Draft.This text is a template and has not been reviewed by a lawyer. Values in [brackets] still need to be filled in.

Privacy Policy

Effective date: [effective date]

This policy explains what personal data Golden Tier collects, why, and your choices. The controller is[Legal name of the business], [Business address]. Contact: [contact email].

1. Data we collect

Account:email address, name (optional), and a password stored only in hashed form by our sign-in provider. If you sign in with Google or Discord, we receive your name, email address and account id from that service.
Your Content:idea descriptions, uploaded images and videos, corrections, feedback, and messages to the AI assistant.
AI output:the analyses, diagnoses, mockups and answers generated for your projects, with the model and prompt version used.
Usage and billing:which AI steps ran, credits used, your plan and subscription status, purchase history. Payment details are collected by Lemon Squeezy; we receive only the subscription and order status.
Rewards:quests completed, bonus credits, who invited you (if you signed up from an invite link) and, if you verify Discord membership, your Discord user id and username.
Technical and analytics data:IP address, browser and device information and technical logs from our hosting; with your consent, pages visited and product events (for example "analysis started") through PostHog and Google Analytics. Some product events are also recorded by our servers, without cookies, to operate and secure the Service.

2. How we use it

To provide the Service: store your projects, run the AI steps you request, and show you the results (contract).
To bill you and manage credits and subscriptions (contract, legal obligations for tax and accounting records).
To keep the Service secure and fair: rate limits, abuse prevention, debugging (legitimate interests).
To improve Golden Tier: aggregated usage analytics (cookie-based analytics only with your consent), and your ratings and corrections of AI output to evaluate and improve analysis quality (legitimate interests). We do not use Your Content to train AI models, and our AI providers process it under terms that do not allow them to train on it.
To send service emails, such as sign-in links, receipts and notices of changes. We send marketing emails only with your consent.

3. Who we share it with

We do not sell personal data. We share it only with service providers that process it on our behalf:

Provider	Purpose	Data
Supabase	Database, sign-in and file storage	Account data, Your Content, AI output, usage and billing records
Vercel	Website and application hosting	Requests, IP address, technical logs
AI providers: Google (Gemini), Anthropic (Claude), OpenAI, DeepSeek, Z.ai, Cloudflare Workers AI — depending on configuration	Generating analyses, answers and mockup images	Idea text, uploaded images, project context and your questions
Lemon Squeezy	Payments, taxes and invoices (merchant of record)	Name, email, billing address, payment details (we never receive card numbers)
Google (optional)	Sign-in with Google	Name, email address, Google account id
Discord (optional)	Sign-in with Discord, and the community membership check	Your Discord user id, username and the list of servers you are in (we only check for our server)
PostHog	Product analytics and error monitoring	Account id, email, feature usage events
Meta Pixel	Advertising measurement, with your cookie consent	Pages visited, conversion events, device information and cookie identifiers — never idea text or email
Google Analytics (via Firebase)	Website traffic analytics	Pages visited, device and approximate location, cookie identifiers — never idea text or email

We may also disclose data when required by law, or to protect our rights, users or the public.

4. International transfers

Our providers may process data in the United States, the European Union and other countries. Where required, transfers rely on safeguards such as the EU Standard Contractual Clauses.

5. How long we keep it

Account data and projects: while your account exists. Deleting a project deletes its content and files.
After you ask us to delete your account: removed within 30 days, except records we must keep.
Billing and tax records: as long as the law requires, typically [number] years.
Technical logs: up to [number] days.

6. Cookies and similar technologies

Necessary:sign-in session cookies. The Service does not work without them.
Analytics (optional): Google Analytics cookies (for example _ga) and PostHog cookies measure how the site is used. They are set only after you clickAccept in the cookie banner. You can change your choice at any time with Cookie settingsat the bottom of the site or in Settings; rejecting stops collection and removes these cookies.

7. Your rights

Depending on where you live, you may access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent. Email [contact email]; we answer within 30 days. You may also complain to your local data protection authority.

8. Security

Data is encrypted in transit, private files are stored in a private bucket and shared only through short-lived links, and every project is isolated by database access rules. No system is perfectly secure; tell us at[contact email]if you find a vulnerability.

9. Children

The Service is not intended for anyone under 16. We do not knowingly collect their data.

10. Changes

We will post updates here with a new effective date and notify you of material changes by email or in the app.