Privacy Policy

1.1 Account data: email address, phone number (for verification), display name, and password hash.

1.2 Third-party sign-in data: when you sign in with Google, Facebook, or Apple, we receive only your email address, display name, and profile picture.

1.3 Device and log data: IP address, browser type and version, device identifier, operating system, referring pages, access times.

1.4 Usage data: pages viewed, links clicked, favorites, comments, subscriptions.

1.5 Payment data: order amount, currency, invoice details, and the transaction reference provided by our payment processor (Payoneer). We do not store your full card number.

1.6 Push subscription token: the browser push notification endpoint created when you subscribe.

1.7 Business data (advertisers / developers): company name, contact person, business address, tax identifier, and payout account details submitted during onboarding.

We process your data for the following purposes:

- To create and operate your account and provide the Service — performance of a contract.

- To secure the Service, prevent fraud and abuse — our legitimate interests.

- To provide customer support — performance of a contract.

- To analyze aggregate usage — consent / legitimate interests, depending on your jurisdiction.

- To send marketing and advertising messages — your consent.

- To comply with legal obligations — legal obligation.

[ENABLE ONLY IN: UK / EU] The legal bases above reference Article 6 of the UK / EU General Data Protection Regulation: (a) consent, (b) performance of a contract, (f) legitimate interests, and (c) legal obligation. Where we rely on consent, you may withdraw it at any time with the same ease as giving it.

[ENABLE ONLY IN: BRAZIL] Under Article 7 of the LGPD, we process your data under the following legal bases: performance of a contract (item V), legitimate interests (item IX), or your consent (item I), as indicated for each purpose.

[ENABLE ONLY IN: CALIFORNIA, USA] In the preceding 12 months, we have collected the categories of personal information listed above for the business purposes described. We do not sell personal information; to the extent online behavioral advertising constitutes "sharing" under the CCPA/CPRA, we provide the opt-out described in Section 8.

We share data only with:

- Payment processor: [Payoneer] — for billing and refunds.

- Identity providers: Google, Facebook, Apple — when you choose third-party sign-in.

- Analytics provider: [Google Analytics / name] — aggregate usage analytics.

- Advertising partners: [list] — for serving and measuring ads, only with your consent where required.

- Cloud and hosting providers: [name, country].

- Public authorities, where required by law.

[ENABLE ONLY IN: AUSTRALIA] We may disclose personal information to recipients in the following countries: [list of countries, e.g., the United States, [Country]].

We use necessary cookies to keep you signed in. Analytics and advertising cookies are used only with your consent, managed through our Cookie Preference Center at [URL].

[ENABLE ONLY IN: CALIFORNIA, USA] You may opt out of the "sale" or "sharing" of your personal information by clicking "Do Not Sell or Share My Personal Information" in our website footer, or by enabling your browser's Global Privacy Control (GPC) signal.

Your data may be transferred to and processed in countries outside your country of residence, including [Country] where our servers are located.

[ENABLE ONLY IN: UK / EU] We rely on the EU Standard Contractual Clauses (UK IDTA where applicable) for transfers out of the UK / EEA.

[ENABLE ONLY IN: RUSSIA] Personal data of Russian users is first recorded, systematized, and stored in databases located in the Russian Federation. Cross-border transfers are notified to Roskomnadzor in advance.

[ENABLE ONLY IN: VIETNAM] Before the first cross-border transfer of Vietnamese users' personal data, we complete a cross-border impact assessment file and submit it to the competent authority (Ministry of Public Security) within 60 days.

[ENABLE ONLY IN: JAPAN] Before providing personal data to a third party in a foreign country, we notify you of that country's data protection system and obtain your consent.

[ENABLE ONLY IN: BRAZIL] Cross-border transfers of personal data occur only when supported by adequate protection standards, standard contractual clauses, or your specific and highlighted consent, under Article 33 of the LGPD.

[ENABLE ONLY IN: THAILAND] Cross-border transfers occur only where the destination provides an adequate data protection standard, or under an applicable exception under Section 28 of the PDPA.

[ENABLE ONLY IN: INDONESIA] Cross-border transfers follow the three-tier mechanism of Article 34 of Law No. 27/2022: adequate protection, binding safeguards (such as standard contract clauses), or your explicit consent.

[ENABLE ONLY IN: MAINLAND CHINA] Data exported overseas follows the Personal Information Protection Law and the 2024 Cross-Border Data Flow Provisions. If the annual cumulative volume remains below the exemption threshold (fewer than 100,000 individuals, excluding sensitive personal information), we still provide notice and obtain your separate consent.

- Account data: for the lifetime of your account, plus [X days] after deletion.

- Transaction and advertising records: at least 3 years from completion of the transaction / end of the ad placement.

- Server logs: at least 6 months.

- Marketing consent records: for the period required by applicable law (at least 1 year in Vietnam; 3 years in Japan; retained as evidence under CASL in Canada).

You may: access, correct, delete your personal data; withdraw consent at any time; request data portability; object to direct marketing; and lodge a complaint with your local data protection authority. To exercise these rights, email [Email] or use the account settings at [URL].

[ENABLE ONLY IN: CALIFORNIA, USA] California residents have the right to know, delete, correct, and opt out of the sale/sharing of their personal information, and to limit the use of sensitive personal information. Use the "Do Not Sell or Share My Personal Information" link in our footer.

[ENABLE ONLY IN: UK / EU] Under Articles 15–22 of the GDPR, you have the right of access, rectification, erasure, restriction, data portability, objection, and to withdraw consent. We respond within one month.

[ENABLE ONLY IN: MEXICO] You may exercise your ARCO rights (Access, Rectification, Cancellation, Opposition) by emailing [Email].

[ENABLE ONLY IN: MAINLAND CHINA] You may view, copy, correct, supplement, or delete your personal data, request an explanation of our processing rules, or close your account, at any time from your account settings.

The Service is intended for users aged [18] or older.

[ENABLE ONLY IN: MAINLAND CHINA] Personal data of children under 14 is treated as sensitive personal data. We process it only with the separate consent of a parent or guardian, and under a separate processing notice for minors.

[ENABLE ONLY IN: BRAZIL] Processing personal data of children occurs only with the specific and highlighted consent of a parent or legal guardian.

[ENABLE ONLY IN: INDIA] We do not undertake tracking, behavioral monitoring, or targeted advertising directed at children.

[Company Name]

[Address]

Privacy inquiries: [Email]

[ENABLE ONLY IN: SINGAPORE] Data Protection Officer: [Name / contact], [Email]

[ENABLE ONLY IN: QUEBEC, CANADA] Person responsible for personal information protection: [Name / contact], [Email]

We use encryption in transit, role-based access controls, and data minimization. In the event of a personal data breach affecting you, we will notify you and the competent authority where required by law.

We may update this Policy. For material changes, we will notify you by email or in-service notice and, where required, obtain your renewed consent. The updated version will be posted at this URL with a new "Last updated" date.