Privacy policy

Who this covers

We are based in Alberta and subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta’s Personal Information Protection Act (PIPA). You must be 18 or older. Fans confirm age at checkout. Creators complete identity verification before payouts.

What we collect

Every table that can hold a person is listed. If it is not here, we do not store it.

• fans — fan id, display name, optional email, age verification stamp, optional wallet address.
• users — email, role, linked fan id, checkout age stamp, Supabase user id. Creator password hash and 2FA secret where applicable.
• auth_challenges — hashed one-time return tokens (email, expiry).
• creators — creator id, display name, public handle. Payout wallets and KYC status live separately.
• payment_intents — fan id, bounty, option, amount, rail, processor name, status. No card numbers are stored.
• uploads — quarantine metadata only. Files sit in a private directory that is not served.
• safety_events — event type, internal ids, hashed IP, provider name, decision. Not file bytes.

Age verification

Fans confirm they are 18 or older at checkout. We do not collect a government ID or a selfie from fans.

Creator identity

Creators complete identity verification with Didit before payouts. We receive a pass/fail, a timestamp, and a session reference — not the document.

Where funds are held

Contributions are held in escrow by our payment processor. We do not hold contributor funds in our own bank accounts.

Discretion

Charges appear on your statement as BOUNTIED. Creators see a display name and backing amount — not your email or legal identity.

Third parties

• Supabase — authentication and database.
• PostHog — product analytics without email addresses or verification references.
• Didit — creator identity verification before payouts.
• Cloudflare Turnstile — optional bot checks when configured.
• Project Arachnid Shield — CSAM hash matching before any hosted file is stored.
• Payment processor — card transactions and escrow. We never see your full card number.

What we do not do

• We do not sell personal information
• We do not use it for cross-context behavioural advertising
• We do not serve hosted media to the public
• We do not share your identity with creators

Your rights

Under PIPEDA and Alberta’s PIPA you may request access, correction, and withdrawal of consent. Contact hello@bountied.xyz.

Children

Bountied is strictly for adults. We do not knowingly collect information from anyone under 18.