Privacy Policy

1. What We Collect

When you create an account, we collect your email address and the display name you choose. When you make a purchase or set up as a seller, Stripe collects your payment or payout details directly. GetForged never sees or stores your full card number or bank account details. We also collect standard usage data (pages visited, browser type, approximate location derived from IP) to understand how the Platform is used and to improve it.

2. How We Store Your Data

User accounts and product data are stored in a managed Postgres database (Neon). Sign-in is handled by Auth.js, which supports Google, GitHub, one-time email links, and email-and-password login; if you use a password, it is never stored in plain text, only a bcrypt hash is kept. We retain your account data for as long as your account is active, plus a reasonable period after deletion for legal and fraud-prevention purposes.

3. Third-Party Services

• Stripe processes all payments. Stripe's own privacy policy governs the data you share with them at checkout.
• Resend handles transactional email (order confirmations, magic-link sign-in, notifications). We share only your email address and the minimum data needed to send the relevant email.
• Neon hosts the Postgres database that stores account and product data.
• Google and GitHub: if you choose to sign in with one of these, they confirm your identity to us; we receive only your name, email address and profile image from them.
• Vercel hosts the application and the file storage used for seller-uploaded screenshots. Vercel may log request metadata for security and performance purposes.

We do not sell your data to any third party, ever. We do not use your data for advertising targeting on other platforms.

4. Cookies & Tracking

We use essential session cookies required for authentication. We do not use advertising cookies or third-party tracking pixels. Basic analytics (page views, referrers) may be collected in aggregate form; this data is not linked to individual identities.

5. Your Rights (GDPR)

If you are located in the UK or EU, you have the right to access, correct, or delete your personal data. You may also request a portable copy of your data or object to certain processing. To exercise any of these rights, email getforged@getbrian.xyz with “Data Request” in the subject line. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (in the UK: the ICO at ico.org.uk).

6. Data Retention & Deletion

You may request deletion of your account at any time by emailing getforged@getbrian.xyz. We will delete or anonymise your personal data within 30 days, except where retention is required by law (e.g., financial records for tax purposes, which may be kept for up to 7 years).

7. Changes to This Policy

We may update this policy as our services evolve. Material changes will be communicated by email or prominent notice on the Platform. Continued use after the effective date constitutes acceptance of the revised policy.

Privacy questions? Email getforged@getbrian.xyz