep the references Stripe gives us for you and your subscription, and a record of your plan, your purchases and how you spend your credits.
• Disputes. If you ask us to review a result, the name, email address, connection to the content and message you give us.
• Visitors. To remember which results you've opened without an account, we may store a salted one-way fingerprint of your IP address. It can't be turned back into the address.

We don't use advertising or analytics trackers, and we don't send marketing emails.

People and accounts we check

Checking public claims means handling information about the people who make them, who usually aren't our users. When someone asks us to check a post, an article or an account, we collect publicly available material: the post and its media, the public profile of the account that wrote it, its recent public posts, and public records, reports and news coverage about it. We keep the results: the claims we tested, in our own words, with a verdict and the sources behind it.

• We only rate accounts of public interest, such as officials, institutions, media and public figures. Private individuals are never rated or labelled.
• We delete our copy of a post's content about a week after we fetch it, and keep only the results. A post that has been deleted on X stops being shown.
• Any links we show between an account and a state, party or organisation come from public records, and say where they come from.
• If a result is about you, use the “Dispute” tab on its page or write to [email protected]. A person reviews every request, and if we uphold it, the result or label is withdrawn for everyone.

We do this because readers have a legitimate interest in knowing whether public claims are true and how far to trust the public accounts behind them, and because it's part of the freedom to receive and share information.

How we use it, and why we're allowed to

• To provide Second Source: running your account, carrying out your checks, keeping your history, and handling your plan, credits and payments. We need this information to do what you asked us to.
• To keep it safe and working: preventing fraud and abuse, protecting accounts, fixing problems and improving how checks work. This is in our legitimate interest, and in yours.
• To check public claims and accounts, as described above. This is in the public's legitimate interest and part of freedom of expression.
• To meet our legal obligations, such as keeping billing records for as long as tax and accounting law requires, and responding to lawful requests.

Who else sees it

We don't sell personal data or use it for advertising. We share it only as follows.

• Other readers. Results of standard checks are shared. Anyone with the link sees a result's verdict and headline, and other readers can unlock the full result. We never show who asked for a check. Deep checks, your history, saved checks, followed claims, notes and source lists stay private to you.
• Service providers working for us, under contract and only to run Second Source: the companies that host our servers and database; the AI service that analyses content, which receives the content being checked and the public material found while researching it, but not your name, email or account details; a speech-to-text service, which receives the sound from videos in posts being checked; and search and public data services, which receive search queries built from the content being checked.
• X, through whose API we read public posts and profiles, and which knows when you sign in with X.
• Stripe, and its Link service, which sell our plans and credits to you as merchant of record and process payments as an independent controller under their own privacy policies. They ask for your name and billing address at checkout to work out the tax due. If you delete your account, we delete your customer record at Stripe too, which ends any subscription. If you ask Link to delete your data, it also cancels any subscription it sold you.
• Authorities or others, where the law requires it, or where it's needed to protect the rights, property or safety of our users, the public or us.
• A new owner, if Second Source is sold or merged, under this policy's protections.

Some of these providers work in other countries, including outside the European Union. Where the law requires it, we protect those transfers with safeguards such as the European Commission's standard contractual clauses.

How long we keep it

• Your account and everything in it, until you delete it on your account page or ask us to.
• Sessions, which expire seven days after you last use them.
• Copies of posts we check, for about a week. Video files only while we analyse them, then they're deleted.
• Results of checks, for as long as Second Source runs. Once your account is deleted, they're no longer linked to you.
• Disputes, for as long as the result they're about, as a record of what we decided.
• Payment records, which Stripe keeps for as long as tax and accounting law requires, even after you delete your account.

Cookies

We only use cookies that the site needs or that remember choices you make:

• A sign-in cookie that keeps you signed in, and a temporary one while you sign in with X.
• A cookie that remembers the language you chose, for a year.
• A cookie that remembers whether you chose the light or dark theme, for a year.

There are no advertising, analytics or tracking cookies, so we don't ask for consent to cookies.

Security

Everything travels over encrypted connections. Passwords are stored only as one-way hashes and X access keys are encrypted. Only the people who run Second Source can reach the database. No system is perfectly secure, and if a breach puts your data at risk we'll tell you and the authorities as the law requires.

Your rights

Depending on where you live, you can ask us to show you the personal data we hold about you and give you a copy; to correct it; to delete it; to stop or limit using it; and to send it to you or another service in a usable format. Where we rely on your consent, you can withdraw it at any time. Write to [email protected] and we'll answer within a month. We may ask you to prove who you are first.

You can change your name and password, disconnect X and delete your account yourself, on your account page.

To stop Second Source reaching your X account, you can also remove it in X's settings, under Security and account access, then Apps and sessions.

If you think we've handled your data wrongly, please tell us. You can also complain to the data protection authority where you live or work.

Children

Second Source isn't meant for anyone under 16, and we don't knowingly collect their data. If you think a child has given us personal data, write to us and we'll delete it.

Changes to this policy

When we change this policy, we'll post the new version here and update the date at the top. If a change matters to how we use your data, we'll say so on the site before it takes effect.