Privacy Policy
[YOUR_LEGAL_ENTITY] ([YOUR_POSTAL_ADDRESS]) is the controller of the personal data described here. Questions and data requests: [PRIVACY_EMAIL].
What we store, and why
| Data | Why | Kept for |
|---|---|---|
| Email, username, password hash (bcrypt) | Your account and sign-in | Until you delete the account |
| Profile name, bio, avatar, interests | Your public profile and feed personalisation | Until you delete the account |
| Posts, boards, comments, likes, follows | The service itself | Until you delete them or the account |
| Outbound clicks: destination, device type, coarse country, referrer, hashed IP | Click stats for the creator whose link was clicked | 90 days, then deleted |
| Reports you file or receive | Moderation and abuse handling | 2 years after the case is closed |
We never store your raw IP address
Click records hold a one-way HMAC-SHA256 hash of the IP, not the address itself. It lets us count one click per person per day without being able to recover who that person was. This is pseudonymisation, not full anonymisation — so we treat it as personal data and delete it on the schedule above.
Cookies
Avahit sets four cookies, all strictly necessary for signing in. There is no analytics, advertising or tracking cookie, which is why you do not see a consent banner.
authjs.session-token— keeps you signed in.authjs.csrf-token— blocks cross-site request forgery on sign-in forms.authjs.callback-url— returns you to the page you came from after signing in.__Secure-variants of the above on HTTPS.
Fonts are served from our own server, so no request goes to Google Fonts. If you sign in with Google, Google sets its own cookies on its own domain under its own policy.
Who else sees your data
We do not sell personal data. It is processed on our own servers. Two things leave our infrastructure:
- When you tap a product link, the destination store sees a normal web visit from you, including your IP and any affiliate tracking that store uses. That store’s privacy policy applies from that point.
- When someone posts a product URL, our server fetches that page once to read its title, price and image.
Your rights
Under the GDPR you may access, correct, export, restrict or delete your data, and object to processing. Two of these are self-service and immediate:
- Export— Settings → Download my data returns a JSON file with your profile, posts, boards, comments and likes.
- Delete— Settings → Delete account erases your account and content. It cannot be undone.
For anything else write to [PRIVACY_EMAIL]; we answer within 30 days. You also have the right to complain to the data protection authority in [YOUR_JURISDICTION].
Legal basis
Running your account and showing your posts is performance of a contract. Click statistics, moderation and abuse prevention rest on our legitimate interest in making the service work and keeping it safe; you may object to these at [PRIVACY_EMAIL].
Children
Avahit is not for people under 16. If you believe a child has an account, write to [CONTACT_EMAIL] and we will remove it.