Privacy Policy

This Privacy Policy explains how Growbase LLC, a California limited liability company doing business as "tingle.fan" ("we," "us," or "Tinglefan"), collects, uses, and shares information about you when you use the tingle.fan service (the "Service").

By using the Service, you agree to this Policy. If you do not agree, do not use the Service.

Account information. When you create an account, we collect your name, email address, and a password (stored as a secure hash, never in plain text).

Profile information (creators). When you set up your creator page, we collect your display name, bio, avatar image, social links, sticker tags, and membership tier definitions.

Content. When you publish content (audio, video, text), we collect and store that content for delivery to fans. Video is stored and streamed via Mux; avatars and other images are stored via Vercel Blob.

Payment information. We do not collect or store full credit card numbers. Payment information is collected and stored by Stripe, our payment processor. We receive limited payment metadata from Stripe (transaction ID, amount, last four digits of card, billing zip, payment status) for record-keeping and reconciliation.

Usage information. We collect information about how you use the Service, including pages viewed, posts viewed, and actions taken (subscribing, posting, requesting custom content, and so on).

Device and connection information. We automatically collect IP address, browser type, operating system, device identifiers, and approximate location (city/region inferred from IP).

Cookies. We use a small number of cookies for authentication and basic operational state. We do not use third-party advertising cookies. See Section 6 for details.

We use information to:

• Operate and maintain the Service.
• Authenticate users and prevent unauthorized access.
• Process payments and pay out earnings to creators.
• Communicate with you about your account, transactions, and the Service.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.
• Improve the Service through aggregate analytics.

We do not use your personal information for advertising. We do not sell your personal information.

We share information with:

• Service providers (sub-processors) that help us operate the Service, listed in Section 5.
• Other users, but only to the extent you choose to make information public (for example, your creator page is public; your subscriber list is not).
• Law enforcement when required by valid legal process, or where we have a good-faith belief that disclosure is necessary to comply with law, protect rights, or address security or fraud issues.
• In a business transfer: if Tinglefan or Growbase LLC is acquired or merges with another company, information may be transferred to the successor entity (subject to this Policy).

We do not sell your personal information. We do not share information with third-party advertisers.

We use the following sub-processors to operate the Service:

These sub-processors process information only as instructed by us and as needed to deliver their service. They are bound by their own privacy policies and data-protection commitments.

We use cookies for:

• Authentication — keeping you logged in.
• CSRF protection — preventing cross-site request forgery.
• Operational state — minimal interface preferences.

We do not use advertising cookies, third-party analytics that cross-track users, or tracking pixels for behavioral advertising. We honor "Do Not Track" browser signals to the extent feasible.

We retain information as follows:

• Account data: retained while your account is active. Deleted within 30 days of account closure, except where we must retain it longer for financial-record or legal reasons (see below).
• Financial records (transaction history, payout records, invoices): retained for 7 years to comply with U.S. tax and accounting requirements.
• Content you publish: retained while your account is active and the content is not deleted by you. Soft-deleted content may be retained in backups for up to 30 days, then permanently deleted.
• Server logs: retained for up to 90 days.

We use industry-standard security measures, including TLS encryption in transit, encrypted storage, access controls, and security monitoring. No system is perfectly secure; we cannot guarantee absolute security but we work to protect your information consistent with reasonable practices for our industry.

If we discover a security incident affecting your information, we will notify you as required by applicable law.

Tinglefan is operated from the United States, and most of our sub-processors are U.S.-based. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

For users in the European Economic Area, United Kingdom, or Switzerland, transfers to the United States rely on Standard Contractual Clauses or comparable safeguards as required.

Depending on where you live, you have rights to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information (subject to retention requirements above).
• Port your information to another service in a structured format.
• Object to certain uses.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, email hello@tingle.fan. We will respond within 30 days. We will verify your identity before fulfilling deletion or access requests.

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we have collected about you.
• Right to delete personal information, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of, but if that ever changes we will provide a clear opt-out.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

To exercise California rights, email hello@tingle.fan with "California Privacy Request" in the subject line.

If you are in the European Economic Area, United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (and equivalent UK GDPR / Swiss FADP):

• All rights listed in Section 10.
• Right to lodge a complaint with your local data-protection authority.
• Right to know our lawful basis for processing.

Our primary lawful bases for processing are: performance of contract (delivering the Service you signed up for), legitimate interests (security, fraud prevention, service improvement), legal obligations (tax records, abuse reports), and consent (specific cases like marketing emails, where applicable).

The Service is for users 18 years and older. We do not knowingly collect personal information from anyone under 18. If you believe a user under 18 has registered, contact hello@tingle.fan and we will delete the account.

We may update this Policy from time to time. The "Effective" date at the top indicates the most recent revision. For material changes, we will notify you by email or in-product notice.

Privacy questions, requests, or complaints should be sent to:

Growbase LLC, dba tingle.fan
hello@tingle.fan