Privacy Policy

Your privacy is the product. This is the shortest version of what we collect and why.

What we collect

• Account info: email, handle, display name, password hash.
• Profile: bio, avatar.
• Creator date of birth: used only to confirm you are 18+. Never shown on your profile, never shared.
• Messages and media: stored encrypted-at-rest in Supabase.
• Technical logs: IP address, user agent, request timestamps. Kept 30 days for abuse prevention.

What we don’t collect

• Third-party advertising or tracking cookies.
• Your contacts, location, or device identifiers.
• Payment details (we don’t process payments yet).

How we use it

To run the Service: deliver your messages, show your profile to people who follow you, verify your age, and investigate abuse. We don’t sell your data. We don’t train anyone’s AI on your messages.

Who we share with

• Supabase — our database, auth, and storage provider.
• Vercel — our hosting provider.
• Law enforcement — only when legally compelled. We will notify you unless prohibited by law.

Your rights

You can edit or delete your account and most of your data from your account page. To request export or full deletion (including logs), email privacy@confidential.org.

Retention

• Account data: while your account is active.
• Messages and media: until you or the other party delete them.
• Creator DOB: as long as your creator account is active.
• Abuse logs: 30 days.

Children

Confidential is not for anyone under 18. If we learn a minor has created an account, we’ll delete it.

Contact

privacy@confidential.org