Privacy Policy

Draft for owner review — not legal advice. Last updated [DATE]. Operator: [LEGAL NAME OF OWNER / BUSINESS].

What we collect

• Your email address, when you verify a vote or sign up for launch alerts. Verification uses a 6-digit code sent by email (Supabase Auth, delivered through Resend). We do not ask for a password, name or address.
• Your votes: which cities you voted for and when. Public pages only ever show totals and charts — never who voted.
• Launch-alert choices: which city (or “any new city”) you asked to hear about, when you agreed, and where on the site you signed up. Voting never signs you up for email.
• Abuse-prevention signals: a keyed one-way hash of your IP address and of a first-party device cookie, attached to votes and to rate-limit counters. We use these only to stop automated or repeated voting. Hashes on votes are cleared after 90 days; rate-limit counters expire within a day; abuse logs are deleted after 30 days.
• Bot protection: hCaptcha checks some requests (sending a code, signing up for alerts, and unusual voting bursts). hCaptcha processes data under its own privacy policy.

Cookies

• A Supabase session cookie that remembers that your email is verified on this device (so the next vote is one tap). “Not you?” removes it.
• A first-party device id cookie (random, no personal data) used only for abuse prevention.
• hCaptcha may set its own cookies when a check runs. We do not use advertising or analytics cookies.

Site statistics

We use Vercel Web Analytics to count page views in aggregate (pages visited, referring site, country, device type). It sets no cookies and does not identify you or follow you across sites. We strip query strings before anything is counted, and private pages (alert links, unsubscribe, admin) are not counted at all.

Email

We send a code email when you ask to verify, a confirmation email if you sign up for alerts without a verified session, and launch emails only for the alerts you chose. Every launch email has a one-click unsubscribe link and a link to manage your alerts. Delivery status (delivered, bounced, complained) is reported to us by Resend so we stop sending to addresses that bounce or complain.

Shopping

Purchases happen on Printify’s Pop-Up Store, not on this site. We never see or store payment details. Printify’s own terms and privacy policy apply to orders, payment, shipping and order support.

Who processes data for us

• Supabase (database and email verification)
• Vercel (hosting and aggregate site statistics)
• Resend (email delivery)
• hCaptcha (bot protection)
• Printify (checkout and fulfilment — on their site)

Your choices

• Unsubscribe from any alert from the link in the email, or use “Manage city alerts”.
• To ask for a copy or deletion of your data, contact [PRIVACY CONTACT EMAIL]. Deleting your verified email also removes the link between you and your votes; the city totals may keep the anonymous count.

Children

This site is not directed to children under 13. [OWNER: confirm age policy]

Changes

We will post changes here with a new “last updated” date.