Privacy Policy

Account information. Your email address, handle, display name, and anything you add to your profile (niche, location, bio, skills, avatar, banner).

Content you create. Projects, scripts, mood boards, shot lists, ideas, project pages, posts, comments, reactions, and uploaded images.

Payment information. If you subscribe, payments are handled by Stripe. We receive limited details such as your subscription status and the last four digits of your card — we never see or store your full card number.

Usage and device data. Basic analytics about how you use the Service (via PostHog) and, for security, the device user-agent and IP address you sign in from.

To provide, maintain, and improve the Service; to authenticate you and secure your account; to process payments; to send you transactional email (such as witness invites, device verification, and ship notifications); to respond to support requests; to understand usage and improve the product; and to comply with legal obligations. Where required, we rely on your consent, the performance of our contract with you, or our legitimate interests as the legal basis for processing.

If you sign in with Google or Apple, we receive your email address, name, and (for Google) a profile photo URL. We do not request, store, or use access to your contacts, calendar, drive, photos, or any other Google or Apple data. We do not share your information with these providers beyond what is required to authenticate you.

Passwords you create are hashed by our authentication provider (Supabase) using bcrypt and never stored in plaintext anywhere on our systems. We check new passwords against a public database of known breaches (Have I Been Pwned) using a privacy-preserving k-anonymity method that never transmits your password. If your password has been in a breach, we ask you to choose another.

When you sign in from a new device, we send a 6-digit code to your email to confirm it's you. Once verified, we remember that device for up to 90 days so you don't have to verify it again. We store the device's user-agent (e.g., 'macOS · Safari') and the IP address it first signed in from, used only to show you the device in your account settings. You can revoke any device at any time. We do not sell or share this information.

We use essential cookies to keep you signed in and to operate the Service. We use PostHog for product analytics to understand how features are used. We do not sell your personal information or use it for third-party advertising. Where required by law, we ask for your consent before non-essential analytics, and we honor browser “Do Not Track” / global privacy control signals.

We share data only with service providers who help us run OBSY, under agreements that protect your information:

• Supabase — authentication and database;
• Vercel — application hosting;
• Stripe — payment processing;
• Resend — transactional email;
• PostHog — product analytics.

We may also disclose information if required by law or to protect the rights, safety, and security of OBSY and its users. We do not sell your personal information.

Content you choose to make public or unlisted — public project pages, your profile, posts on The Floor — is visible to others and may be indexed by search engines or shared. Think before you post; what you make public is public.

We keep your information while your account is active and as needed to provide the Service. When you delete your account, we delete your content from active systems — deleted means deleted — except for content others have already shared, anonymized or aggregated data, and limited copies we must retain by law or that persist briefly in routine backups.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing (for example under the GDPR or CCPA). You can edit your profile and delete your account in settings, and you can request a copy of your data or exercise other rights by emailing team@obsy.me. We will not discriminate against you for exercising these rights.

We use industry-standard measures to protect your information, including encryption in transit, hashed passwords, and device verification. No system is perfectly secure, so we cannot guarantee absolute security — keep your own backups of anything important.

We are based in the United States, and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers of personal data.

OBSY is not directed to children under 18, and we do not knowingly collect their personal information.

We may update this policy from time to time and will note the date above. For any privacy question or request, contact team@obsy.me. See also our Terms of Service.