Privacy Policy

Template policy for launch — have counsel review before public release.

What we store

Account basics (email, password stored only as an irreversible hash), the creator profiles and works you publish, and security records such as hashed IP addresses attached to sessions and audit events. Public analytics (via self-hosted Umami) are collected without cookies or personal identifiers.

What we never store

Plaintext passwords, raw visitor IP addresses, or third-party tracking profiles. Refresh tokens are opaque and stored hashed; access tokens live only in your browser's memory.

How data is used

To operate your account and public pages, keep the service secure (rate limiting, fraud and abuse detection), and show creators aggregate statistics about their own pages. We do not sell personal data.

Sharing

We don't share personal data except with infrastructure providers strictly needed to run the service (hosting, database, email delivery), or when required by law.

Retention and your rights

You can edit or delete your profiles at any time. Deleting an account removes access and de-lists its public pages; security and audit records may be retained as hashed, minimized data. Email us to request export or deletion of your personal data.