Privacy Policy

What we collect

Only what the service needs:

• Account — when you sign in with GitHub or Google we receive your name, email address, avatar URL and that provider's ID for you. We store the username, display name, bio, links and avatar you set.
• What you post — products, screenshots, updates, comments, votes.
• Collaboration — requests you send or receive, and the email addresses both sides confirm when they choose to exchange contacts.
• Payments — Stripe handles your card. We get the order: what was bought, when, for how much, and a reference that ties it to you. Card numbers never reach us.
• Abuse signals — the IP address and time of sign-ins and votes, so one address can't stuff a ballot. Plus the reports and blocks you file.
• Cookies — one session cookie that keeps you signed in. No analytics, no ad pixels, no third-party trackers.

Why we use it

• To run your account and the pages you see.
• To count votes, rank products and makers, and keep the boards honest.
• To verify the link back and re-check it every 7 days.
• To take payments, calculate tax and handle refunds.
• To catch manipulation and spam, and to act on reports.
• To email you about your own account, orders and listings — review results, collaboration requests, receipts. Not marketing.

What's public

Your username, display name, avatar, bio, links, your published products with their screenshots and updates, vote counts, badges, and your position on the boards. Completed collaborations show as a count.

Everything on a product page is public, so treat it that way: search engines index it, and archives keep their own copies that we can't recall.

Who else sees it

A small set of providers runs the site: Supabase (database and sign-in), Vercel (application hosting), Cloudflare (DNS, the cache in front of the site, and R2 for image storage), and Stripe (payments and tax). GitHub and Google are involved only when you sign in.

• We don't sell, rent or share your personal data for advertising.
• We hand over data when the law requires it, or when it's needed to protect someone's safety or enforce these terms.
• Public content stays public — anyone can read it, and so can anything that copies it.

Where it lives and how long

Our providers store data in the United States and the European Union, so if you're elsewhere, your data is transferred there to be handled.

The audit trail of what happened on the site — sign-ins, votes, task completions — is deleted after 180 days. Your account, products, votes and orders stay for as long as your account does.

• Removed listings keep a record rather than vanishing, so refunds and disputes stay auditable.
• Payment records are kept as long as tax law requires.

Deleting your account

Email hello@debutpin.com and we'll delete your profile and take your products offline, then confirm within 30 days. Orders stay for tax and dispute records, and the audit trail ages out on its own.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to hello@debutpin.com — the same address handles GDPR requests in the EEA, the UK and Switzerland, CCPA requests in California, and anything similar elsewhere.

If you think we've handled something badly, tell us first. We'd rather fix it than argue about it.

Security

The site runs over HTTPS, card data never touches our servers, and database access is locked down row by row so one account can't read another's records. Nobody is perfect: if a breach affects you, we'll tell you and the authorities as required.

Children

DebutPin isn't for children. You need to be at least 16 to have an account.

Changes and contact

If this policy changes, the date at the top changes with it. Questions about any of it: hello@debutpin.com.