Privacy Policy
Effective August 21, 2026
1. What we collect
Account: the email from your Google or email sign-in, and the Sui wallet address derived from it. Account security: when you sign in, we record a coarse label for that sign-in (browser and operating system type, like "Chrome on Windows") and sign-in times, shown to you on your account page so you can recognize your own sign-ins and unlink any you don't - we never store the full browser fingerprint, and no location is attached to sign-ins. Donations: amount, chosen side, optional display name, and the on-chain transaction digest. Eligibility: to enforce our supported-jurisdiction rule, your approximate location (country and state, derived from your IP) is checked at the network edge when you visit; it gates access but is not attached to or stored with your donations. Operations: standard server logs and security telemetry. We do not currently run identity verification (KYC); if we add it, this policy will be updated before that control goes live.
2. What is public
Donation amounts and transaction digests are public on the Sui blockchain by design; that transparency is how anyone can verify a Fight. Your legal name is never published. Display names appear only where you opt in, and any donation can be made anonymously.
3. What we never do
We do not sell personal data. We do not store or display precise locations. We do not send push notifications without explicit opt-in. We do not use donation history for advertising, and we set no cross-site or advertising cookies.
4. Processors
We share only what each service needs to do its job: Supabase (our application database for off-chain records), Mysten Labs Enoki (sign-in and gasless-transaction infrastructure), Transak (third-party card-to-USDC on-ramp, used only if you pay by card), Cloudflare Turnstile (bot and abuse protection on sign-in and forms), Upstash (rate limiting and abuse prevention), Resend (transactional email delivery), and Vercel (application hosting and server logs). We do not use any advertising or product-analytics processors.
5. Cookies and local storage
We use a small number of first-party cookies and no advertising or cross-site trackers. "fff_session" is an essential, HttpOnly cookie that keeps you signed in (SameSite=Lax), and "fff-consent" remembers your privacy choices. "fff-ref" is set for 7 days when you arrive through a supporter's share link so the referrer gets credit; it holds only a short referral code, no identity. Cloudflare Turnstile may set its own cookie for bot protection on pages with sign-in or forms. Your browser also keeps small preferences in local storage on your device (for example, your recent donations for one-tap re-donate and the display name you choose); these never leave your device and are not identity data. A full, itemized list, with controls to turn optional storage on or off, is on our Cookie Notice at /legal/cookies (also reachable from "Your Privacy Choices" in the footer).
6. Retention and deletion
Off-chain personal data is retained while your account is active and for any period required by financial-compliance law, then deleted. On-chain records (donation amounts, wallet addresses, and transaction digests) are permanent and outside any party's control; this is disclosed before your first donation. Deleting your off-chain data does not and cannot remove those public on-chain records.
7. Your rights and how to reach us
You can request access to your off-chain data, a copy of it, correction, or deletion, and exercise California privacy rights where applicable. Email support@fightforfunds.com, submit a deletion request from your account page, or use "Your Privacy Choices" in the footer to opt out of optional data uses. We act on verified requests within the time the law allows.
8. US state privacy rights
If you live in a US state with a consumer privacy law (for example California, under the CCPA/CPRA), the following disclosures apply. Categories of personal information we collect: identifiers (your sign-in email, the wallet address derived from it, and your IP address); device information (a coarse browser and operating system label recorded per sign-in, shown to you on your account page for account security); approximate location derived from your IP (country and state only, checked at the network edge and not stored with your donations); donation records (amount, chosen side, optional display name, transaction digest); and internet activity (server logs and security telemetry). Sources: you directly, your device and browser, and the public blockchain. Purposes: operating the service, processing and displaying donations, enforcing our eligibility and per-wallet rules, security and fraud prevention, transactional email, and legal compliance. We do not collect sensitive personal information as those laws define it: no precise geolocation, no government identifiers, no biometric or health data. We do not sell personal information and we do not share it for cross-context behavioral advertising; because we do neither, there is no sale or sharing to opt out of, but we still honor opt-out preference signals: "Your Privacy Choices" in the footer controls optional storage, and we treat a Global Privacy Control signal from your browser as an opt-out automatically, turning off analytics and third-party embeds for you. We disclose personal information only to the service providers in section 4, under contracts limiting their use to providing services to us. Retention follows section 6. Your rights: to know and access the personal information we hold, to receive a portable copy, to correct it, to delete it, and not to be discriminated against for exercising any of these rights. These rights apply to the off-chain data we hold; public blockchain records cannot be corrected or deleted by anyone, including us (section 6). To exercise them, email support@fightforfunds.com or use your account page; we verify requests by confirming control of the signed-in account or its email address, an authorized agent may submit a request on your behalf with proof of authorization, and if we decline a request you may appeal by replying to our decision and we will respond as your state's law requires.
9. Automated systems and AI
We want you to know exactly where automation touches this platform. Chat moderation is automated: messages are filtered at ingestion by rule-based word lists and patterns (not by an AI model profiling you), and user reports feed a human review queue. Our jurisdiction check is a rules-based comparison of your approximate location against the supported-region list. Those two checks act automatically: a message can be filtered, and a visit from outside the supported region can be blocked, without a person in the loop. Weightier decisions, like closing an account, freezing a Fight, or rejecting a fundraiser, are never made solely by automated means; a human is responsible for those. We do not operate an AI chatbot: messages to support are read and answered by people, and nothing on this site presents AI-generated conversation as human. The live donation feed shows only real, confirmed donations; activity is never simulated or AI-generated. We do use AI tools to help build the platform's software and to prepare drafts of documents, including these policies; all code is human-reviewed and tested before release, and legal documents are reviewed by counsel before they take effect.