This Privacy Policy explains how Kitschy (“Kitschy,” “we,” “us,” or “our”) collects, uses, and protects information when you use the Kitschy application at app.kitschy.io — where creators build a public “kit” page, share the tools and products they use, and view analytics about how their page performs. Kitschy is operated by an individual (a sole proprietor) based in Texas, United States.
This policy covers the Kitschy app. Our separate marketing site at kitschy.io has its own privacy policy governing the pre-launch landing page and email sign-up.
Information we collect
Account information
When you create an account, we collect your email address and a password. Passwords are hashed and managed by our authentication provider — we never see or store your password in plain text. You may also choose to add profile information: a display name, username, bio, avatar image, and links to your social media accounts. With the exception of your email address, this profile information is displayed publicly on your kit page.
Content you create
We store the content you add to build your kit — the links you save (product and tool URLs, titles, and descriptions), preview images, and any images or videos you upload. This content is published on your public kit page.
Kit-page and click analytics
When someone visits a public kit page or clicks one of its links, we record limited information so we can show creators how their page is performing. For each click we store:
- A one-way hashed fingerprint of the visitor’s IP address (SHA-256 combined with a secret salt). We never store the raw IP address, and the hash cannot be reversed back into one. It exists only to distinguish unique visits from repeat ones.
- The visitor’s browser user-agent string.
- The referring page, if the browser provides one.
- The destination URL that was clicked, and the time of the click.
We use this data solely to provide analytics to creators. We do not build advertising profiles, and we do not track visitors across other websites.
Cookies
We use strictly necessary cookies to keep you signed in (session cookies set by our authentication provider). We do not use advertising or third-party tracking cookies.
Abuse prevention
To protect the service against abuse, we temporarily process IP addresses for rate limiting on sign-up, login, and link-click endpoints. These are held transiently by our rate-limiting provider and are not stored in our database.
How we use your information
- To provide and operate the service — your account, your kit page, and link redirects.
- To show you analytics about how your kit page and links are performing.
- To protect the service through rate limiting, abuse and fraud prevention, and security monitoring.
- To send you service-related messages (for example, about security or your account) and, only if you opt in, product updates.
- To comply with legal obligations and enforce our Terms of Service.
Legal bases for processing (GDPR)
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:
- Contract — to provide the account and kit-page service you sign up for.
- Legitimate interests — to give creators analytics about their own pages and to keep the service secure. We minimize the impact on visitors by only ever storing an irreversible hash of their IP address, never the address itself.
- Consent — where required, such as for optional marketing emails. You may withdraw consent at any time.
- Legal obligation — where processing is required to comply with the law.
How we share information
We do not sell your personal information, and we do not share it with third parties for their own marketing. We rely on a small number of service providers who process data on our behalf:
- Supabase — provides our database, authentication, and file storage. It stores your account, your content, and your analytics. Supabase Privacy Policy.
- Vercel — hosts the application and delivers it over its content network. Vercel Privacy Policy.
- Upstash — provides the Redis service used for transient rate limiting. Upstash Privacy Policy.
We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.
Your content is public
Your kit page — including your username, display name, bio, avatar, social links, saved links, and uploaded media — is publicly visible on the internet and may be indexed by search engines. Please do not put anything you consider private on your kit page.
Data retention
We keep your account information and content for as long as your account is active. Click analytics are retained while your account is active so your historical analytics remain available. When you delete your account, your personal data is deleted and your click history is anonymized — its association with you and your links is removed — rather than kept tied to your identity. Because click records only ever contain an irreversible hash of a visitor’s IP address, they hold no directly identifying information.
Your rights
Depending on where you live, you may have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Deletion — ask us to delete your data.
- Portability — receive your data in a machine-readable format.
- Objection or restriction — object to or restrict certain processing.
- Withdraw consent — where we rely on consent, withdraw it at any time.
You can delete your account at any time from your account settings, which permanently removes your data as described above. To exercise any other right, email us at hello@kitschy.io. We will respond within 30 days.
California residents (CCPA/CPRA): you have the rights to know, delete, and correct your personal information, and to not be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law.
EEA and UK residents (GDPR): in addition to the rights above, you have the right to lodge a complaint with your local data protection authority.
International data transfers
Our service providers may process and store data in the United States and other countries. Where required, appropriate safeguards are applied to protect your data when it is transferred internationally.
Security
We take security seriously. Protections include row-level security on every database table, hashed passwords, irreversible hashing of visitor IP addresses, encryption in transit, and a strict content security policy. No method of transmission or storage is ever completely secure, but we work to protect your information using industry-standard measures.
Children’s privacy
Kitschy is not directed to, and is not available to, anyone under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we will delete it promptly.
Changes to this policy
We may update this policy as Kitschy evolves. When we do, we will update the “last updated” date above and, for material changes, provide a more prominent notice. Continued use of the service after changes take effect constitutes acceptance of the updated policy.
Contact
Questions, concerns, or requests about this policy or your data? Reach us at hello@kitschy.io.