Privacy Policy

1. Who is responsible for your data?

The operator of the Service (the "Artist" or "Host") is the data controller. For contact details, see Section 10 below.

2. What data we collect and why

We collect only the minimum data necessary to run the Service.

• Email address – Account creation, login, password reset. Legal basis: contract; legitimate interest (security).
• Password – Stored as a one-way hash; we never see your plain password. Legal basis: contract.
• Display name (optional) – Shown on posts and comments. Legal basis: consent / contract.
• Country / region – Age-verification rules, analytics, compliance. Legal basis: legal obligation; legitimate interest.
• Age verification result – We do not store your ID documents; the third-party verifier may retain data per their policy. Legal basis: legal obligation.
• IP address – Security, fraud prevention, jurisdiction (e.g. age-verification), post-view analytics. Legal basis: legitimate interest; legal obligation.
• Session cookie – Keeping you logged in. Legal basis: contract; strictly necessary.
• Posts, likes, comments – Providing the Service. Legal basis: contract.
• Post-view counts – Content analytics; we disclose this and, where required, obtain consent. Legal basis: legitimate interest.

We do not sell your personal data. We do not use your data for advertising or marketing to third parties.

3. Cookies and how we use them

We use:

• Strictly necessary cookies – e.g. session cookie so you stay logged in. These do not require consent under EU/UK law; we disclose them here.
• Content analytics – e.g. to count post views. We disclose this and, where required by law, we ask for your consent once (at first visit or signup). We do not use marketing or advertising cookies.

If we change how we use cookies, we will ask for your consent again where required.

4. How long we keep your data

• Account data – For the duration of your account and a short period after deletion (e.g. disputes or legal holds), then deleted.
• Session – Until you log out or the session expires.
• Posts, likes, comments – Until you delete them or close your account, except where we must retain for legal or safety reasons.
• Post-view analytics – Aggregated or pseudonymised where possible; raw logs only as long as needed for security and compliance.
• Age verification – We store only that you passed; we do not store copies of your ID.

5. Your rights (EU, UK, and similar)

If you are in the EEA or the UK, you have the right to: access, rectification, erasure, restriction, data portability, object, withdraw consent, and complain to a supervisory authority. To exercise these rights, contact us (Section 10). We will respond within the time required by law (e.g. one month under GDPR).

6. Users in the United States

We do not sell personal information. We collect only what is necessary for the Service, age verification, and security. If you are in a state with additional rights (e.g. California under CCPA/CPRA), you may have the right to know, delete, and correct your data, and to opt out of "sale" or "sharing" – we do not sell or share your data for cross-context behavioural advertising. Contact us (Section 10) to exercise rights.

7. International transfers

Your data is processed in Bulgaria (EU). If we use processors outside the EEA/UK, we will ensure appropriate safeguards (e.g. standard contractual clauses) as required by GDPR/UK GDPR.

8. Security

We use industry-standard measures (HTTPS, hashed passwords, secure sessions). We will notify you and regulators where required if a breach affects your personal data.

9. Children

The Service is for adults only (18+). We do not knowingly collect data from minors. If you believe we have, please contact us so we can delete it.

10. Contact

For privacy requests or questions: admin@figgapp.eu. In the EU/UK you may also lodge a complaint with your local data protection authority.