Privacy Policy — We Know Less About You Than You Think

Last updated: May 2026

We know what you're thinking: "Great, another privacy policy no one will read." We get it. But this one is actually short, honest, and written by people who are also tired of 47-page privacy documents. Here is exactly what we collect, why, and what we do with it.

1. What We Collect and Why

A. When You Donate

• Nickname (chosen by you, publicly displayed)
• Message (chosen by you, publicly displayed)
• Country and flag (chosen by you, publicly displayed)
• Donation amount in USD (publicly displayed)
• Timestamp of donation (shown on leaderboard)
• Stripe payment session ID (for our financial records only — we never see your card number)

Everything you submit in the donation form is designed to be public. That's the whole point. Do not submit your real name or any information you don't want the world to see.

B. Automatically Collected

• IP address (stored temporarily for fraud prevention and rate limiting)
• Browser/device type via User-Agent headers (used for analytics, not stored long-term)
• Referral source (how you found us — anonymized)

We do not build profiles. We do not sell data. We do not know your name unless you typed it in the nickname field, which would be a bold choice.

C. Cookies

We use essential cookies for site functionality (language preference, session state). We use analytics cookies if you consent. See our Cookie Policy for details.

2. How We Use Your Data

• Display your entry on the leaderboard (public)
• Process and verify your payment via Stripe
• Detect and prevent fraud and abuse
• Comply with legal obligations
• Send transactional emails (payment confirmation) — and that's it

We do not send marketing emails unless you explicitly opt in somewhere (we currently have no such form, so you're safe).

3. Who We Share Data With

Nobody sells anything here. We share minimal data with:

• Stripe: payment processing. They have their own privacy policy and are extremely serious about it.
• Our hosting provider (cloud infrastructure): stores encrypted data on our behalf.
• Law enforcement: only if legally compelled by valid court order or applicable law.

We do not sell data. We do not trade data. We do not give data to data brokers. We do not share data with "advertising partners." We are not that kind of company and frankly, your data isn't that interesting to us beyond making the leaderboard work.

4. Data Retention

• Leaderboard entries: retained permanently (that's the product — your digital immortality)
• IP addresses from rate limiting: purged after 24 hours
• Payment records: retained for 7 years as required by financial regulations
• Analytics data: anonymized after 12 months

5. Your Rights (GDPR / General)

Depending on your jurisdiction, you may have the right to:

• Access: see what data we hold about you
• Rectification: correct inaccurate data
• Erasure ("right to be forgotten"): we can remove your leaderboard entry. Note: this affects a public display, not a secret file.
• Restriction: limit how we process your data
• Portability: receive your data in a structured format
• Objection: object to processing based on legitimate interests

To exercise any of these rights, email szymon.codecroissant@gmail.com. We will respond within 30 days as required by law. Requests are free of charge. We will verify your identity before fulfilling requests.

6. Security

We use industry-standard security practices: HTTPS everywhere, encrypted databases, least-privilege access controls, and we do not store payment card data (Stripe handles all of that). No system is perfectly secure, but we take this seriously.

7. International Transfers

If you are in the EU/EEA, your data may be processed in countries outside the EEA. We ensure appropriate safeguards are in place (Standard Contractual Clauses or equivalent).

8. Contact

Data controller: FlexWall (legal entity details available on the Contact page). Privacy inquiries: szymon.codecroissant@gmail.com.