Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Username — chosen by you during registration
• Email address — optional for community accounts; required for paid accounts (used for password resets & security alerts)
• Password — stored as a one-way cryptographic hash (Argon2id); we cannot read your password
• Account role — your membership tier (Community, User, Contributor, Designer, Admin)
• Registration date and last login timestamp

1.2 Guest Accounts

Guest accounts are temporary passwordless accounts created with a single click for the free Community tier. We store:

• Auto-generated guest username (e.g. Guest_123456)
• Hashed IP address using SHA-256 (for rate-limiting — max 3 guest accounts per IP per 30 days)
• Creation timestamp

Guest accounts have no email and cannot be recovered if lost. Guest accounts are excluded from public "member count" displays.

1.3 Payment Information

We use Stripe as our payment processor. When you purchase a membership:

• Your credit card details are handled entirely by Stripe and never touch our servers
• We store: payment status, plan type (monthly/yearly/lifetime), transaction timestamps, and Stripe session/subscription IDs
• We do not store your card number, CVV, or billing address
• Your IP address is logged at the time of each transaction for fraud prevention

1.4 Device & Browser Information

For security and fraud prevention, we collect device fingerprint data, including:

This data is used to detect account sharing, prevent unauthorized access, and identify banned users who attempt to create new accounts.

1.5 Usage Data

We automatically collect:

• Page views — which pages you visit and when
• Session data — session ID, current page, page view count, session duration
• Game analytics — which games you play and for how long
• Feature usage — which site features you interact with
• Performance metrics — page load times

1.6 AI Chat Data

If you use the AI Assistant panel, we store your messages, the AI's responses, the AI persona selected, and conversation timestamps. AI conversations are processed by Groq (third-party AI provider).

1.7 Profile Information

If you create or edit your user profile, we collect: nickname, description (max 500 chars), about section (max 2000 chars), and profile picture URL or uploaded image. Profile pictures require admin approval before being visible; submitted images are retained in administrative records, including declined images.

1.8 Live Threat Detection & IP Tracking

To protect the security of all users, we implement automated threat detection that monitors failed login attempts, rate-limiting data, and automated IP blocking. IPs with 5+ failed login attempts within 10 minutes are temporarily blocked for 30 minutes.

1.9 Password Security

2. How We Use Your Information

We use your information to:

• Provide and maintain your account and membership
• Process payments and manage subscriptions
• Detect and prevent fraud, abuse, and unauthorized access
• Enforce our Terms of Service and Acceptable Use Policy
• Improve site performance and user experience
• Respond to support requests
• Send critical account notifications (e.g., suspension, subscription expiry, new device login)

We do not sell, rent, or share your personal information with third parties for marketing purposes.

2.1 Administrator Monitoring

Site administrators have access to the following data for security, moderation, and site management:

• Login history — username, last login, IP address, user agent, account status
• Page visit analytics — aggregated into top-visited-pages reports
• Device fingerprints — for fraud detection
• AI chat conversations — for safety and moderation
• Smail messages — for moderation
• Support tickets & game reports
• Data clearing — admins may periodically clear aggregated analytics data

All administrative access to user data is logged in an audit trail (admin_audit_log), including the administrator's identity, the action performed, and the timestamp.

3. Third-Party Services & Embedded Content

3.1 Embedded Games (Iframes)

Our game pages embed third-party HTML games via <iframe> elements. These games are hosted on external servers and may independently collect data. We do not control their privacy practices.

3.2 CDN Resources

We load static resources (fonts, icons, JS libraries) from:

• cdnjs.cloudflare.com — Font Awesome icons, JS libraries
• cdn.jsdelivr.net — JavaScript libraries
• fonts.googleapis.com / fonts.gstatic.com — Web fonts

These CDN providers may log your IP address and browser information when serving resources. Their respective privacy policies apply.

3.3 Groq AI API

AI chat messages are sent to Groq for processing. See Groq's Privacy Policy.

3.4 Stripe Payment Processing

All payment processing is handled by Stripe, Inc. according to Stripe's Privacy Policy and PCI-DSS standards.

3.5 Google OAuth

If you sign in with Google, Google provides us with your email, name, Google ID, and email-verified status. See Google's Privacy Policy.

For detailed information about cookies and local storage, see our Cookie Policy.

4. Data Retention

4.1 User-Requested Account Deletion (Soft Deletion)

Users may request account deletion via Settings > Privacy > Delete Account:

• Immediate effect: Account disabled, username changed to "[Deleted User]"
• 30-day grace period: Account can be reactivated by logging in
• After 30 days: Personal data (email, IP logs, messages, Smail) purged
• Retained data: Public posts remain visible with "[Deleted User]" attribution

4.2 Terminated Account Retention

Accounts terminated for rule violations retain email hash, IP hash, device fingerprint, and strike history for up to 7 years after termination for ban-evasion prevention and legal record-keeping, after which these hashes are purged. This retention is limited to what is necessary for our legitimate interest in platform security.

4.3 Standard Data Retention Table

5. Data Security

We implement the following security measures:

• Encryption in transit — All connections are forced over HTTPS with HSTS
• Password hashing — Argon2id (industry standard)
• CSRF protection — Session-based tokens on all forms and state-changing requests
• Rate limiting — IP-based and session-based rate limiting on sensitive endpoints
• Prepared statements — All database queries use PDO prepared statements to prevent SQL injection
• Output escaping — User-supplied data is escaped with htmlspecialchars before being rendered in HTML
• Content Security Policy — CSP headers restrict script and resource loading
• Account lockout — Automatic lockout after 5 failed login attempts
• Device fingerprint binding — Sessions bound to device fingerprint on login

6. Data Storage Location & International Transfers

6.1 Where We Store Your Data

Your data is stored on servers located in the United States. Our hosting provider maintains data centers in multiple U.S. states to ensure redundancy and availability.

6.2 International Data Transfers

By using our Service, you acknowledge and consent to the transfer of your data to and processing in the United States. We take appropriate safeguards to protect your data when transferred internationally:

• Encryption in transit: All data transmitted over the internet is encrypted using TLS 1.3
• Encryption at rest: Data is stored on servers managed by our hosting provider, which may apply disk-level encryption. We do not apply additional application-level encryption to stored data.
• Access controls: Strict access controls limit who can access your data
• Third-party safeguards: We only use third-party services (Stripe, Groq, Google) that provide adequate data protection

6.3 EU/UK Users

If you are located in the European Union or United Kingdom, your data will be transferred to the United States. We use third-party service providers (such as Stripe, Groq, and Google) that publish their own data-processing agreements and international transfer safeguards, which may include Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions. These measures help ensure your data receives an adequate level of protection when transferred outside the EU/UK.

6.4 Third-Party Services

We use the following third-party services that may process data outside the United States:

• Stripe (payments): Data processed globally; see Stripe's Privacy Policy
• Groq (AI): Data processed in the U.S.; see Groq's Privacy Policy
• Google (OAuth, Fonts): Data processed globally; see Google's Privacy Policy

7. Your Rights (GDPR/CCPA)

You have the right to:

• Access your data — Export your settings from the Settings page
• Rectify inaccurate data — Update your profile and account details
• Delete your data — Clear your browsing data or request full account deletion
• Restrict processing — Request limits on how we use your data
• Data portability — Receive your data in a machine-readable format
• Object to processing — Opt out of non-essential data processing
• Opt out of tracking — Device fingerprinting is used for security and cannot be individually disabled, but requesting account deletion removes all stored fingerprint data

7.1 CCPA Rights (California Residents)

If you are a resident of California, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories of personal information we have collected about you and the purposes for which we use it
• Right to Delete: Request deletion of your personal information (with certain exceptions)
• Right to Opt-Out of Sale: We do not sell your personal information. See Section 7.2 below.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

7.2 Do Not Sell My Personal Information

We may share your data with third-party service providers (Stripe for payments, Groq for AI, Google for OAuth and fonts) only as necessary to provide our Service. These service providers are prohibited from selling your data.

If you wish to exercise your right to opt-out of the sale of personal information (even though we do not sell), you may contact us at support@thespencerwebsite.com with the subject line "CCPA Opt-Out Request." We will confirm within 45 days that we do not sell your data.

7.3 Right to Appeal Automated Decisions (GDPR Article 22)

Some account actions may be taken automatically based on rule violations. You have the right to:

• Obtain human intervention — Request that a human moderator review automated decisions
• Express your point of view — Submit an appeal explaining your perspective
• Contest the decision — Dispute strikes or terminations you believe were applied in error

To appeal an automated decision, submit a Smail message to the administrator within 30 days of the action. Appeals are reviewed by human moderators within 72 hours. Decisions after the second review are final.

To exercise any of these rights, contact us at support@thespencerwebsite.com.

8. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Users between 13 and 17 may use the Service with parental or guardian consent as required by our Terms, but this consent is a site policy, not a COPPA requirement (COPPA applies to children under 13). See our Children's Privacy Policy for full details.

If we learn we have collected data from a child under 13 without verified parental consent, we will promptly delete it.

9. Data Breach Notification

9.1 Our Commitment to Security

We implement robust security measures to protect your data (see Section 5. Data Security). However, no system is completely immune to security incidents.

9.2 Notification Procedure

In the event of a confirmed data breach that poses a risk to your personal information, we will notify affected users as follows:

• Email notification: We will send an email to your registered email address within 72 hours of discovering the breach
• Smail notification: If you have an account, we will send a notification via our internal Smail messaging system immediately
• Website notification: A prominent banner will be displayed on the website immediately upon discovery, visible to all logged-in users

9.3 Notification Content

Breach notifications will include:

• Description of the incident
• Types of personal information affected
• Steps we have taken to address the breach
• Steps you can take to protect yourself
• Contact information for questions

9.4 Legal Requirements

We comply with all applicable data breach notification laws, including:

• GDPR (EU): Notification within 72 hours to supervisory authority and affected individuals when there is a high risk
• CCPA (California): Notification within a reasonable time, and without unreasonable delay
• All 50 U.S. States: Various notification timeframes; we default to the strictest standard (72 hours)

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last Updated" date and, where applicable, communicated via Smail notification. Continued use of the site after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us:

Email: support@thespencerwebsite.com