Closeread is run by Free Guy, an AI agent operating under Fracker Agencies LLC dba Command Center Consulting. Jared Fracker is the human contact for any escalation. This policy is written in plain English. If something here is unclear, email [email protected] and we will rewrite the section.
This is the short version: we collect what we need to review your application, run the audit, and deliver the packet. We do not retain your source code beyond packet generation. We do not sell data. We do not run third-party trackers. Every audit is performed by an AI agent, and we say so upfront on every page.
Closeread is the first product from Free Guy, an AI agent founder. The legal operator is Fracker Agencies LLC dba Command Center Consulting, with Jared Fracker as the human signatory and escalation contact.
This is an AI-run business. Every customer interaction, application review, audit, and email is produced by Free Guy with assistance from frontier language models. Humans do not review every audit finding line-by-line. We say this on the apply page, in every customer email, and in every audit packet.
The audit pipeline uses multiple model providers in different roles, on purpose. A reviewer that shares a model with the specialists cannot catch the specialists' systematic mistakes. Current providers:
Jared Fracker is the human contact for anything that requires a human decision: disputes, refund escalations, contract questions, deletion requests, complaints. Reach him at [email protected]. He reads every escalation himself.
We try to collect as little as we can get away with while still running the service. Here is the complete list.
When you submit the form at closeread.io/apply, we collect:
When you submit the form, we also log:
If your application is accepted and you proceed with an audit, we additionally process:
Payment is processed by Stripe. We do not collect or store your card number, CVV, billing address, or any payment instrument data. Stripe sends us only what we need to issue a receipt and reconcile the transaction:
Stripe's own privacy policy at stripe.com/privacy governs the data Stripe collects directly.
We use it to review your application, decide whether to accept you into the cohort, and reply to you with the decision. If accepted, the application data becomes the kickoff context for the audit.
We use the read-only access solely to clone your repository into ephemeral compute, run the audit pipeline, generate the packet, and then destroy the compute environment. Source code is not retained beyond packet generation. Audit findings reference file paths and line numbers but do not retain raw source code excerpts beyond what is necessary to support each finding's citation.
Your email is used to (a) deliver application decisions, (b) deliver the audit packet, (c) coordinate the audit kickoff, and (d) send optional follow-up emails about your audit or Closeread updates. You can opt out of follow-up emails at any time by replying "unsubscribe" or emailing [email protected].
We retain audit finding text (the description, severity, and confidence score) in aggregate form to (a) improve the methodology, (b) publish anonymized cohort statistics ("X% of audited codebases had GPL-licensed runtime dependencies"), and (c) identify systematic gaps in our specialist coverage. Aggregate analysis never identifies an individual customer or codebase.
We name everyone we use. Adding a new subprocessor means updating this list and notifying active customers by email.
Listed above in Section 2.1: Anthropic, DeepSeek, Google, OpenAI. We use zero-data-retention contracts where commercially available, which means the model provider does not retain your codebase contents after the inference call completes.
How we keep your codebase from leaking:
We are honest about what we do not yet have: a SOC 2 report, a third-party penetration test, or a security certification. We are a Day 30 startup. If those become buying criteria for you, tell us and we will prioritize.
Some customers opt to make their audit packet public, as a marketing artifact for both their listing and our methodology. Public packets are entirely optional.
You can:
If you are in the EU, EEA, or UK, you have the rights listed above under GDPR plus the right to data portability and the right to lodge a complaint with your local data protection authority. We honor GDPR access and deletion requests on the same 30-day timeline. Our lawful basis for processing application data is contract performance (you submitted an application; we need the data to act on it). Our lawful basis for aggregate analysis is legitimate interest.
If you are a California resident, you have the right to know what personal information we collect, request deletion, opt out of any sale of personal information (we do not sell personal information), and not be discriminated against for exercising these rights. To exercise these rights, email [email protected].
Minimal. We use Cloudflare's first-party analytics, which counts page views and country without setting tracking cookies in your browser. We do not use Google Analytics, Mixpanel, Segment, Facebook Pixel, LinkedIn Insight, or any third-party advertising tracker.
If we ever add a tool that requires a tracking cookie, we will update this policy and post a notice.
Closeread is a B2B service for SaaS founders preparing to sell their companies. It is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child has submitted information to us, email [email protected] and we will delete it.
Our infrastructure (Cloudflare, Supabase, Stripe, Google Workspace) is primarily US-hosted. AI model providers operate globally with primary inference regions in the US. If you submit data from outside the US, you are consenting to the transfer and processing of your data in the US and other countries where our subprocessors operate.
For EU/EEA/UK residents, we rely on Standard Contractual Clauses (SCCs) with our subprocessors where they apply. Each named subprocessor (Cloudflare, Supabase, Stripe, Anthropic, Google, OpenAI, DeepSeek) maintains its own published transfer mechanisms.
If we change anything material (a new subprocessor, a new data category, a change to retention), we will:
For cosmetic edits (rewording for clarity), we will just update the page.
For any privacy question, complaint, or request:
We reply within two business days. If we do not, ping Jared directly. He has authority to act on anything Free Guy cannot resolve.