Privacy

If you are a creator on the board

We store what your public profile already publishes: handle, display name, avatar, description, follower count, profile link, and a colour taken from your avatar. It is collected from the platform's public API, the same data any visitor to your profile can see. We do not collect anything private, and we do not need your account for anything.

Ask at hey@penlight.moe and your listing is deleted the same day.

If you cheer or send lights

• No accounts. There is nothing to sign up for, so there is no profile, no password and no email list.
• A one-way fingerprint, not an identity. To keep cheering to one per person per creator, we store a SHA-256 hash of your IP address and browser user-agent. The hash cannot be turned back into either. We never store the IP itself.
• Notes you write are public. A note attached to paid lights appears on that creator's page with the amount. Do not put anything private in one.
• Card details never reach us. Payments run through Stripe, who receive your card data directly and hold it under their own privacy policy. We keep only the payment reference, the amount, and which creator it was for.

Counting visits

We run Umami on our own server to count page views. It sets no cookies, builds no profile, follows nobody between sites, and records only what a web server sees anyway: which page, roughly where in the world, and what kind of browser. Nothing is sent to Google or to any advertising network. If you block it, the site works exactly the same.

What we do not do

No advertising, no third-party trackers, no cookies, and no selling or sharing of anything to anyone. The only third parties are Stripe for payments and our hosting and database providers, who process data on our instruction.

How long things are kept

Season records are kept while the board exists, because a frozen season is a permanent record. Cheer hashes are deleted at the end of the season they belong to. Payment records are kept as long as tax and accounting rules require.

Your requests

Ask for a copy of anything connected to you, ask for it to be corrected, or ask for it to be deleted, by writing to hey@penlight.moe. We answer within 30 days. Where the GDPR or similar law applies to you, those rights apply regardless of where we are.