PRIVACY POLICY

Andy Durge (sole operator, natural person), Heemskerk, Netherlands, is the data controller for personal data processed via BladeFeed. Privacy contact: support@bladefeed.app.

Account data: email, username, hashed password, optional full name, bio, avatar. Content data: posts (videos, photos, captions, hashtags), comments, likes, follows, bookmarks, crew memberships, trick log entries, XP events. Technical data: IP address (logged on signup/login for fraud prevention), device ID (rotates per device), user-agent, app version, push notification token. We do NOT collect: precise location, contacts, advertising identifiers, browsing history outside the app, or behavioral data for ad targeting.

• Performance of contract — to provide the BladeFeed service you signed up for (account, feed, uploads). • Legitimate interest — fraud prevention (IP/device logging), copyright protection (AudD scanning), security. • Consent — push notifications, marketing broadcast emails (you can withdraw at any time via Notifications settings or the Unsubscribe link in any marketing email). • Legal obligation — responding to lawful requests from authorities, copyright takedowns under EU DSA / DMCA.

We rely on the following sub-processors. They process data on our behalf under data processing agreements. We never share your data with advertisers, data brokers, or social-media platforms beyond the share-link previews you explicitly create. • Cloudinary — Hosts uploaded videos, photos, thumbnails and avatars. Data: Media files you upload, derived thumbnails. Region: EU + US. • Resend — Sends transactional and marketing emails (verification, password reset, broadcasts). Data: Email address, username (in body). Region: EU. • AudD — Detects copyrighted music in uploaded videos via audio fingerprinting. Data: Short audio sample of each uploaded video. Region: EU. • Printify — Fulfills merch orders placed in-app. Data: Shipping address, email, order details (only when you place an order). Region: US. • Expo Push (FCM/APNs) — Delivers push notifications to your device. Data: Anonymous push token, notification payload. Region: US (Google), US (Apple).

Some processors are based outside the EEA (e.g. Printify in the US, Apple/Google for push delivery). Where data is transferred outside the EEA, we rely on EU Standard Contractual Clauses (SCCs) or equivalent safeguards under GDPR Chapter V.

Your email is shared with a rights holder ONLY if you submit a takedown request — they'll receive your name and email so they can contact you about resolution. We never share your email otherwise.

By default, your username, full name, bio, avatar, public clips, and follower/following counts are visible to all logged-in users. You can hide your trick log via the Public/Private toggle. Crew membership for private crews is only visible to crew members.

On the web, we use a single httpOnly auth cookie. The mobile app stores your auth token in secure device storage (Expo SecureStore on iOS/Android). We don't use third-party tracking cookies, ad cookies, or analytics SDKs. See Settings → Cookies & Tracking for the full table.

We keep your account data while your account is active. Posts marked as 'removed' (via takedown or moderation) are kept in our database but hidden from feeds for audit purposes. Audit logs (admin actions, copyright detections) are retained up to 2 years. After account deletion, backups are purged within 30 days.

Under GDPR (EU users) and equivalent laws (UK GDPR, California CCPA, etc.) you have the right to: • Access — see what we hold (Settings → Download my data) • Rectification — correct inaccurate data (edit profile) • Erasure — delete your account (Settings → Delete Account) • Restriction — temporarily limit processing (email us) • Portability — receive your data as JSON (Settings → Download my data) • Objection — object to processing based on legitimate interest (email us) • Withdraw consent — at any time, e.g. via Unsubscribe links or notifications toggles To exercise any right, email support@bladefeed.app. We respond within 30 days.

If you believe your data has been mishandled, you have the right to lodge a complaint with a supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). Other EU users: see edpb.europa.eu/about-edpb/board/members_en.

Delete your account directly in-app via Settings → Delete Account. This triggers a 7-day grace period during which you can cancel; after that, your profile, posts, comments, likes, follows, crew memberships, trick log, bookmarks, and notifications are permanently removed. Backups are purged within 30 days. Some logs (audit, copyright detection) may be retained longer for legal reasons.

BladeFeed is not directed at children under 13. If we learn an account belongs to a child under 13, we will delete it. EU users under the local digital-consent age (16 in NL) need verifiable parental consent.

For the Google Play Data Safety form, the following categories apply: • Personal info: Email address, Name (optional), User IDs — collected & shared with sub-processors only. • App activity: In-app actions (posts, likes, comments) — collected, not shared with third parties. • App info & performance: Crash logs, Diagnostics — collected, not shared. • Photos & videos: User-generated content — collected & stored on Cloudinary. • Audio: Snippets sent to AudD ONLY for copyright fingerprinting (not retained by us). • Device or other IDs: Device ID, Push token — collected for fraud prevention & notifications. Data is encrypted in transit (TLS) and at rest. You can request deletion in-app.

We may update this policy. Material changes will be announced in-app at least 14 days in advance. Questions, complaints, or data requests: support@bladefeed.app.