Privacy Policy

This policy explains how FlakePot (“FlakePot”, “we”) handles personal data when you use flakepot.com. We collect as little as we can and never sell your data.

What we collect

• Account details: email address, display name, username, avatar, home currency and your confirmation that you are 18+.
• Payment handles you choose to add: e.g. your PayPal.me or Venmo username, UPI ID, a QR code image or bank details, shown to people in your plans so they can pay you directly.
• Plan activity: plans you create or join, deposit and refund claims you record, check-ins, vouches, excuses, votes, and photos you upload.
• Location at check-in: when you tap “I'm here”, your device's coordinates and accuracy are sent once to verify you are at the venue. We don't track your location in the background.
• Notifications: your notification preferences and, if you enable push, a push subscription for your device.
• Purchases: Paddle (our merchant of record) processes payments. We receive a customer ID, what you bought and the subscription status, never your card details.
• Technical data: IP address for security and rate limiting, and privacy-friendly analytics (self-hosted Umami, no cookies, no cross-site tracking).

What we don't do

• We never receive or hold the money you send to friends, and we don't see your bank or payment app accounts.
• We don't sell personal data or use it for third-party advertising.

Who can see what

• Your profile, reliability score and badges are visible to other users.
• Plan details and who's in are visible to anyone with the plan's invite link. Outcomes, excuses, votes and photos are visible only to members of that plan.
• Share cards you or your plan-mates create are public at their link.

Why we use it (legal bases)

• To provide the service you asked for (contract): accounts, plans, check-ins, settlements, notifications.
• For security and abuse prevention (legitimate interests): rate limiting, moderation, fraud checks.
• To process purchases and meet tax obligations (contract and legal obligation), via Paddle.
• For optional push notifications and location at check-in (consent, which you can withdraw in your browser or Settings).

Service providers

• Supabase (database, authentication, file storage)
• Resend (transactional email, sent from send.flakepot.com)
• Paddle.com (payments, as merchant of record)
• Google (only if you choose “Continue with Google”)
• OpenStreetMap and Photon by Komoot (map tiles and venue search)
• Our own servers for the app, analytics (Umami) and background jobs

How long we keep it

We keep your data while your account exists. Reliability scores only use the last 12 months. When you delete your account we delete your profile, plans you organized, your photos and your history, except records we must keep for tax or legal reasons (e.g. purchase records held by Paddle). Server logs are kept for up to 30 days.

Your rights

Depending on where you live, you can access, correct, export or delete your data, object to processing, or withdraw consent. Most of this you can do yourself in Settings (including deleting your account). For anything else email hello@flakepot.com. You can also complain to your local data protection authority.

Children

FlakePot is only for people aged 18 and over. We delete accounts we learn belong to someone younger.

Changes

We'll post updates here and tell you in the app or by email about significant changes.