Privacy Policy

Last updated: [DATE]

1. Data we collect

• Account data: email address, display name, password hash (we never store plain-text passwords). If you sign in with Google, we receive your Google-verified email address, name, and Google account ID instead of a password.
• Newsletter preference: whether you opted in to the weekly digest, stored with an unsubscribe token so one-click unsubscribe works.
• Content you submit: influencers, recommendations, proof links, ratings, reports.
• Verification data: email verification tokens; in the future, identity-verification results from [ID VERIFICATION VENDOR].
• Technical data: IP addresses, user-agent strings, and request logs used for rate limiting, bot detection (Cloudflare Turnstile), and security.

2. How we use data

To operate the service, verify accounts, prevent bots and abuse, moderate content, and comply with legal obligations. We do not sell personal data. Analytics, if any, will be described in [ANALYTICS PROVIDER / "we use no third-party analytics"].

3. Public by design

Display names, influencer profiles, recommendations, and ratings are visible to every visitor. Do not post personal information about yourself or others in public fields.

4. Sharing

We share data with service providers only as needed to run the service: [HOSTING PROVIDER] (hosting), [EMAIL PROVIDER] (transactional email and the weekly digest), Cloudflare (bot protection), Google (only if you choose Google sign-in — OAuth authentication), and [ID VERIFICATION VENDOR] (future identity checks). We disclose data when required by law.

5. Retention

Account data is kept while your account is active. Logs are kept for [RETENTION PERIOD, e.g. 12 months] for security. Deleted accounts have personal identifiers removed; aggregate rating statistics may be retained.

6. Your rights

Depending on your jurisdiction ([e.g. GDPR / CCPA]), you may request access, correction, deletion, or export of your personal data, and may object to certain processing. Contact [PRIVACY CONTACT EMAIL]. We respond within [TIMEFRAME, e.g. 30 days].

7. Security

We use bcrypt-hashed passwords, httpOnly session cookies, HTTPS in production, and rate limiting. No system is perfectly secure; report vulnerabilities to [SECURITY CONTACT EMAIL].

8. Children

The service is not directed at children under [AGE, e.g. 13/16], and we do not knowingly collect their data.

9. Changes

We will notify users of material changes via [NOTICE METHOD].