Legal
Privacy Policy
Last updated: September 23, 2026
Ceri Cross (operated by Ceri Cross) (“we,” “us”) explains here how we collect, use, store, and protect personal information when you use this website and related services.
Information we collect
- Account information — email address and authentication identifiers when you register or sign in (processed by Clerk)
- Profile & activity — purchases, subscriptions, unlocks, wishlist/donation contributions, and direct messages you send
- Payment information — transaction IDs, amounts, and subscription status from Stripe (we do not store full payment card numbers)
- Technical data — device/browser type, approximate location derived from IP, timestamps, and security logs
- Local storage — age-gate confirmation and theme preference stored in your browser
- Analytics — aggregated usage metrics via Vercel Analytics (no advertising profiles sold from this site)
How we use information
We use data to operate the platform, authenticate users, deliver purchased Content, process payments, prevent fraud and abuse, respond to support requests, comply with law, and improve security and performance. We do not sell your personal information.
Legal bases (where applicable)
For users in regions with privacy laws (such as the UK/EEA), we rely on contract performance (providing the service you request), legitimate interests (security, anti-piracy, analytics), legal obligation, and consent where required (for example marketing, if ever offered).
Service providers
We share data only as needed with subprocessors that help run the site:
- Clerk — authentication and account management
- Stripe — payment processing and subscriptions
- Neon — database hosting
- Vercel — hosting, CDN, private media storage, and analytics
These providers process data under contractual terms appropriate to their role. Links to their policies are available on their websites.
Retention
We keep personal data only as long as needed for the purposes above. Account data is retained while your account is active. Transaction records may be kept longer for tax, accounting, chargeback defense, and legal compliance. Security logs are retained for a limited period unless needed for an investigation.
Security
We use HTTPS, access controls, and provider security features. No method of transmission or storage is 100% secure; you use the service at your own risk and should protect your login credentials.
Your rights & deletion
You may request access, correction, deletion, or export of your personal data where applicable law provides those rights. See our dedicated Data Protection & Account Deletion page for step-by-step instructions. We will verify requests and respond within applicable timelines (typically within 30 days).
Children
The service is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided data, contact us to request deletion.
International transfers
Data may be processed in the United States and other countries where our providers operate. We use appropriate safeguards where required by law for cross-border transfers.
Changes
We may update this policy; the “Last updated” date will change. Material changes may be highlighted on the site.