Privacy

We collect as little as the service allows.

What we hold

For creators: email address, handle, page content, payout address, sessions and sign in methods. For supporters: an optional name, an optional email for the receipt, and the note you write. For everyone: a hashed IP address, country and short user agent string, kept for security and abuse handling.

Why we hold it

To run the service you asked for (contract), to keep it safe from fraud and abuse (legitimate interest), and, for the receipt email, because you asked us to send it (consent).

How long

Sessions end after 30 days without a visit, or 90 days at most. Sign in links 15 minutes. Audit records 12 months. Hashed IP addresses 90 days. Payment records 7 years, because accounting rules require it.

The public record

Settlement details sit on a public network. PollyPay cannot erase them, edit them or make them private. Account addresses are pseudonymous personal data and we do not publish supporter addresses on any page.

Who processes data for us

Cloudflare (hosting, storage), Resend (email delivery), Privy (the email based payout and card accounts), Coinbase (card payments and bank transfers, with their own identity checks), our Solana network providers, and our sanctions list source. We do not sell data and we do not run advertising.

Cookies

Only what the service needs: a sign in cookie, a short lived challenge cookie, a supporter cookie that unlocks posts you paid for, and the Cloudflare challenge widget. No analytics cookies, so no banner.

Your rights

Access, correction, export, deletion, objection. Write to security@pollypay.uk and we answer within one month. Deleting an account removes your profile, email, sessions, sign in methods and media, and replaces your identity on payment rows with a tombstone.

Children

PollyPay is not for people under 18. We delete accounts we find.

Questions: hello@pollypay.uk. Abuse and impersonation: abuse@pollypay.uk. Security: security@pollypay.uk.