Privacy Policy
Effective date: 2026-10-04 · Last updated: 2026-10-04 · Version 2026-10-04-draft-1
This draft reflects the current web application's implementation. It is not a promise of legal compliance or a lawyer-approved policy. The operator must finalize jurisdiction-specific rights, lawful bases, retention periods, processor agreements, and contact information.
Account and profile information
The service stores email, a bcrypt password hash, verification status, account role/access state, first and last name, username, display name, avatar, bio, and an optional profile location. Profiles can include date of birth: the exact date is available in the private profile, while a calculated age may appear publicly. Signup records 18+ self-attestation and policy consent timestamps/versions; it does not perform identity verification.
Content and interactions
Posts, comments, Vibes, Marketplace listings and images, conversations/messages, blocking relationships, and reports are stored to provide those features. Public profile information, public content, and listing information are visible to others. Direct messages are available to conversation participants; a reported message can be reviewed by authorized administrators without exposing the entire conversation in the report queue.
Security and request information
Request IP information is used for abuse limits and CAPTCHA verification. Durable limiter and content-fingerprint keys are HMAC-hashed rather than storing raw IPs, emails, tokens, or message text in those buckets. Existing auth audit logs record account email, event type, and limited security metadata, including approximate request location where supplied by hosting headers. No claim is made that hashing makes all metadata anonymous.
How information is used
Information supports account creation, email verification, login/MFA, password resets, profiles, social interactions, messaging, Marketplace, abuse prevention, reporting, and administrator review. Moderation audit trails record actions and reasons. User content is not sent to a paid AI moderation service by this MVP implementation.
Service providers
MongoDB stores application data. Cloudinary hosts uploaded media. Cloudflare Turnstile processes CAPTCHA tokens and may receive request IP data when configured. Resend is the default email provider for verification, password reset, welcome, and administrator MFA emails; the code allows an operator-configured email endpoint. Vercel may host deployed instances and supply request metadata. These providers process relevant information according to their own arrangements and policies.
Cookies and sessions
Authentication uses a signed session token in an HTTP-only cookie, with SameSite=Lax and secure transmission in production. An additional short-lived cookie tracks pending administrator MFA. Session identity is rechecked against the active database account. Browser UI state and forms are also used to deliver the application; no advertising-consent checkbox is added at signup.
Media and links
Images are checked for supported file types, signatures, size, and managed storage location. Under the manual-moderation MVP policy, valid images can publish without automated nudity or violence classification. Moderation state, uploader identity, asset metadata, and review records are stored. Pending/rejected explicitly held media is omitted from public application rendering. Cloudinary delivery URLs are not a guarantee of private CDN storage. Deterministic link checks run without fetching arbitrary user URLs; external malware/phishing scanning is not configured.
Retention
Content, accounts, messages, reports, and audit records persist in the database unless removed by supported operations or an operator-managed retention process. Verification/reset/MFA and abuse-limit records use expiry/TTL where implemented; physical database cleanup may lag expiry. Exact legal retention schedules and backup handling require operator review.
Account deletion
The current deletion control requires your password and explicit confirmation, then deactivates your account and clears the session. It is not a complete erasure workflow: posts, messages, listings, reports, and audit history may remain. Contact Support for applicable access, deletion, correction, or retention questions. Legal obligations and others' rights may affect what can be removed.
Security
Password hashing, email verification, administrator MFA, authorization checks, blocking, file validation, and shared abuse limits help protect the service. No system can guarantee complete security. Do not include passwords, financial credentials, or sensitive private information in content or messages.
Choices and adult eligibility
You can edit profile fields, delete supported content, block users, report concerns, and deactivate your account. The initial public launch is 18+ and relies on self-attestation. Historical profiles and birthdays are not silently rewritten; the operator must review legacy eligibility questions and applicable legal rights.
Changes and contact
The central version and dates apply to this draft. Material practice changes should be reflected in an updated policy and appropriate user notice. Use Contact / Support for privacy questions; the operator must finalize the relevant contact and response processes.