prospects.fyi

Privacy

Last updated 11 October 2026

prospects.fyi is operated by Colin Petty Solutions, LLC, a Texas limited liability company doing business as prospects.fyi (“we”). This page describes what the site actually does. It is written from the code rather than from a template, so every line below is checkable against the behaviour you can see in your browser.

The short version

There are two kinds of thing here. Research is about companies: who they are, where, what changed, and who works there. Your own work is everything you add: notes, ratings, next steps, calls, emails and the people you type in yourself. Research becomes part of the prospects.fyi database and can help research for other people. Your own work is shown to nobody but you. Nobody is ever told that you hold a company, and nobody at your own firm is ever handed one you or a colleague already hold.

We never share or sell your saved companies, prospects or customers. They are never shown to other users. The only others who handle them are the service providers below, who run the site for us and act only on our behalf.

What is saved

  • Company research. The companies in your morning drop, the ones you bring back from your own ChatGPT or Claude, and the detail that comes with them: location, what they do, why they fit, what changed lately, the main phone number and the role to ask for.
  • Contacts found by research. The people our research or Enrich finds at a company, with the phone, email and LinkedIn it found for them and where each came from.
  • Your own work. Notes, Good fit and Not a fit ratings, next steps and due dates, calls you mark, addresses and people you add by hand, and the email campaigns you write or file.
  • Your answers. What you sell or haul, what makes you different, who you sell to, where, what size, your own columns, and the customers you name unless you switch that off on your profile page.
  • Your email and a sign-in session, once you type your email to see three, sign in or turn on the morning drop, and your phone number if you add one to receive codes by text.
  • How the morning email is used: when its link is pressed, when the page is looked at, when a row is rated, when the five are saved and whether the link signed you in, with the time since sending and the browser’s own description of itself. That is how we tell a person from the mail scanner that follows every link, whether the link is working, and whether the drop is worth sending. If five in a row go by with no visit, we ask once whether you still want them, and stop after a week with no answer; you can switch it back on from your profile.
  • A random id for this browser, generated here and derived from nothing about you, and a restore code if you ask for one.

The research database

Company research and the contacts found by research, whether our own research found them for your drop or your assistant found them and you brought them back, become part of a database that prospects.fyi owns and keeps. We use it to research for everybody: a company researched once can be checked again and offered to somebody else it fits, instead of being searched from scratch.

What that never includes, and never will:

  • Your notes, ratings, next steps, calls or email campaigns.
  • Anything you typed or added by hand, including a person or an address you added yourself.
  • The customers you name.
  • The fact that you hold a company, when you saved it, or anything else that would tell another user what you are working.

And one rule on top: a company anybody at your firm holds (worked out from your email address’s domain) is never handed to anybody else at your firm. Your ratings steer your own drop, and are otherwise only ever used added up across many people, never as yours.

If you connect Salesforce

We write only our own fields, fill a standard field only when it is blank, never delete a record, and push only when you press the button. To keep companies you already have out of your drop, we read each Account’s name, website, owner, type, created and last activity dates, whether it has a won or an open deal, and any of your own fields your admin names in a rule. That is kept with your account only, is never added to the shared research database or sent to an AI model, and is deleted after 30 days without a fresh read, or at once when you disconnect. The security page has the detail.

What is never saved

  • Your IP address. It is used to stop anybody sending sign-in codes or sign-ups in bulk. The address itself is never written down; a one-way hash of it is kept to count each day’s sign-ups from one place, and another, mixed with a secret that changes every day, to count each day’s visitors.
  • Your conversations in ChatGPT or Claude. The prompt is written here and run in your own account. We see only what you choose to bring back with the save link or by pasting.

The morning email’s link

The button in your morning email opens that morning’s companies and signs you in for the day, so the morning does not start at a code screen. The link is new every day, stops signing anybody in a day after it was sent, and the sign-in it gives lasts a day rather than the ninety a code gives. It never switches a browser that is already signed in as somebody else. Please do not forward the email; if you do, the link can sign that person in as you until the day is out.

The save link

The link your assistant writes carries your results after a #, the one part of a web address a browser never sends to a server. So what is in it stays out of our request logs and our host’s until you press save, and once the list is saved it is taken back out of your address bar.

Analytics, ads and cookies

We use analytics to understand how the site is used: Vercel Web Analytics, Google Analytics, and our own count of page views. Our own count keeps, for each view, the day, the page with any id cut off, the name of the site that sent you and a link’s source tag, plus the daily visitor hash described above, and whether the page was scrolled or pressed, which is how a person is told from a bot. On a page made for one company, a second hash kept for that page alone tells a returning visitor from a new one, and the site’s owner is emailed when somebody views it: the time and the site that sent them. Google Analytics sets its own cookies to tell visits apart; we send it the page, a link’s tags and Google’s own ad click id, never your email, what you typed or what you saved.

When an ad or a tagged link brings you here, its address carries tags that say which campaign it was, and often a click id from the ad platform (Google, Meta, LinkedIn, Microsoft, TikTok or X). Your browser keeps those, and when you sign in they are kept with your account, so that if you later sign up for a paid plan we can tell that platform its ad led to a customer. What a platform is told is the click id, what happened (a sign-up or a purchase), when, and where it asks for one, a one-way hash of your email so it can match its own records. It is never told about your lists, your prospects, your customers or anything you typed.

We also keep a record of what you do on the site, so we can make it better for you and show you more of what you spend time on: the pages you open, how long each was on screen and how far you scrolled, the buttons and links you press, and which companies were on your screen and for how long. It is kept with this browser’s random id, and with your account when you are signed in. It never includes anything you type, and like the rest of your own work it is never shown to anybody else.

Our own cookie is the sign-in session. Everything else above is optional. Visitors from the EU, the UK and Switzerland are asked before any of it runs; anyone can choose essential only below, and this browser then loads no Google Analytics, keeps no ad click ids or tags and records no activity. The sign-in session and this browser’s random id stay, because the site does not work without them.

Service providers

These companies process data for us, on our behalf and for nothing else: Vercel (hosting and analytics), Supabase (the database), Resend (email), Stripe (payments), Google (analytics and our own mail), Twilio (sign-in codes by text) and Anthropic (the research behind your drop), and, when we advertise with them, the ad platforms named above, which receive only what that section describes. None of them is given your lists to use for themselves, and none buys anything from us.

When a tagged link or another site brings you here, your browser keeps a short note of it: the link’s tags (such as “LinkedIn” and “company page”), the name of the site that sent you, the page you landed on and the date, for your first and latest such visit. It goes with three things you do, each time only into a message to the site’s owner, so we know which posts and pages are worth making:

  • When you press to look up a company: an email saying which company, and the page you pressed it on.
  • When you type your email to see three, or sign up with a code: a text and an email with your email address.
  • When you leave after looking up a company without signing up: an email saying which company, how far you got and the page you left, and an email address if you typed one in and did not send it. We do not write to an address you did not send.

When you sign up, the note is also kept with your account, so we can count which posts and pages bring people in. Your browser drops it once you sign up, sign in or sign out. Deleting your data below deletes the account and the note with it; messages already sent are not recalled.

How long it is kept

Your own work and your account are kept until you delete them with the button below. Research in the database is kept for as long as it is useful; a deleted account no longer has any link to it.

Delete everything

This removes your saved lists, your answers, your notes, ratings and campaigns, clears what is stored in this browser, and, if you signed in, deletes your email, the account and every sign-in session with them. Company research already in the shared database stays there, attached to no account. It cannot be undone, and if you have given your restore code to another browser, use this there too.

Nothing is stored for this browser yet.

Getting in touch

prospects.fyi is run by one person. If something here is unclear or you want your data gone and the button is not doing it, write to colin@prospects.fyi and it will be handled by a human rather than a process. By post: Colin Petty Solutions, LLC, PO Box 100273, Fort Worth, TX 76185.