Privacy Policy

Information we collect

We collect only what we need to run the service. That means:

• Account information — your name, email address, and a hashed (never plain-text) password when you register with email/password.
• Google OAuth data — if you sign in with Google, we receive your name, email address, and profile picture from Google.
• Income entries — the income data you log inside the dashboard: dates, amounts, source names, platforms, and your own notes. This data belongs to you.
• Payment records — when you subscribe, we store the NowPayments payment ID, the cryptocurrency used, and your plan status. We do not store private keys, wallet seeds, or full card numbers.
• Usage data — standard web server logs (IP address, browser, pages visited) used for security and performance. We do not build behavioural profiles.

We do not collect data you don't give us. We don't track you across other websites.

How we use it

We use your data to:

• Provide and operate the Creator Money OS service
• Send transactional emails — account verification, password resets, payment confirmations
• Activate and manage your subscription plan
• Respond to support requests you initiate
• Detect and prevent fraud or abuse

We do not sell your data, rent your email to third parties, or use your income data for advertising.

Data storage & security

Your data is stored in a PostgreSQL database hosted on Render.com's infrastructure, located in the United States. We use industry-standard measures including:

• HTTPS (TLS) for all data in transit
• Password hashing using Werkzeug's pbkdf2:sha256 algorithm
• Cryptographically random tokens for email verification and password reset links
• Parameterised SQL queries to prevent injection attacks
• Session cookies marked HttpOnly and SameSite=Lax

No security system is perfect. If you discover a security vulnerability please email us immediately at the address in section 8.

Third-party services

We use a small number of third-party services to run the platform:

• Google OAuth — optional sign-in. If you use it, Google's Privacy Policy applies to that authentication step.
• NowPayments — processes crypto subscription payments. Your transaction goes through their platform. See NowPayments Privacy Policy.
• Titan Email / Hostinger — we use Titan (hosted by Hostinger) to send transactional emails. Your email address is passed to their SMTP service for delivery only.
• Render.com — our hosting provider. See Render Privacy Policy.

We do not use advertising networks, tracking pixels, or analytics platforms that share your data with third parties.

Cookies

We use cookies strictly to operate the service — not to track you for advertising.

• Session cookie (session) — keeps you logged in during your browser session. Expires when you close the browser or sign out.
• Remember-me cookie (remember_token) — optional, set when you tick "Remember me" on sign-in. Valid for 14 days.

We do not set third-party cookies or analytics cookies. You can clear all cookies in your browser settings at any time — doing so will sign you out.

Your rights

You have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Correction — update your name or email via your account settings.
• Export — Starter and Growth subscribers can export their income entries as CSV from the dashboard at any time.
• Deletion — request deletion of your account and all associated data. Email us (see section 8) and we'll process it within 30 days.
• Portability — your income data is exportable in CSV format.

If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

Data retention

We keep your data for as long as your account is active. If you delete your account:

• Your profile, income entries, and action board items are deleted immediately from the database.
• Payment records are retained for 7 years to comply with financial record-keeping requirements.
• Server logs are rotated within 90 days.

Contact us

For any privacy-related questions, data requests, or to report a security issue:

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the service after an update constitutes acceptance of the revised policy.