Only what the Cent needs.
This notice explains the personal data used to run, secure and measure OneCentForMyFriend.
Controller and contact
OneCentForMyFriend
Email: contact@onecentformyfriend.com. Complete provider details appear in the Imprint.
Data we process
Anonymous account and session identifiers; names, messages, language and visibility choices; optional friend images submitted for moderation; friend journey and wall activity; order, checkout and payment-status identifiers; IP-derived security logs and device/browser data. Brand submissions also include company name, URL and logo file. Full card data stays with Stripe.
Friend images and moderation
Friend images are optional. New uploads are stored in a private Supabase Storage bucket and marked as pending. Pending or rejected images are not displayed on the public Wall. Only approved images may be made temporarily readable through signed file links for display. The uploader must confirm that they have the necessary rights and permission. Images may be rejected or removed to protect safety, privacy, legal rights and service integrity.
Purposes and legal bases
Data is used to provide requested pages and placements, perform contracts, moderate optional images, prevent abuse and fraud, meet legal duties, respond to requests and understand aggregate site use. Depending on the activity, the legal basis is contract performance, legal obligation, legitimate interests in security and service improvement, or consent where required.
Public pages and share links
Public wall entries and approved images attached to them may be visible to everyone. Friend and claim links are capability links: anyone with the link may be able to open their content even if the page is excluded from public discovery. Never submit secrets or private addresses.
Service providers
Netlify and ChatGPT Sites may deliver the website; Supabase provides authentication, database, functions and file storage; Stripe processes payments; Cloudflare Turnstile helps prevent bots; Plausible may provide cookieless aggregate analytics when enabled. These providers process data under their own safeguards and locations, including lawful transfer mechanisms where required.
Cookies and analytics
The core app uses technical browser storage needed for an anonymous session and checkout recovery. Plausible is configured without advertising profiles or cross-site tracking and is enabled only after its production domain is configured. Stripe and Turnstile may set strictly necessary data when their features are used.
Retention
Content remains while needed to provide the requested journey or placement. Order and accounting records are retained for statutory periods. Pending, rejected or abandoned image uploads may be deleted when no longer required for review, dispute handling or security. Security logs are deleted or anonymized when no longer needed. Backups expire on their normal rotation.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria, or your local authority. Identity or control of the relevant capability link/order may need to be verified.
No sale of personal data
Personal data is not sold. It is not used to build advertising profiles.