Data we collect.
- Account email and a hashed password (Argon2id — your plaintext password never reaches our database).
- Payment details handled by Stripe — we never see card numbers, expiration dates, or CVCs.
- Profile content you publish (handle, photo, bio, links).
- Geocoded coordinates of the address you provide for the affiliate map, with
1–2 miprivacy jitter applied before any public display. - Standard server logs (IP, user-agent, timestamp) retained for the minimum window needed to investigate abuse.
Data we never publish.
- Your real address — only the jittered
display_pointis ever returned by public APIs. - Your email, phone, postal code, IP, or payment details.
- The map shows only the jittered coordinate and the public-allowed fields you choose to publish.
Your rights.
GDPR Article 15 (access/export) and Article 17 (deletion) requests will be honored from the in-app account settings page. CCPA equivalents apply for California residents. Deletion cascades within 30 days across all production stores.
Cookies & trackers.
Strictly-necessary cookies only for the authenticated app (session, CSRF). The marketing site does not set analytics or advertising cookies. Stripe's payment iframe sets its own cookies during checkout, governed by Stripe's policy.
Contact.
Until a published contact channel exists, reach the team via the in-app help center after signup. If you don't have an account yet and need to ask a privacy question, the help center is also where ex-signups go after they cancel — every message is read.