Privacy Policy

This Policy describes how Orbon-Simunovic Software (“we”) collects, uses, and shares personal information through Culvita.

1. What we collect

• Account info: email, display name, date of birth, optional avatar and bio.
• Guardian info (for minor creators): the parent / legal guardian's consent record, IP and user-agent at consent time, and Stripe Identity / Connect references. The identity documents themselves are collected and stored by Stripe; we only receive a verified / not-verified signal.
• Project content: titles, descriptions, images, milestones, and updates you publish.
• Payment metadata: pledge amount, Stripe PaymentIntent and Customer IDs, refund records. We do not store full card numbers, CVCs, or bank account numbers — those go directly to Stripe.
• Device tokens (if you opt in to push notifications): Expo / Apple / Google / Web Push tokens.
• Logs: IP address, user-agent, requested URL, and timestamps for audit and abuse prevention. Logs are PII-redacted before storage where feasible.

2. How we use it

• To operate the platform: account auth, project listings, pledges, payouts.
• To prevent abuse: rate limiting, fraud signals, automated language scanning for prohibited content.
• To comply with legal obligations: tax records, audit trails for moderation actions, payment history retention.
• To send you transactional notifications (account, project, pledge events). You can control these at /settings/notifications.

3. Who we share with

• Stripe, Inc. — for payments, identity verification, and Connect payouts. Stripe's privacy policy: stripe.com/privacy.
• Supabase — for managed Postgres and authentication.
• Resend — for transactional email.
• Apple Push Notification service / Google Firebase Cloud Messaging / Web Push — for push notifications you opted in to.
• Law enforcement — only in response to a valid legal request, and only the minimum necessary information.

We do not sell personal information. We do not run third-party advertising trackers.

4. Children (under 13)

Culvita's minimum age is 13. We do not knowingly collect information from children under 13. If you believe a child under 13 has signed up, please email moose@foilforge.net and we will remove the account.

5. Minors (13–17)

Minor creators (13–17) can sign up and browse, but a verified parent or legal guardian must consent and complete identity + payout onboarding before the minor can publish a project or receive funds. The guardian is the legal owner of the connected Stripe account.

6. Your rights

Under GDPR and CCPA you have the right to (a) access your data, (b) request deletion, and (c) correct inaccurate information. Use /settings/privacy to download a JSON export of your data or request account deletion. Deletion requests have a 30-day grace period; for minors, the guardian must confirm before the grace period starts.

7. Data we keep after deletion

When you delete your account we anonymize your profile (display name, avatar, bio) and remove transient records (device tokens, favorites, notification history). We retain payment and refund records for the period required by U.S. tax and anti-money-laundering law (typically 7 years), without any personally-identifying fields that aren't already required by those laws.

8. Security

All traffic is HTTPS-only (HSTS preload). Database access is gated by row-level security. Service-role credentials are never exposed to client code. We rate-limit sensitive endpoints, redact PII from logs, and verify Stripe webhook signatures.

9. Changes

We may update this Policy; the “Last updated” date above will change. Material changes will also be announced to active users.

10. Contact

Privacy questions: moose@foilforge.net.