PRIVACY
Privacy by design.
This MVP stores only the data required to run accounts, purchases, ownership and public profiles. Final production privacy wording should be reviewed before launch.
Account data
Email addresses and password hashes are stored for account access. Passwords are hashed rather than stored as readable text.
Public profile data
Display names, biographies, profile images and links are public only after moderation approval.
Payments
When Stripe is enabled, payment card details are handled by Stripe-hosted checkout rather than stored by this application.
Data requests
Before launch, add a documented process for access, correction and deletion requests and confirm the appropriate UK GDPR lawful bases and retention periods.