Privacy Policy

1. Information We Collect

When you create an account, we collect:

• Account information: your email address, display name, and profile picture (if provided via Google OAuth).
• Content you create: appreciation messages, fan stories, letters, comments, uploaded photos, and photocard collection progress.
• Technical data: IP address (for rate limiting and abuse prevention), browser type, and timestamps of your activity.

2. How We Use Your Information

• To provide and maintain the community platform.
• To authenticate your identity and manage your account.
• To display your public posts, appreciations, and comments to other community members.
• To enforce our community guidelines and prevent abuse (rate limiting, IP banning, content moderation).
• To improve the platform based on usage patterns.

3. Google OAuth

If you sign in with Google, we receive your name, email address, and profile picture from Google. We do not access your Google contacts, Gmail, or any other Google services. Your Google credentials (passwords, tokens) are never stored on our servers.

4. Data Storage & Security

Your data is stored in a secure PostgreSQL database. Passwords (for credential-based accounts) are hashed using bcrypt and are never stored in plain text. All connections use TLS encryption. We implement security headers including HSTS, CSP, and X-Frame-Options to protect against common web attacks.

5. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. Your data may be shared only in the following circumstances:

• With your consent.
• To comply with legal obligations or law enforcement requests.
• To protect the safety and security of our users and platform.

6. Cookies & Local Storage

We use essential cookies for authentication (session management via NextAuth.js). We use browser localStorage to store your theme preference and guest photocard collection progress. We do not use advertising or analytics cookies.

7. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Withdraw consent for data processing at any time.

To exercise these rights, please contact us through the platform or via email.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data will be removed. Public posts and comments may be anonymized rather than deleted to preserve community discussion context.

9. Children's Privacy

This platform is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the platform after changes constitutes acceptance of the updated policy.