Privacy Policy

Version draft-2026-10-01. This is a working draft under legal review; the practices below reflect how FanNest operates today.

1. What we collect

Account email and password hash (Supabase Auth) when you create an account. Nestor signups: the email you give, an optional display name, the Nest you joined, a consent timestamp, and a salted hash of your IP (abuse prevention — we do not store raw IPs). Outbound-link clicks are logged per link with a referrer class (search, social, AI assistant) and no account identity. Claim records store the account you named for verification and your Terms acceptance timestamp. [Counsel: legal bases per category (GDPR Art. 6), retention periods.]

2. What we never collect

Payment card details never touch FanNest servers — checkout is processed entirely by Stripe. We run no third-party advertising trackers, and we do not sell or rent personal information. [Counsel: confirm 'do not sell/share' wording for CCPA/CPRA.]

3. How we use it

To operate Nests and their signups, verify and bill claims, show hosts aggregate (never per-person) analytics, keep links healthy, and prevent abuse. Nestor emails are used to confirm your signup and, where you consented, for updates from that Nest — every email carries an unsubscribe link. [Counsel: marketing-consent wording once double opt-in ships via Resend.]

4. Who processes it

Supabase (database and authentication, US-East), Vercel (hosting), Stripe (payments), Resend (email, when enabled). Directory content is assembled from public sources (Wikidata, MusicBrainz, YouTube channel statistics) and concerns public figures' public accounts, not private individuals' data. [Counsel: DPA status per processor; international-transfer mechanism.]

5. Your choices and rights

Unsubscribe from any Nest's emails via the link in each message. Request access, correction, or deletion of your data by contacting us; public-figure directory pages have their own route — the 'Report this page' link on every Nest. [Counsel: contact address, DSAR process and timelines, EU/UK representative if needed.]

6. Cookies, children, changes

We use first-party cookies only: your sign-in session and, pre-launch, an invite cookie. No advertising cookies. FanNest is not directed at children under 13. [Counsel: COPPA position, cookie-banner necessity by jurisdiction, policy-change notice mechanics.]