Privacy Policy

We collect the following types of information:

Account information: email address, username, and password hash when you create an account.

Google Sign-In: if you sign in with Google, we receive your name and email address from your Google account. We use your name as your display name and your email to create and identify your account. We do not receive or store your Google password, and we do not store your Google profile picture.

Payment information: transaction details are processed by our payment providers (Gumroad, NOWPayments). We store transaction IDs and point amounts but do not store your card numbers or cryptocurrency wallet addresses.

Usage data: pages visited, content unlocked, and interactions with the platform.

Referral programme: if you arrive through an invitation link, the referral code from that link is stored in your browser (see section 4). If you then create an account, we record which member invited you and the date — this is what the referral reward is calculated from. We never disclose your identity to the member who invited you: they only see how many people have joined and how many points they have earned.

We use your information to:

• Provide and maintain your account and purchased content
• Process payments and manage your points balance
• Communicate important service updates
• Prevent fraud and ensure platform security
• Improve our services based on aggregated usage patterns

Payments are processed by third-party providers:

• Gumroad (gumroad.com) — acts as Merchant of Record for card payments
• NOWPayments (nowpayments.io) — processes cryptocurrency transactions

Each provider has its own privacy policy. We only receive transaction confirmations and order identifiers from these providers.

We use essential cookies to:

• Maintain your login session
• Store your language preference
• Remember your theme selection
• Remember your cookie consent choice
• Remember a referral code from an invitation link for 30 days, and remember that you dismissed the invitation banner

Analytics & advertising (optional, consent required): When you give your consent via the cookie banner, we may use the following third-party services:

• Google Analytics 4 (Google LLC, analytics.google.com) — collects anonymised usage statistics (pages visited, session duration, device type). Consent category: analytics_storage.
• Meta Pixel / Facebook Pixel (Meta Platforms Inc., facebook.com) — tracks conversions from Meta advertising campaigns. Consent categories: ad_storage, ad_personalization.
• Google AdSense (Google LLC, google.com/adsense) — serves display advertisements on non-premium pages. When consent is not granted, ads are shown in non-personalised mode (NPA). Consent categories: ad_storage, ad_user_data.

All of the above are loaded via Google Tag Manager and are subject to Consent Mode v2: tracking is denied by default and activated only after your explicit consent. You can withdraw consent at any time by clearing the site cookies or contacting us.

Error monitoring: We use Sentry (Functional Software Inc., sentry.io) to capture JavaScript errors in production. Sentry does not collect personally identifiable information (sendDefaultPii: false). Error reports may include the URL, browser type, and an anonymised stack trace.

We do not sell your personal data to advertisers.

We retain your data as follows:

• Account data: for the lifetime of your account
• Transaction history: for 7 years (legal/tax requirements)
• Usage logs: for 12 months
• Session data: until logout or expiration
• Referral code in your browser: 30 days from opening the invitation link
• Referral link between accounts: for the lifetime of the account

You may request account deletion at any time.

We implement appropriate technical and organizational measures to protect your data, including:

• HTTPS encryption for all communications
• Hashed passwords (never stored in plaintext)
• JWT-based authentication with expiring tokens
• Row-level database locks for financial transactions

If you are in the European Economic Area, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Portability — receive your data in a structured format
• Objection — object to certain processing activities

To exercise these rights, contact us through the contact page.

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware of such collection, we will delete the data promptly.

Your data may be processed in countries outside your country of residence. We ensure appropriate safeguards are in place for any international data transfers in compliance with applicable data protection laws.

We may update this privacy policy from time to time. We will notify you of significant changes via email or on-site notification. The "Last updated" date at the top reflects the most recent revision.

For privacy-related questions or data requests, please contact us through the contact page or email urbex_albania@proton.me.