Privacy Policy

What we collect

• Profile details you enter: handle, display name, bio, links, and an optional private contact email (never shown publicly).
• Your read-only provider credential, stored encrypted (AES-256-GCM) so the page can refresh and so you can prove ownership when editing.
• Aggregate revenue metrics, product and plan names, and (for charts) per-day totals derived from provider data. Customer identifiers, where used, are hashed and customer records and raw provider responses are not stored.
• Optional follower counts you enter, and a GitHub follower count fetched from GitHub's public API if you link GitHub.
• Rate limiting: a keyed hash of your IP address, held temporarily in Upstash Redis. The raw IP is not stored.
• Page-view analytics from Vercel Web Analytics in production (see Cookie Policy).

How we use it

To render your public page, badges and embeds, keep figures fresh, prevent abuse, and operate the service. We do not sell data or use it for advertising.

Who processes it

• Vercel (hosting, analytics), Neon (Postgres database), Upstash (rate limiting) and your payment provider (whose API we call with your key).

Public by design

Anything shown on your page, badge or embed is visible to anyone and may be cached or copied by third parties.

Retention and your rights

Data is kept while your page exists. You may request access, correction or deletion (including the stored credential) via the contact in the project repository. Revoking the key at your provider stops all further reads immediately. Depending on where you live you may have additional rights under laws such as the GDPR or CCPA; contact us to exercise them.

Security

Credentials are encrypted at rest and used server-side only. No system is perfectly secure; use read-only keys and rotate them if in doubt.