Privacy Policy

What we collect

• Account details: username, email address, password hash, account creation date, verification status, two-factor authentication settings and sign-in/session information.
• Profile details: name, date of birth, city, country, occupation, bio, website, links, photo, banner, profile styling choices and an optional private phone number.
• Deck and post content: deck name, posts, replies, collections, highlights, On This Day entries, captions and uploaded media.
• Media files: images, video and audio uploaded to a deck or profile, stored in remote object storage.
• Technical data: IP address, browser/user-agent, request time, security and error logs, and basic operational usage data.
• Payment data: if you use a paid option, PayPal processes the payment. We receive the transaction result, amount, currency and order identifiers. We do not receive or store your full card number.
• Communications: messages you send to us, including support and privacy requests.

Why we use it

• Create, secure and sign you into your account.
• Publish your deck, profile, posts and media as you request.
• Verify email addresses, enforce the age requirement, provide optional two-factor authentication and prevent abuse.
• Operate storage quotas, backups and account lifecycle rules.
• Process payments and maintain transaction records where applicable.
• Respond to support and privacy requests, and comply with legal obligations.
• Protect the service with rate limits, spam controls, logging and security monitoring.

What is public

Deck pages, posts, replies, public profile fields, public highlights and public collection media can be seen by anyone who can reach the site. Your email address, password, sign-in details, private notes and private On This Day entries are not shown publicly.

Please treat anything published on a public deck as public information. Choose what you share with that in mind.

Cookies and local storage

We use essential cookies and local storage to keep you signed in, remember interface choices and protect forms. If a payment provider or embedded service is used, that provider may set its own cookies or similar technologies. We do not use advertising cookies to build cross-site advertising profiles.

Where data lives

Account and site data are stored on our hosting infrastructure. User-uploaded media is stored in remote object storage (Cloudflare R2) under a deck or profile folder. Email is sent through our mail provider. PayPal handles payment processing.

Our hosting, media storage, email delivery, security and payment providers may process personal information outside Ontario and Canada, including in the United States and the European Union. Where required, we rely on the providers’ contractual safeguards and applicable legal mechanisms. Privacy laws in those locations may differ from those in Ontario.

How long we keep data

• Account and profile data: while your account remains open, then according to our lifecycle and backup schedule.
• Posts, decks and media: until you or the deck owner delete them, or until an account lifecycle action removes them, subject to backups and legal requirements.
• Technical and security logs: only as long as needed to operate and protect the service.
• Payment records: as required for accounting, tax and fraud-prevention purposes.

When an account is archived, sign-in is blocked but content may be retained. When an account is deleted, eligible content and media are removed, except where retention is required by law or still present in backups.

Your choices and rights

You can update most profile and account details from your profile page. You may also ask us to access, correct, export or delete your personal data, or to restrict or object to certain processing, by writing to [email protected].

We may need to verify your identity before acting. If you are in a jurisdiction with additional privacy rights, those rights apply.

Children

Chiplag is intended for people aged 16 and older. We do not knowingly create accounts for children under 16. If you believe a child has provided personal information, contact us and we will review it.

Security

We use HTTPS, access controls, password hashing, verification checks, remote storage and administrative safeguards. No system is perfectly secure. Choose a strong unique password, keep your email account secure, and contact us if you believe your account has been compromised.

Third-party services

We use service providers for hosting, media storage, email delivery, security and payments. They process data on our behalf or as independent controllers under their own terms. Links to other sites are not covered by this policy; review their privacy notices before sharing information there.

Changes to this policy

We may update this policy as the service changes. The effective date at the top will change when we do. Material changes will be announced on the site where practical.