This policy explains what [COMPANY LEGAL NAME] ("we") collects when you use SwayFate (the website, the player and our emails), why, who we share it with, and the choices you have. We designed the service so you can watch without an account; we collect the minimum needed to remember your place in a story, to run the service, and — with your permission where the law requires it — to measure our advertising.
1. What we collect
Information you give us
- Email address, if you join the launch list, create an account, or buy something — with the time and page of your consent.
- Purchases: what you bought and when. Card details are entered directly with our payment processor (Stripe) and never reach our servers; we receive a token, the last four digits and the card brand.
- Messages you send to support.
Information created when you watch
- A viewer identifier (a random code stored in your browser) so we can resume your story and remember your choices on this device.
- Your progress and choices in each story: episode reached, decisions taken, story state, endings seen.
- Playback and usage events: which episodes start and finish, how long clips take to load, errors, device and browser type, approximate location derived from your IP address (country/region), the page you came from and campaign parameters in the link you clicked.
Information from advertising tools (only with consent where required)
- If you arrived from an advertisement, the platform's click identifier, and conversion events we send back to that platform (for example "started watching", "purchased") so we can measure which advertisements work. Email addresses used for this are hashed first.
2. Why we use it (and our legal bases where the GDPR/UK GDPR applies)
- To play stories and remember your place and choices — performance of our contract with you / legitimate interest in running the service.
- To process payments, deliver what you bought, prevent fraud and keep accounts — contract; legal obligation (tax and accounting records).
- To understand and improve the product (aggregate analytics, error monitoring) — legitimate interest; consent where local law requires it for analytics cookies.
- To send the emails you asked for (launch list, receipts, account messages) and, if you opt in, news about new seasons — consent, which you can withdraw at any time with the unsubscribe link.
- To measure advertising — consent in the EEA/UK/Switzerland and wherever else the law requires; otherwise legitimate interest, with an opt-out.
3. Who we share it with
We do not sell personal information for money. We share it with service providers who process it for us under contract:
- Hosting and databases: Vercel, Neon, Cloudflare.
- Payments: Stripe (independent controller for its own fraud and legal obligations).
- Product analytics and error monitoring: PostHog, Sentry.
- Email: Resend and, later, Customer.io.
- Support chat: Crisp.
- Advertising measurement (consent-based where required): Meta Platforms, TikTok — these companies may use the data under their own policies; US state privacy laws may treat this as "sharing" for cross-context advertising, and you can opt out as described in section 7.
We will disclose information if the law requires it, to protect rights and safety, or as part of a sale or merger of the business (you would be notified).
4. International transfers
We operate from [REGISTERED ADDRESS] and use providers in the United States and the European Union. Where data moves out of the EEA/UK we rely on adequacy decisions or standard contractual clauses.
5. How long we keep it
- Viewer identifier, progress and choices: until you clear your browser storage or ask us to delete them; inactive records are deleted after 24 months.
- Launch-list emails: until you unsubscribe or 24 months after our last email to you.
- Purchase records: as required by tax law (typically 7 years).
- Analytics events: 24 months, then aggregated.
6. Cookies and similar technologies
We use browser storage for strictly necessary purposes (your viewer identifier, playback settings, your place in a story) without asking. Analytics and advertising technologies are only set after you agree, where the law requires agreement; you can change your choice at any time via "Privacy settings" in the footer. We honour the Global Privacy Control signal as an opt-out of sharing.
7. Your rights and choices
- Access, correct, delete or export your data; object to or restrict processing; withdraw consent — email [SUPPORT EMAIL]. We respond within 30 days (45 days under some US state laws) and will verify your request using the email address or viewer identifier involved.
- Unsubscribe from marketing with the link in any email.
- Opt out of advertising "sharing": use "Privacy settings" / "Do Not Sell or Share My Personal Information" in the footer, or enable Global Privacy Control in your browser.
- EEA/UK residents may complain to their data protection authority. We will appoint EU and UK representatives when we market there; their details will appear here.
8. Children
SwayFate is for adults (18+). We do not knowingly collect information from anyone under 18; if you believe we have, contact [SUPPORT EMAIL] and we will delete it.
9. Security
Data is encrypted in transit and at rest with our providers; access is limited to people who need it; payment data never touches our systems. No service is perfectly secure; if a breach affects you we will tell you as the law requires.
10. Changes and contact
We will post changes here and, for material changes, notify subscribers by email. Contact: [COMPANY LEGAL NAME], [REGISTERED ADDRESS], [SUPPORT EMAIL].