Privacy Policy

You may browse many Lorepage features without creating an account. When you choose to sign in or use account-linked features, Lorepage may collect or receive the following information:

• Your email address, display name, profile image, and authentication-provider account identifier.
• Authentication and session information required to create and maintain your Lorepage account.
• Preferences, creator settings, favorites, or other information you intentionally save to Lorepage.
• Standard usage and diagnostic information such as pages visited, browser or device information, performance data, and errors.
• Information you voluntarily provide when contacting Lorepage for support or a privacy request.

If you select Sign in with Google, Lorepage uses Google OAuth to authenticate your Lorepage account. The Google user data Lorepage may receive for sign-in is limited to basic identity information:

• Your Google account email address.
• Your name or Google display name.
• Your Google profile picture, when available.
• A Google account/provider identifier used to associate the sign-in with your Lorepage account.

When you choose Google sign-in, Lorepage also requests read-only YouTube access so the same authorization can privately verify and link a channel to your account. You can also choose Connect YouTube in Profile to verify a different channel. This uses the Google OAuth scope https://www.googleapis.com/auth/youtube.readonly. This read-only permission is used to identify and verify the YouTube channel associated with the Google/YouTube identity you authorize. Automatically linked channels are hidden from public view until you enable their visibility in Profile.

During YouTube verification, Lorepage may receive and save channel information such as the YouTube channel ID, channel title, handle or custom URL, channel description, and channel avatar. Lorepage does not use this permission to upload, edit, delete, rate, comment on, or otherwise manage YouTube content.

Lorepage does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, payment information, documents, messages, or other unrelated Google services. Lorepage does not receive or store your Google password.

Google user data is used only to provide the user-facing Lorepage features you request:

• Create or identify your Lorepage account when you sign in with Google.
• Authenticate you and maintain your signed-in Lorepage session.
• Display your name and profile image in account-related interface elements.
• Verify which YouTube channel belongs to the Google/YouTube identity you explicitly authorize.
• Present verified YouTube channels so you can choose which one represents you on Lorepage.
• Unlock the YouTube profile badge and, when you enable public visibility, link visitors to the selected channel.
• Prevent unauthorized access, fraud, abuse, and other account-security issues.

The temporary Google OAuth access token returned during Google sign-in or Connect YouTube is used to make the read-only verification request to the YouTube Data API. Lorepage does not persist that temporary Google access token or a Google refresh token in its profile database.

Lorepage does not use Google or YouTube user data for targeted or personalized advertising, retargeting, credit or lending decisions, sale to data brokers, information-resale services, or training generalized artificial-intelligence or machine-learning models.

Lorepage also supports OAuth sign-in through Discord and Twitch. If you choose one of these providers, Lorepage may receive basic identity information made available for authentication, such as your email address when provided, display name, avatar, and provider account identifier. Lorepage does not receive or store your Discord or Twitch password.

When a Discord server admin sets up a store feed with the Lorepage bot (/store), Lorepage stores that server's ID, the channel and role they chose, their settings and the admin's Discord user ID, so it can post the store's public Play Hub events there. The bot doesn't read or store the server's messages.

4a. TikTok account linking and creator videos

Connecting TikTok is optional and does not replace your existing Lorepage sign-in. With your authorization, Lorepage uses TikTok Login Kit and its read-only Display API to retrieve your TikTok account identifier, display name, avatar, profile link, and recent public videos (including thumbnails, titles, links, and timestamps).

Lorepage securely stores TikTok access and refresh tokens in protected server-side Supabase tables to maintain the connection and periodically synchronize public videos. These tokens are not exposed to visitors or other Lorepage members. Lorepage does not request permission to publish, edit, or delete content on your TikTok account.

Connected TikTok videos are initially visible only in your private account preview. Approved creators can separately opt in to display their public TikTok videos on the Lorepage Community page. Disabling that option stops public display; disconnecting TikTok removes the stored connection, tokens, and cached video metadata. Videos remain hosted by TikTok, and you can also revoke Lorepage access in TikTok account settings.

Lorepage uses Supabase for authentication and account infrastructure. A Lorepage user record may include your email address, provider identifier, display-name or profile metadata, and authentication metadata necessary to operate your account.

Lorepage uses browser storage and authentication session credentials so that you can remain signed in between page loads. These credentials are used to authenticate your Lorepage session. Google sign-in may also request YouTube read-only access to verify your channel and save its public channel information to your account. The separate Connect YouTube action remains available if you want to verify another channel. Neither flow requests access to unrelated Google APIs.

Lorepage and its service providers may use cookies, browser local storage, or similar technologies to maintain authentication sessions, remember settings, secure the service, improve performance, and understand site usage. Some browser storage is necessary for signed-in features to function.

Lorepage may use Vercel hosting, performance, analytics, and diagnostic services to understand aggregate traffic and identify technical problems. Analytics data is not used to sell Google account information or create advertising profiles from Google sign-in data.

On Events near me, the map opens on your approximate area (city level), which Vercel works out from your connection's IP address. Major events uses the same approximate area to list Set Championships near you. Lorepage uses it only to position the map, suggest a nearby place and pick those nearby events, and does not store it. Use my location shares your precise location only when you choose it; the place you search is remembered only in your browser, so the map reopens there next time.

If you turn on notifications on your profile, your browser gives Lorepage a push address and encryption keys for that device. Lorepage stores them with your account, along with your browser's name, until you turn notifications off there, the browser stops accepting them, or you delete your account. Each notification is encrypted and delivered by your browser's own push service (Google for Chrome and Android, Apple for Safari, Mozilla for Firefox, Microsoft for Edge on Windows), which cannot read its contents. Play Hub event reminders you set, and which kinds of notification you want, are stored with your account.

My calendar stores the stores you follow, the events you add, your reminder settings and when your last weekly summary went out, with your account. Its calendar link contains a random private key so calendar apps can read your calendar without signing in; anyone with the link can see those events, and you can replace it on My calendar at any time.

Lorepage does not sell personal information or Google user data. Lorepage does not transfer Google user data to third parties for advertising, data brokerage, resale, credit-worthiness, lending, or generalized AI or machine-learning training.

Information may be processed by service providers only when necessary to operate Lorepage. Supabase processes authentication and account data and runs the server-side function Lorepage uses to verify YouTube channel identity. Vercel hosts and delivers the website and may process standard request, performance, analytics, and diagnostic information. Polar processes supporter membership payments, as described in the next section. Information may also be disclosed when required by applicable law or when reasonably necessary to protect users, investigate abuse, or protect Lorepage's security and integrity.

Supporter memberships are sold through Polar (Polar Software, Inc.), which is the Merchant of Record for these orders. When you buy a membership, Polar collects and processes your payment details, name, email address, and billing country or address directly under its own privacy policy. Lorepage never receives or stores your full card number.

Lorepage stores the Polar customer, subscription, and order IDs linked to your account, your plan, its status, and its billing dates, so it can show your supporter status and let you manage your membership. When you open your membership settings, Lorepage asks Polar for your payment history and the brand and last four digits of your card to display them; that card information is not saved by Lorepage.

Lorepage's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Lorepage's use of YouTube API Services is limited to the user-facing channel verification and profile features described in this Privacy Policy.

Lorepage uses HTTPS/TLS for data transmitted between your browser and the service and relies on access controls and security features provided by its authentication and hosting infrastructure. Access to account-related systems is limited to what is needed to operate and maintain the service.

No online service can guarantee absolute security, but Lorepage uses reasonable technical and organizational safeguards designed to protect personal and authentication information against unauthorized access, disclosure, alteration, or loss.

Lorepage retains account information only for as long as reasonably necessary to provide your account and account-linked features, maintain service security, comply with applicable legal obligations, and resolve legitimate operational issues. Data may remain in protected backups for a limited period before being overwritten or deleted through normal backup cycles.

You may request deletion of your Lorepage account and associated personal information by emailing support@lorepage.ink. We may ask you to verify that you control the account before completing the request. After verification, Lorepage will delete or de-identify account information that is no longer required for legal, security, fraud-prevention, or other legitimate obligations.

You may separately revoke Lorepage's Google access from your Google Account permissions. You may also disconnect YouTube inside Lorepage; doing so removes the verified YouTube channel records and public YouTube connection stored for your Lorepage account. Revoking Google provider access does not automatically delete the Lorepage account record; send a deletion request if you also want Lorepage-held account information removed. You can disconnect TikTok from your Lorepage profile to remove its stored credentials and synchronized video metadata, or turn off Community sharing without disconnecting.

You may choose not to create an account and continue using Lorepage features that do not require sign-in. You may revoke Lorepage access from your Google, Discord, Twitch, or TikTok account settings at any time, and you may disconnect YouTube or TikTok from your Lorepage profile. To request access to, correction of, or deletion of personal information associated with your Lorepage account, email support@lorepage.ink. We may need to verify your identity before fulfilling a request.

Lorepage is a general-audience fan and creator resource and is not designed to knowingly collect personal information from children where parental consent is legally required. If you believe a child has provided personal information inappropriately, contact support@lorepage.ink so we can review and address it.

Lorepage may update this Privacy Policy as features, authentication providers, infrastructure, or data practices change. If Lorepage's handling of Google user data changes, this policy will be updated to describe those changes. The effective date above identifies the current version.

For privacy questions, data-access requests, correction requests, or deletion requests, contact support@lorepage.ink.