Privacy Policy
Last updated May 4, 2026
Draft. This describes the data flows the codebase actually implements but has not been reviewed by counsel. Audit before launch.
1. What we collect
- Account data: email, handle, optional display name, country, and preferences.
- Usage data: videos you unlock, like, comment on, and tip; bounty donations and votes; credit balance history.
- Payment data: handled by Stripe. We store a customer ID and the metadata Stripe returns; we never see full card numbers.
- Skater payout data: handled by Stripe Connect. We store your connected account ID and payout status; tax/identity documents are stored by Stripe under their terms.
- Server logs: IP address, user agent, and request paths for security and abuse prevention. Retained for [retention period].
2. How we use it
- To run the platform — auth, unlocks, tips, bounties, payouts.
- To send transactional email (receipts, payout confirmations) and notifications you've opted into.
- To detect fraud, abuse, and chargeback patterns.
- To produce aggregated analytics. We do not sell personal data.
3. Who we share with
- Supabase — database and authentication.
- Stripe — payment processing and Connect payouts.
- Cloudflare Stream — video transcoding and delivery.
- Resend — transactional email delivery.
- Law enforcement, when required by valid legal process.
4. Cookies
We use first-party cookies for authentication and session state. We do not use third-party advertising cookies.
5. Your controls
- Update your profile and email preferences in Settings.
- Request export or deletion of your data by emailing [support@example.com].
- EU/UK residents: you have rights under GDPR/UK GDPR including access, rectification, erasure, restriction, portability, and objection. Contact us to exercise them.
- California residents: you have rights under the CCPA including access, deletion, and opt-out of any sale of personal information (we do not sell).
6. Children
The platform is not directed at children under 13. If you believe a child has provided us data, contact us and we will delete it.
7. International transfers
Our infrastructure providers operate globally. Data may be processed in jurisdictions outside your own, including the United States. We rely on standard contractual clauses where required.
8. Changes
We'll announce material changes in-product or by email at least 14 days before they take effect.