Privacy Policy

1. Information we collect

• Account information: email address, username, and password (stored securely by our authentication provider, Supabase — we never see your plaintext password).
• Profile information you choose to add: display name, bio, avatar, employment, education, location, and topics of interest. These are optional, and some can be marked private in Settings.
• Content you post: posts, comments, votes, follows, saved posts, and reports you submit.
• Security/technical data: when you sign up, sign in, or request a password reset, our bot-protection provider (Cloudflare Turnstile) processes your IP address and browser signals to verify you're not an automated script. We also use error-monitoring (Sentry) that can capture technical details (e.g. browser type, the page you were on) when something breaks, to help us fix it.
• Usage data: we use Vercel Analytics for basic, privacy-friendly traffic statistics (e.g. page views). It does not use tracking cookies to build a profile of you across other websites.

2. How we use your information

We use your information to operate the platform: to show your posts and comments to other users, to enforce our moderation rules, to send you account-related emails (password resets, email changes), to protect the platform from spam/abuse, and to improve the product. We do not sell your personal information to third parties.

3. Cookies and similar technologies

We use only the cookies/local storage strictly necessary to keep you signed in (managed by Supabase Auth) and to remember basic preferences. We do not use advertising or cross-site tracking cookies. Our bot-protection widget (Cloudflare Turnstile) may set a short-lived cookie as part of verifying you're not a bot.

4. Post expiration and data retention

Posts are hidden from public feeds after 7 days (or a shorter duration you choose when posting), but the underlying record is retained for a period afterward for moderation and integrity purposes, not indefinitely displayed. Account information is retained until you delete your account.

5. Your rights and controls

From Settings, you can at any time:

• Export your data — download a copy of your profile, posts, and comments.
• Control profile visibility — hide employment/education/location from other visitors.
• Delete your account — your profile is anonymized (shown as "Private user") and you can no longer sign in. Your posts and comments remain visible, without your name attached, so other people's conversations aren't disrupted.
• Block other users and mute Republics to control what you see.
• Sign out of all other devices from one place, without changing your password.

Depending on where you live, you may also have the right to access, correct, or request a copy of your personal data; to object to certain processing; or to lodge a complaint with your local data protection authority. Contact us (below) to exercise any of these rights.

6. Third-party services

We rely on the following providers to run SFERAT, each processing data on our behalf under their own security and privacy commitments:

• Supabase — database, authentication, file storage.
• Vercel — hosting and privacy-friendly analytics.
• Resend — delivery of account emails (confirmation, password reset).
• Sentry — error monitoring, to help us find and fix bugs.
• Cloudflare (Turnstile) — bot/abuse protection on sign-up and sign-in.

Some of these providers may process data on servers outside your own country. Where that happens, they do so under their own applicable safeguards for international data transfers.

7. Children

SFERAT is not directed at children under 16. If you believe a child has created an account, please contact us so we can remove it.

8. Contact

Questions about this policy or your data? Contact us at sferatapp@gmail.com.