Privacy Policy

This policy explains what personal data Journey Shares (“we”) collects through Journey Shares, why, and the choices and rights you have. We are the data controller. Contact us at privacy@journeyshares.app.

What we collect

• Account data: your username, a securely hashed password (we never see or store the password itself), and your email only if you choose to add one.
• Activity: your play-money balances and ledger history, trades, options, price alerts and price-point orders, comments and vouches, reports you make, your watchlist, listings you create, and any claim or delisting requests and the verification codes and results linked to them.
• Notifications: the notifications we send you, your notification settings, and, if you turn on phone notifications, the push subscription your browser gives us (an address at your browser's push service plus encryption keys; it contains no contact details).
• Security data: records of sign-in attempts (the username or email tried, whether it succeeded, and when) to stop password guessing.
• Technical data: our hosting provider processes your IP address, browser type and request logs to deliver and protect the Service.
• Data about people listed: the name of a public figure, links to their public accounts and websites, and short descriptions from public sources such as Wikipedia and Wikidata. Listings are limited to public figures.
• Privacy requests: the email, name and details you give us when you make a request.

Why we use it, and our legal bases

• To run your account and the game, and to keep an accurate ledger: performance of our contract with you.
• To keep the Service safe, prevent abuse and manipulation, moderate content and fix problems: our legitimate interests.
• To send password reset emails if you add an email: performance of contract, and you can remove your email any time.
• To show public-figure listings based on public information: our legitimate interests, balanced against the person's rights. Anyone listed can object or ask for removal at any time.
• To respond to legal requests and keep records we're required to: legal obligation.

We don't sell or share your personal data for advertising, and we don't use it for automated decisions with legal or similarly significant effects.

What's public

Your username, comments and vouches are public. Your username and approximate play-money net worth appear on the leaderboard and in the activity feed unless you turn that off in Account → Privacy. Your email is never shown to other users.

Cookies

We use only strictly necessary cookies: one to keep you signed in and security cookies that protect forms. We don't use advertising or analytics cookies, so there's no cookie banner.

Who processes data for us

• Vercel (hosting), Neon (database), Cloudflare (DNS and email forwarding), and Resend (password reset email, only if you add an email). They process data only on our instructions.
• If you turn on phone notifications, messages are delivered through your browser maker's push service (for Chrome, Google). Notification content is encrypted end to end between us and your device.
• When a listing is checked, the Service requests public pages from Wikipedia, Wikidata and the linked sites; we don't send them your account data.

These providers may process data in the United States and other countries. Where required, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

• Account data: until you delete your account.
• Ledger and trade records: kept for the life of the Service because every balance and price depends on them. When you delete your account they're detached from your identity and kept only under an anonymous id.
• Sign-in attempts: 30 days. Password reset links: one hour. Privacy requests: up to 3 years, as a record of how we handled them.
• Notifications and push subscriptions: until you delete them, turn notifications off, or delete your account.

Your rights

Depending on where you live (including under the EU and UK GDPR and California law), you can: access your data and get a portable copy; correct it; delete it; restrict or object to how we use it; and complain to your local data protection authority. We won't treat you differently for using these rights.

• Download your data or delete your account yourself under Account → Your data.
• Anything else, or if you don't have an account (for example, if you're listed): use the privacy request form or email privacy@journeyshares.app.

We reply within 30 days. We may ask you to confirm your identity before acting on a request.

Security

Passwords are hashed with bcrypt, sessions are signed, connections are encrypted, sign-in attempts are rate limited, and access to admin tools is restricted. No system is perfectly secure; if we learn of a breach affecting your data we'll notify you and the authorities as the law requires.

Children

The Service is only for people 18 and older. We don't knowingly collect data from anyone younger, and we remove listings of minors.

Changes

If we change this policy in a significant way, we'll ask you to review it in the app and update the date above.

Questions: privacy@journeyshares.app · All legal pages