Privacy Policy.

Summary, in plain English

Creators Tycoon ("we", "us") runs the Creators Tycoon affiliate program and this app. To run it we need your account details, the stats for your link, and — before we can pay you — payout and tax information. Payout details are encrypted, tax forms are stored privately, and we never sell your data or use it for advertising. The creator directory your link sends fans to is a separate website with its own privacy policy.

1. Information we collect

a. Your account

• Name, display name, email address, and password. Passwords are stored and checked by our authentication provider (Supabase Auth) as salted hashes; we never see them in readable form.
• Who referred you (if anyone), your affiliate code, and your account status.

When you sign up you confirm that you are 18 or older; we check that confirmation but do not keep a separate record of it.

b. Payout details

The payout method you choose and its details (for example account holder, bank name, routing and account number, or a payment-service email or IBAN). These are encrypted at rest (AES-256-GCM); the app only ever shows a masked version back to you. We also keep a one-way fingerprint of the account identifier to detect the same payout account being used by several affiliates.

c. Tax forms and electronic signatures

Before paying you we may need a Form W-9 (U.S. persons) or W-8BEN (non-U.S. individuals). You can upload one or complete our substitute form in the app, which collects what the IRS form asks for: name, business name and tax classification, address, taxpayer identification number (SSN/EIN or foreign TIN), citizenship, and date of birth (W-8BEN). Your typed name is your electronic signature; we record the date and time, your account email, and the IP address you signed from, and include them in the signed PDF. Tax forms are stored in private storage that only our team can access.

d. What you do in the app

Community chat messages and reactions, support tickets and replies, playbook progress, notification history, and your settings (such as appearing anonymously on the leaderboard).

e. Your link's performance

Visits, clicks, subscriptions, and revenue attributed to your affiliate code, and the commissions and referral bonuses calculated from them. These are aggregate figures about fans, not information about you beyond your earnings.

f. Referral link visits

When someone opens a referral link (/join?ref=CODE), we record the time, their IP address, a salted hash of it, the country reported by our CDN, their browser's user-agent string, and the referring page, so we can credit the referring affiliate and avoid double-counting refreshes.

g. Push notifications

If you turn on notifications, your browser gives us a push subscription (an endpoint address and keys from your browser's push service), which we store with your browser's user-agent string so you can tell devices apart. We use it only to send you notifications and delete it when you turn them off.

h. Cookies and local storage

• ct_session keeps you logged in: a signed, HttpOnly, Secure, SameSite=Lax cookie for this site only, valid for up to 30 days. Logging out clears it.
• While you sign up through a referral link, the referral code is kept in your browser's session storage so it survives a page reload. It is cleared when the tab closes.

We set no advertising or third-party tracking cookies.

i. Analytics and logs

We use Vercel Web Analytics and Speed Insights, which collect aggregate, cookie-less data about page views and performance. Our hosting provider keeps standard request logs, and we use your IP address briefly in memory to rate-limit sign-ups, logins, and other abuse-prone actions.

2. How we use information

• To run your account and show your stats and earnings.
• To attribute fans and revenue to your link, calculate commissions and referral bonuses, and pay you.
• To meet tax and accounting obligations (for example, issuing or filing information returns).
• To detect and prevent fraud, fake traffic, duplicate accounts, and abuse.
• To contact you: email verification, password resets, support replies, in-app notifications, and push notifications you turned on.
• To keep the app secure, reliable, and working well.

We do not sell or rent your information and do not use it to build advertising profiles.

3. Legal bases for processing (GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with similar law, we rely on:

• Contract: to provide the program you signed up for and pay you under the affiliate terms.
• Legal obligation: tax forms, payment records, and responses to lawful requests.
• Legitimate interests: fraud prevention, security, referral attribution, and improving the app.
• Consent: push notifications, which you can turn off at any time.

4. Who sees your information

Other affiliates see your display name in community chat. The leaderboard ranks the top affiliates by revenue and shows each one's revenue and subscriber counts; if you appear anonymously you are shown as "Affiliate" plus the last four characters of your code instead of your name, but your figures still appear. The affiliate who referred you sees your display name, join date, and the revenue that earns them a referral bonus. Affiliates two and three levels above you see your join date and that revenue, but not your name.

Service providers process data on our instructions only:

• Supabase: database, authentication, and private file storage.
• Vercel: hosting, request logs, and the analytics described above.
• Resend: delivery of account emails.
• Browser push services (such as Apple, Google, or Mozilla): delivery of push notifications you turned on.
• Our link-tracking provider: runs the creators' tracking links your fans pass through. We tag each click with your affiliate code, an internal affiliate ID, and a click ID so it can report subscriptions and revenue back to us. It never receives your name or contact details.
• Banks and payment services you choose for payouts receive what they need to pay you.

We also disclose information when required by law (for example to tax authorities or under a valid court order) or when necessary to investigate fraud, abuse, or threats to safety.

5. Data retention

• Account, activity, and performance data: for as long as your account exists, and afterwards as long as needed to settle commissions, prevent fraud, and keep accounting records.
• Payout details, tax forms, and signature records: as long as tax and accounting law requires, even after your account closes.
• Referral visit records: as long as needed for attribution, analytics, and fraud prevention.
• Push subscriptions: until you turn notifications off or the push service reports them expired.
• Session cookie: up to 30 days, or until you log out.

6. Data security

We use HTTPS everywhere, encrypt payout details at rest, keep tax forms in private storage, sign session cookies, and restrict server-side access to the people and systems that need it. No system is perfectly secure, so please use a strong, unique password.

7. International transfers

Our infrastructure is hosted in the United States (Supabase region us-east-2; Vercel region iad1). If you use the app from outside the U.S., your information is processed in the U.S. We rely on appropriate safeguards (such as Standard Contractual Clauses with our processors) where applicable.

8. Your choices and rights

• Access and correction: you can see and edit most of your information in Profile and Settings.
• Deletion: ask us to close your account and delete your data; we will delete what we are not required to keep (see Section 5).
• Notifications: turn push notifications off in Settings or in your browser at any time.
• Global Privacy Control: we honor GPC signals; since we do not sell data or run cross-site tracking, the practical effect is unchanged.

Depending on where you live (for example California, the EEA, or the UK) you may have further rights, including to know, correct, delete, or port your data, to object to or restrict processing, and not to be discriminated against for using them. Use the contact details in Section 11 to exercise any of them.

9. Age requirement

The program is for adults only. We do not knowingly collect information from anyone under 18 (or the age of legal adulthood where you live, if higher). If you believe a minor has signed up, contact us and we will close the account.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the current version, and we will tell you inside the app about material changes before they take effect.

11. Contact

Affiliates can open a support ticket in Settings inside the app. For privacy requests or legal notices:

Creators Tycoon
Email: legal@creatorstycoon.com