Privacy Policy

1. Information We Collect

When you create an account on clstr, we collect information from your Google account through our OAuth authentication process. This includes your name, email address, Google profile identifier, and profile photo URL. You may also provide additional profile information such as a username, display name, bio, and a custom avatar image.

When you use the service, we collect the content you upload, including photos, videos, and associated metadata such as file type, file size, and image dimensions. We also collect usage data through standard server logs, including pages you visit, features you interact with, and the clstrs you create or join. Our servers and infrastructure providers automatically collect device and browser information such as your user agent string and IP address. We use a limited number of cookies, which are described in detail in the Cookies section below.

2. How We Use Your Information

We use the information we collect to provide and operate the clstr service, including authenticating you through Google OAuth, creating and maintaining your account, and displaying your profile and content on your personalized subdomain. We process your media files through image transformations and video transcoding to optimize them for display across devices. We may also use your information to send transactional communications related to your account, to monitor and improve the service, and to enforce our Terms of Service.

3. How We Store and Protect Your Information

Your user data, including profile information and clstr metadata, is stored in Supabase, a PostgreSQL-based database service with row-level security policies that restrict data access. Your media files are stored on Cloudflare R2, an object storage service where files are encrypted at rest. Video files are temporarily processed on Fly.io servers during transcoding and are deleted from those servers once processing is complete. All data transmitted between your browser and our servers is encrypted using HTTPS and TLS. While we implement industry-standard security practices to protect your information, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

4. Third-Party Services

We rely on a number of third-party services to operate clstr, and each may receive certain data as part of providing their services. Google provides OAuth authentication and receives your Google account information during the sign-in process. Supabase hosts our database and stores your profile information and clstr metadata. Cloudflare provides our content delivery network, object storage through R2, and image transformation services, and processes your media files and IP address. Fly.io provides video processing infrastructure and temporarily receives your video files during transcoding. Vercel hosts our application and processes server logs and IP addresses. Sentry provides error monitoring and receives anonymized error data but no personal content. Each of these services operates under its own privacy policy, and we encourage you to review them.

5. Data Sharing

We do not sell your personal information to anyone. We do not share your data with advertisers or advertising networks. Profiles and clstrs that you have made public are visible to anyone who has the URL. We may disclose your information if required to do so by law, or if we believe in good faith that such action is necessary to comply with legal obligations, protect our rights or safety, or investigate potential violations of our Terms of Service.

6. Your Rights

You have the right to access your data, which is visible to you through your profile and the content you have uploaded. You can delete individual media items or entire clstrs at any time through the service. You can also delete your account entirely, which will result in the permanent removal of all your data and media from our systems.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect about you, the right to request deletion of your personal information, and the right to opt out of the sale of your personal information. As noted above, we do not sell personal information.

If you are a resident of the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to access your personal data, the right to rectification of inaccurate data, the right to erasure, the right to data portability, and the right to object to processing. To exercise any of these rights, please contact us at info@clstr.life.

7. Children’s Privacy

clstr is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that a user is under the age of 13, we will promptly delete their account and all associated data. If you believe that a child under 13 has created an account on clstr, please contact us at info@clstr.life so that we can take appropriate action.

8. Data Retention

Your account data and uploaded content are retained for as long as your account remains active. When you delete individual content items, they are permanently removed from our storage systems. Server logs are retained for up to 90 days for operational and security purposes. When you delete your account, all associated data, including your profile information, clstr metadata, and media files, is permanently removed from our systems.

9. Cookies

clstr uses a small number of cookies that are essential to the operation of the service. Authentication cookies are set by Supabase to maintain your login session and are required for the service to function. A username cookie is used for subdomain routing to direct you to the correct profile page. A beta access cookie is used temporarily during our beta period to manage access to the service. A view identifier cookie is used to prevent duplicate counting of page views. This cookie contains a randomly generated identifier and is not linked to your personal identity. It is retained for up to one year. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the “Last updated” date at the top of this page. Your continued use of clstr after any modifications constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

11. Contact

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at info@clstr.life.