Memberflow runs inside your Skool community, so "what can this thing actually see?" is a fair question — and one we'd rather over-answer than hand-wave. Below are the questions operators actually ask us, answered plainly. The full legal detail is in the Privacy Policy.
The short version
What can Memberflow read?
Only what's already visible to you, on Skool pages you're actually looking at, while you're signed in. It reads things like member names, profile links, visible posts and comments, and your community's settings/metrics pages — the same things you'd see with your own eyes. It can't see private content you don't have access to, and it doesn't touch any site other than skool.com.
Who reads our posts?
No human at Memberflow reads your community's posts. The coaching, People and tagging insights are generated on your own computer and stay there — that content is never sent to us.
The one exception is content you create for automation: if you schedule a post or write a welcome/broadcast DM, we store that message on our servers so it can publish while your browser is closed. That's your own content, stored to do the job you asked for — not your members' conversations.
What's stored where?
Your insights stay on your device. Your sign-in, and (only if you use automation) your scheduled content plus an encrypted session token, are on our servers. Full breakdown in the table below.
Are you GDPR compliant?
Yes — and we'll show our work rather than just claim it. We publish our lawful bases, retention periods, subprocessors and transfer safeguards; we offer EU/UK operators a Data Processing Agreement; we honour access and deletion requests globally; we never sell or share data for advertising; and we run a privacy complaints channel with a 30-day acknowledgement. Details below.
What's stored where
| Data | Where it lives | When |
|---|---|---|
| Coaching, People, tags, activity insights, snapshots | Your device only | Always |
| Email + password (your account) | Our servers | When you sign in |
| Scheduled post / DM content you write | Our servers | Only if you use scheduled posting or DMs |
| Encrypted Skool session token | Our servers (encrypted at rest) | Only while automation is enabled |
| Member/approval details for DMs & auto-approve | Our servers | Only if you enable those features |
Scheduled posting is on by default so the feature works — but the first time you schedule a post, we show you exactly what gets stored and let you choose "Keep local-only" instead. Welcome DMs, broadcasts and auto-approve are off until you turn them on.
Why we store a session token, and how it's protected
To publish a post at 7am while your laptop is shut, our server has to act as you on Skool. That requires your Skool session token. So if — and only if — you use automation, we capture it and store it encrypted at rest. It's decrypted only inside our secured server process at the moment it performs the action you scheduled, it's never logged in plain text, it's never exposed to other users, and it's used for nothing else. Turn automation off, disconnect, or delete your account and it's gone.
Security
- All traffic over HTTPS.
- Session token encrypted at rest; decrypted only in-process at point of use.
- Row-level security and owner-scoping — your data is isolated to your account.
- Server-only keys never ship to the browser. Our build fails if backend auth code is ever bundled into the page script.
- The extension asks for access to skool.com only — no other site.
- No ad trackers, no advertising pixels, no non-essential cookies.
Your rights
You can, at any time:
- Turn scheduled posting and every automation feature on or off.
- Request access to, correction of, or deletion of your data.
- Delete your account — which performs a full erasure: your automation content, encrypted token, DM/approval records and your entire analytics warehouse are deleted along with the account.
- Uninstall the extension, and clear its local storage from your browser.
We aim to respond to any request within 30 days. Email brian@baddayexcellence.com.
GDPR & UK GDPR
Who's the controller?
For your account, we are. For your members' data, you are the controller and we're your processor — we only handle it because you asked us to. That's why we publish a Data Processing Agreement you can rely on when your own members ask who processes their data.
Lawful bases
- Account & access: performance of our contract with you.
- On-device insights: legitimate interests — and it never leaves your device.
- Automation: your consent, recorded with a timestamp, withdrawable anytime by turning the feature off.
Where data is processed
Our backend runs on Supabase (AWS us-west-2, United States). For UK/EU users that's a restricted transfer, covered by appropriate safeguards including Standard Contractual Clauses through our agreement with Supabase.
Subprocessors
| Who | What for | Where |
|---|---|---|
| Supabase (AWS) | Backend: auth, database, edge functions, storage | US (us-west-2) |
| Vercel | Hosting for the dashboard and these pages | US |
| Resend | Transactional email (privacy complaint notifications) | US |
| Giphy | GIF search — receives the search term only, never member data | US |
| Google (YouTube Data API) | Public metrics for your own channel in Analytics | US |
Skool is not our subprocessor — it's the platform we act on, using your own session, at your instruction. Webhook destinations you configure (e.g. Zapier) are your choice and your responsibility.
Complaints
If something about our privacy practices bothers you, tell us — there's a complaint form at the bottom of the Privacy Policy. We acknowledge every complaint within 30 days, investigate, and respond. UK users can also complain to the Information Commissioner's Office (ICO).
What we don't do
- We don't sell or share your data for advertising. Ever.
- We don't read your community's posts, and we don't use your data to train anything.
- We don't track you across other websites or collect general browsing history.
- We don't touch any site other than skool.com.
- We don't auto-decline membership requests.
Still have a question? Email brian@baddayexcellence.com — a real person (Brian) answers. Read the Privacy Policy or the Data Processing Agreement.