Privacy notice

Information we handle

• Creator account information, including name, email, sign-in provider identifiers, and authentication records. Email/password accounts store a password hash rather than the password itself.
• Profile content you supply: your handle, introduction, images, links, projects, support options, and goals.
• Support information: optional name and message, public-sharing choice, checkout email, amount, currency, payment and subscription status, and Stripe identifiers and event records. Provider records may include billing contact details and limited payment-method information.
• Access and service records, including account sessions, receipt-access records, email-delivery records, security and rate-limit data, and audited operator actions.

Stripe collects payment details on its hosted checkout and billing pages. We do not collect or store full card numbers or card security codes in our application.

How information is used

We use this information to operate profiles, authenticate users, process and reconcile support, track goals, deliver transactional emails, provide private receipts and billing access, prevent abuse, resolve payment issues, and meet applicable obligations.

Creators receive information about support for their work through their dashboard, notifications, and Stripe account. This includes payment information and messages, and may include the email used at checkout. A private message is private from the public, not from the creator you send it to.

What is public

Published creator profiles, featured projects, images, and visible goal progress are public. Individual supporter payment amounts and email addresses are not displayed on creator pages.

Your name and message are displayed only if you choose public sharing, and can be hidden by the creator or platform moderation. Share cards exclude your email and message. Including an amount on a share card is optional. If you share a card elsewhere, that service’s policies apply.

Cookies and optional analytics

Essential cookies support sign-in, checkout-return verification, and private receipt access. Receipt email links are short-lived and exchanged for an HttpOnly session. Do not forward private access links to others.

Optional analytics are enabled by default. The “Allow optional browser analytics” checkbox in your signed-in account settings controls PostHog product events and Vercel site analytics, including related server conversion events. We respect Global Privacy Control and Do Not Track signals. Your choice is saved in local storage; enabled analytics also create a one-year pseudonymous visitor cookie.

Product events use random visitor identifiers and limited properties such as creator ID, currency, payment frequency, and whether a payment is a renewal. We exclude raw email, messages, payment amounts, private receipt tokens, and sensitive URLs from these events. Session replay and automatic form or click capture are disabled.

Turning analytics off stops future tracking for that visitor and removes unsent conversion events after the preference is saved. It cannot recall events already delivered or delete necessary payment records. This preference is specific to your browser; it is not an account-wide deletion request. If saving the preference fails, the page provides a retry control.

Service providers

We use Vercel for hosting and public image storage, Neon for hosted database storage, Resend for transactional email, Stripe for payments and billing, and PostHog and Vercel for optional analytics. Google or GitHub receives sign-in information if you choose that provider. Providers process information needed for their services under their own terms and arrangements with us.

Information may be processed in the United States and other locations where these providers operate. Provider privacy information is available from Stripe, Vercel, Neon, Resend, and PostHog.

We may also disclose information when needed to address a valid legal request, investigate abuse, or protect people and the service.

Retention and your choices

We retain account, support, and service records to operate the platform and address financial, security, and legal obligations. Some payment, dispute, and audit records may need to remain after account closure. An expired access link or session no longer grants access; expiry does not necessarily mean its underlying record has already been deleted.

You can edit your creator profile, choose whether to share a supporter message, change optional analytics preferences, and use Manage support to access receipts and cancel recurring support.

For access, correction, deletion, account closure, or questions about rights available where you live, contact buy-me-some-tokens@transitivebullsh.it. We may need to verify your identity and clarify which records or creator relationship your request concerns.

Updates and contact

We will update this notice as the service changes. The date above identifies this version. Send privacy questions or reports to buy-me-some-tokens@transitivebullsh.it.