Privacy

Short version: we collect what the pilot needs to work and nothing we can’t justify. We don’t sell your data. Creators you apply to see your name and participation state; nobody else does by default.

What we collect

• Your Google account identifier used to sign you in. We never store your Google password.
• Your profile — name, institution, faculty, programme, year, country. Whatever the onboarding wizard asked for.
• Betas you create, participations you join, state transitions on both.
• Reports you file.

What we don’t collect

• IP addresses beyond what Vercel logs for abuse protection. We don’t look at those unless something breaks.
• Social-media profiles. We don’t ask.
• Device fingerprinting.
• Analytics beyond anonymised page-view counts.

Who sees what

• A creator sees the name + participation state of people who apply to their beta. Nothing else.
• Admin sees anything you report, plus audit events when investigating abuse.
• Nobody else sees your participation history by default.

Third parties we use

BETA runs on these services:

• Supabase (Switzerland / Germany) — database, auth, storage.
• Vercel (US / Europe) — hosting + edge functions.
• Resend (US) — transactional email, when we send one.
• Google (US) — our OAuth sign-in provider. We don’t read your Gmail or Drive.

Your rights

• Export your data from your profile page (JSON download, when the endpoint ships — before public launch).
• Delete your account from your profile page.
• Correct any field by editing your profile.

Retention

Account data stays until you delete it. Audit events — the record of state transitions, reports, admin actions — are kept to support investigation if an abuse report comes up later.

Children

BETA is 18+.

Changes to this policy

We’ll notify signed-in users by email when this policy changes.