PRIVACY POLICY

Andy Durge (sole operator, natural person), Heemskerk, Netherlands, is the data controller for personal data processed via BladeFeed. Privacy contact: support@bladefeed.app.

Account data: email, username, hashed password, optional full name, bio, avatar. Content data: posts (videos, photos, captions, hashtags), comments, likes, follows, bookmarks, crew memberships, trick log entries, XP events. Technical data: IP address (logged on signup/login for fraud prevention), device ID (rotates per device), user-agent, app version, push notification token. We do NOT collect: precise location, contacts, or browsing history outside BladeFeed. BladeFeed itself does not build advertising profiles. Note: public web pages (skate spot & city guide pages) show Google AdSense advertisements — Google may process your IP address and set advertising cookies there (see section 4 and the Cookies page).

• Performance of contract — to provide the BladeFeed service you signed up for (account, feed, uploads). • Legitimate interest — fraud prevention (IP/device logging), copyright protection (AudD scanning), security. • Consent — push notifications, marketing broadcast emails (you can withdraw at any time via Notifications settings or the Unsubscribe link in any marketing email), and advertising cookies set by Google AdSense on public web pages (managed via your browser/consent choices). • Legal obligation — responding to lawful requests from authorities, copyright takedowns under EU DSA / DMCA.

We rely on the following sub-processors. They process data on our behalf under data processing agreements. We never sell your data to data brokers. One advertising partner applies: Google AdSense serves ads on public bladefeed.app web pages only — Google acts as an independent controller for those ad cookies. We do not pass your BladeFeed account data (email, username, posts) to Google or any other advertiser. • Google AdSense — Serves a limited number of advertisements on public bladefeed.app web pages (skate spot and city guide pages) — never inside the app or logged-in feed. Data: IP address, browser user-agent and (where permitted) advertising cookies set by Google on public web pages. Region: Global (EU + US). • Cloudflare (R2 + CDN) — Stores and delivers uploaded videos, photos, thumbnails and avatars. Data: Media files you upload, derived thumbnails. Region: Global (EU + US). • Resend — Sends transactional and marketing emails (verification, password reset, broadcasts). Data: Email address, username (in body). Region: EU. • AudD — Detects copyrighted music in uploaded videos via audio fingerprinting. Data: Short audio sample of each uploaded video. Region: EU. • Printify — Fulfills merch orders placed in-app. Data: Shipping address, email, order details (only when you place an order). Region: US. • Expo Push (FCM/APNs) — Delivers push notifications to your device. Data: Anonymous push token, notification payload. Region: US (Google), US (Apple).

Some processors are based outside the EEA (e.g. Printify in the US, Apple/Google for push delivery). Where data is transferred outside the EEA, we rely on EU Standard Contractual Clauses (SCCs) or equivalent safeguards under GDPR Chapter V.

Your email is shared with a rights holder ONLY if you submit a takedown request — they'll receive your name and email so they can contact you about resolution. We never share your email otherwise.

By default, your username, full name, bio, avatar, public clips, and follower/following counts are visible to all logged-in users. You can hide your trick log via the Public/Private toggle. Crew membership for private crews is only visible to crew members.

On the web, we use a single httpOnly auth cookie plus non-sensitive UI preferences. The mobile app stores your auth token in secure device storage (Expo SecureStore on iOS/Android). BladeFeed itself sets no tracking or analytics cookies. On public web pages (spot & city guides), Google AdSense may set advertising cookies to serve and measure ads. See Settings → Cookies & Tracking for the full table.

We keep your account data while your account is active. Posts marked as 'removed' (via takedown or moderation) are kept in our database but hidden from feeds for audit purposes. Audit logs (admin actions, copyright detections) are retained up to 2 years. After account deletion, backups are purged within 30 days.

Under GDPR (EU users) and equivalent laws (UK GDPR, California CCPA, etc.) you have the right to: • Access — see what we hold (Settings → Download my data) • Rectification — correct inaccurate data (edit profile) • Erasure — delete your account (Settings → Delete Account) • Restriction — temporarily limit processing (email us) • Portability — receive your data as JSON (Settings → Download my data) • Objection — object to processing based on legitimate interest (email us) • Withdraw consent — at any time, e.g. via Unsubscribe links or notifications toggles To exercise any right, email support@bladefeed.app. We respond within 30 days.

If you believe your data has been mishandled, you have the right to lodge a complaint with a supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). Other EU users: see edpb.europa.eu/about-edpb/board/members_en.

Delete your account directly in-app via Settings → Delete Account. This triggers a 7-day grace period during which you can cancel; after that, your profile, posts, comments, likes, follows, crew memberships, trick log, bookmarks, and notifications are permanently removed. Backups are purged within 30 days. Some logs (audit, copyright detection) may be retained longer for legal reasons.

BladeFeed is not directed at children under 13. If we learn an account belongs to a child under 13, we will delete it. EU users under the local digital-consent age (16 in NL) need verifiable parental consent.

For the Google Play Data Safety form, the following categories apply: • Personal info: Email address, Name (optional), User IDs — collected & shared with sub-processors only. • App activity: In-app actions (posts, likes, comments) — collected, not shared with third parties. • App info & performance: Crash logs, Diagnostics — collected, not shared. • Photos & videos: User-generated content — collected & stored on Cloudflare (R2 + CDN). • Audio: Snippets sent to AudD ONLY for copyright fingerprinting (not retained by us). • Device or other IDs: Device ID, Push token — collected for fraud prevention & notifications. Data is encrypted in transit (TLS) and at rest. You can request deletion in-app.

We may update this policy. Material changes will be announced in-app at least 14 days in advance. Questions, complaints, or data requests: support@bladefeed.app.