Draft — pending legal review. The list of what this deployment stores is accurate as of 2026-09-24; the obligations section is a framework and does not yet bind anyone.
privy-token cookie that this site reads to know who you are (src/lib/privy.ts).src/lib/email.ts).NEXT_PUBLIC_POSTHOG_KEY is configured. When it is on, it records named events only: autocapture, session recording, heatmaps, surveys and feature-flag requests are all disabled in the initialiser (src/lib/analytics.ts). Vercel Speed Insights reports page-performance measurements.[To be completed by counsel: the controller's legal identity and address, and the contact for privacy requests.]
[To be completed by counsel: the lawful basis for each category above, and a retention period per category — including the transaction records that tax and anti-money-laundering rules require to outlive an account deletion.]
[To be completed by counsel: access, correction, deletion, portability and objection, the jurisdiction each applies in, and the response time promised.]
[To be completed by counsel: the processors named above, where their data is processed, and the transfer mechanism relied on.]
[To be completed by counsel. The session cookie above is the one the code sets today; a consent flow is the follow-up if analytics or recording is ever switched on.]