Privacy Policy
A factual description of what this prototype collects — not a substitute for real legal review before this goes live beyond a closed demo.
1. Overview
This describes what data the platform actually collects and why, based on how it's built today. It's a prototype's privacy notice, not a lawyer-reviewed policy — real legal review is needed before this is shown to anyone outside a closed demo.
2. Account data
Your email address and a hashed password (never stored in plain text) to create and secure your account. If you enable two-factor authentication, a TOTP secret is stored to verify codes.
3. Profile data
Whatever you enter on your profile: for brands, company name, website, niche, and description; for creators, display name, niche, bio, language, and per-platform follower counts and social links. Any avatar or logo image you upload is stored as part of your profile. All of this is visible to other users of the platform by design — it's how matching and outreach work.
4. Messages, payments, and activity
Messages you send through the platform are stored and visible to the person you're messaging. Payment records (amount, fee, status) are stored for the escrow feature described in our Terms — payments run through Stripe, and we never see or store your card details ourselves. Reviews, reports, and blocks you create or receive are stored to power those features.
5. Login activity
Each login attempt records the IP address and browser user-agent string alongside the timestamp and whether it succeeded, so you can review recent activity on your account and so we can detect abuse (e.g. rate-limiting repeated failed logins).
6. Cookies and push notifications
A single session cookie keeps you logged in — no third-party analytics or advertising cookies are used. If you enable browser push notifications, your browser's push subscription (endpoint and keys, assigned by your browser vendor) is stored so we can deliver them; nothing is sent if you don't opt in.
7. Third-party processors
We use Stripe to process payments and payouts (they receive whatever's needed to run a card payment or a payout — see Stripe's own privacy policy) and Resend to deliver password reset and email verification messages (they receive the recipient address and message content for that one email). Neither uses your data for their own purposes beyond providing that service to us.
8. Sharing
Beyond the processors in the section above, data isn't sold or shared with third parties. Profile information, messages, and reviews are visible to other users only in the ways the product itself shows them (matching, conversations, public profiles).
9. Access, export, and deletion
You can export your data as JSON from Settings at any time, and delete your account entirely from the Danger zone section of Settings — deletion removes your account and cascades to your profile, messages, and related records.
10. Changes
We may update this notice as the product changes. Continued use after a change means you accept the updated version.