Data we collect
Viewers (supporters):
- Nickname (required, stored in plain text)
- Email address (optional, stored in plain text for notification purposes)
- IP address hash (one-way SHA-256 hash, not reversible)
- Uploaded proof files (images/PDFs, stored in encrypted cloud storage)
- Session token (HttpOnly cookie, 24-hour expiry)
Creators & Moderators:
- Email address (via Supabase Auth magic links)
- Moderation action logs (who approved/rejected what)
How we use it
- To coordinate support claims and prevent duplicate claims
- To notify viewers of submission status (approved/rejected)
- To detect and prevent fraudulent submissions
- To moderate and display supporter names in the journey timeline
IP address hashing
We never store your raw IP address. We store a one-way SHA-256 hash combined with a server secret. This hash is used to detect abuse (e.g., repeated fraudulent submissions) but cannot be used to identify you directly.
Data retention
- Session tokens: deleted after 24 hours
- Expired/rejected claims: retained for 90 days for fraud detection
- Approved submissions: retained for the duration of the journey archive
- Email addresses: retained until you request deletion
Third-party services
- Supabase — database and authentication (GDPR compliant)
- Resend — transactional email delivery
- Vercel — hosting and edge functions
Your rights
Under GDPR and PH DPA, you have the right to access, correct, or delete your personal data. To exercise these rights, contact the platform creator directly via their YouTube channel. We will respond within 30 days.
Cookies
We use one HttpOnly session cookie per viewer session. This cookie is essential for claim security and is not used for tracking. We do not use advertising, analytics, or third-party tracking cookies.
No monetisation of data
We do not sell, rent, or share personal data with third parties for commercial purposes.