account information:

• email address and username for account creation
• payment information processed securely by our payment processor (we do not store full card numbers)
• passkey public keys and credential identifiers (private keys remain on your device)
• creator payout information handled by our payout provider (we receive limited status metadata)

content you create:

• posts, photos, comments, and other content you publish
• draft content saved automatically while editing
• ratings and reviews you provide

usage information:

• pages viewed, searches performed, and features used
• device information and browser type
• ip address and general location for session management
• interaction patterns to improve our recommendation system

information from other sources:

• verification and fraud-prevention signals from service providers
• payment and payout status updates from our processors (limited metadata)

we use your information to:

• provide and improve our marketplace service
• process payments and manage your passport membership
• enable communication between buyers and creators
• prevent fraud and enforce our terms of service
• send important account notifications and updates
• analyze usage patterns to enhance user experience

we may use aggregated and de-identified information for analytics and service improvement, and we will maintain it in de-identified form and not attempt to reidentify it, unless required by law.

legal bases (where applicable): contract (to deliver the service you request), legitimate interests (to keep the platform secure and improve it), consent (for optional features like certain analytics or communications), and legal obligation (tax, accounting, and compliance).

public information:

• your username and published content are public
• comments and ratings you leave are visible to other users
• creator profiles show aggregated statistics like total sales

service providers:

• Stripe (payment processing, subscriptions, and creator payouts)
• Cloudflare (hosting infrastructure, R2 storage, Workers, and CDN services)
• PostgreSQL hosting provider (database services)
• analytics providers to understand usage (aggregated/limited where possible)

legal requirements:

we may disclose information when required by law, to protect our rights, or to ensure platform safety and security.

business transfers: if we are involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to applicable law and any required notices.

affiliates: we may share information with our affiliates for purposes consistent with this policy.

we implement reasonable security measures to protect your information:

• encrypted data transmission using tls
• passkey authentication and login link verification
• regular security reviews and updates
• limited access to personal data on a need-to-know basis

no method of transmission or storage is 100% secure.

we retain your information as long as your account is active or as needed to provide services. specific retention periods:

• account data: until account deletion
• published content: may remain available to prior purchasers even after account deletion
• payment records: 7 years for tax and legal compliance
• session logs: 30 days for security purposes
• backups: limited-time backups may persist for up to 30–90 days

account control:

• update your profile information at any time
• delete your account through settings
• control visibility of your published content

data rights (where applicable):

• request correction or deletion of your data (subject to legal requirements)
• object to or restrict certain processing activities
• opt out of marketing communications at any time
• for some regions: opt out of “sale” or “sharing” of personal information (we do not sell personal information)

communication preferences:

• unsubscribe from marketing emails (account notifications still sent)
• adjust notification settings in your account preferences

we use essential cookies for authentication and session management. we don't use advertising cookies or third-party tracking for marketing purposes.

• session cookies to keep you logged in
• preference cookies to remember your settings
• analytics cookies to understand platform usage (aggregated/limited data)

you can control cookies via your browser settings. if we offer in-app controls, they will be available in settings.