Privacy Policy

1. Information We Collect

AllFans collects information you provide directly: email address, wallet address, and event attendance history. We do not collect personal data beyond what is necessary to operate the platform. We never collect credit card numbers, government IDs, or KYC documents — payment and identity verification are delegated to Stripe and Coinbase.

Blockchain transactions associated with your wallet address are public by nature of the networks they occur on (Base, Arc). AllFans does not control or obscure on-chain data.

2. How We Use Your Information

Your information is used to:

• Authenticate your account and manage your session
• Process ticket purchases and event check-ins
• Display your profile, attendance history, and achievements
• Facilitate connections through the Meets system
• Distribute Community Chest funds per governance votes
• Measure product usage with PostHog analytics — only with your consent, and never when your browser signals a Global Privacy Control opt-out
• Power the Luna event-planning agent via third-party inference APIs (Venice, Gemini, OpenRouter, Groq, OpenAI) under service-provider terms — we do not use personal data to train AI models.

3. Analytics, Cookies & Global Privacy Control

We use PostHog (US cloud) as our product-analytics processor under our instructions. Analytics only initializes after you accept in the consent banner. We honor the Global Privacy Control (GPC): if your browser sends the GPC signal, analytics is disabled by default and stays disabled — this is our universal opt-out mechanism, recognized across the state privacy laws now in force.

We do not sell personal information and do not share it for cross-context behavioral advertising. We use no third-party advertising cookies or tracking pixels.

4. Your Privacy Rights

Depending on your state (Texas, California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, New Hampshire, New Jersey, Oregon, Utah, Virginia), you have the right to know/access your personal data, port it (machine-readable export), correct inaccuracies, and delete it — including information collected about you (usage history, derived analytics), subject to on-chain and legal exceptions. You may also appeal any denial.

How to exercise a rights request

1. Sign in to AllFans (your authenticated session is how we verify your identity).
2. Submit a request at Settings → Privacy → Privacy rights request (or by email from your account address to privacy@allfans.live). An online webform is required under CA SB 923 (eff. 2027-01-01) — the in-product flow satisfies it.
3. We respond within 45 days. Know/portability requests include a downloadable JSON export of your data.
4. If we deny a request, we state the basis and you can appeal in-product; appeal responses also come within 45 days. After a final denial you may contact your state Attorney General.

Account deletion is also available instantly at Settings → Delete Account. On-chain data (transactions, event attendance attestations) cannot be deleted from the blockchain.

5. Data Storage & Security

Account data is stored in a Neon PostgreSQL database with encryption at rest. Authentication tokens are stored as httpOnly cookies where supported. Blockchain private keys are never stored on AllFans servers.

6. Contact

For privacy-related inquiries and rights requests: privacy@allfans.live