Security

• Every workspace sits behind an authenticated session — email and password, or Google sign-in.
• Passwords are handled by our managed auth provider; we never see or store them ourselves.
• Dashboard and admin routes are excluded from search engines and require a signed-in session.
• Administrative functions verify the admin role on the server, not just in the interface.

Workspace data lives in a managed Postgres database with row-level security enabled on every table. Policies scope reads and writes to the signed-in account, so one workspace cannot query another's profile, steps, results or sidekick history.

The application and its API are served over HTTPS. Hosting, database and authentication run on managed infrastructure; we don't operate our own servers.

Step briefs, sidekick replies and creative drafts are generated by a third-party model provider. The context sent is limited to your business profile and the relevant conversation or step. Don't paste credentials, card numbers or other secrets into the sidekick.

• Hosting, database, authentication and file storage — managed cloud platform.
• AI generation — hosted model provider for briefs, chat and images.
• Web reading — service that fetches the public content of URLs you submit.

Data is kept for as long as your workspace exists. Deleting your workspace in Settings removes the profile, steps, results, notes and sidekick history associated with it. For full account removal, email us.

We secure the platform and your data inside it. You're responsible for keeping your sign-in credentials safe, for who you invite into your workspace, and for the security and legality of anything you execute from the plan in your own tools and channels.

Found something? Email hello@yougtm.com with steps to reproduce. Please don't test against other people's workspaces or run disruptive scans — we'll acknowledge reports and work with you on a fix.