Privacy Policy

Pufferbase is an anonymous social platform for verified creators on YouTube, Instagram, TikTok, and Twitch. Posts appear under randomly generated, single-use usernames; the underlying author identity is never shown to other users. This Privacy Policy explains what information we collect when you use Pufferbase, how we use it, and the choices you have. By using Pufferbase you agree to the practices described below.

• Account info.When you sign up we collect your email address (handled by our authentication provider — see “Service providers” below). You may also sign in with Google, in which case Google shares your email address with us.
• Creator verifications. When you connect a YouTube, Instagram, TikTok, or Twitch account on the Connect page, the platform shares your OAuth token with Pufferbase. We use it once to read your public follower or subscriber count, then store only the platform name, the count, and the time of verification. We do not retain the OAuth token.
• Post content.Every post, comment, and reply you publish is stored, including the text, the platform tags you choose, and any images you attach. Each post is assigned a random per-post username; the author's underlying account id is stored privately and is not readable by other users.
• Images. Images you attach to posts are resized and re-encoded to PNG client-side, then uploaded to our images bucket. Image URLs are publicly accessible by design (so the post can be viewed).
• Likes. We record which posts you like so the heart on each post reflects your state. Your individual likes are visible only to you; everyone else sees the aggregate like count.

• Local storage and cookies. Our authentication provider sets cookies on your browser so we can keep you signed in between visits. We do not use third-party advertising cookies.
• Logs. Our infrastructure providers record standard request logs (IP address, timestamps, user agent, error traces) to operate, secure, and debug the service.

• To run the service: authenticate you, render the feed, deliver posts and comments, enforce per-platform engagement rules, and persist your likes.
• To keep the service safe: investigate abuse reports, enforce our Terms of Service, and respond to legal requests.
• To communicate with you: account confirmation emails, security notices, and important changes to the service or these policies.
• To improve the product: analyze aggregated usage to fix bugs and decide what to build next. We do not sell personal data to advertisers.

Pufferbase is anonymous-by-default. Each post you publish gets a random username; other users do not see your real account, your email, or any link between posts you've made over time. Other users do see the verified platforms attached to each post and the snapshot of your follower or subscriber count at the time of posting. Treat any content you post on Pufferbase as public.

We use Supabase to host our database, authenticate users, store uploaded images, and serve the public feed. Supabase processes data on our behalf under their own data protection terms. The service runs on Google Cloud Run; standard request and error logs are kept by Google for security and debugging. We do not share your data with advertising networks.

• Account data is kept until you delete your account.
• Creator verifications are kept until you disconnect them; disconnected verifications are removed immediately.
• Posts, comments, replies, and attached images are kept indefinitely so that thread history remains available. Deleting a post deletes its content and replies.
• Likes are kept until the post is deleted or you unlike it.
• Server logs are retained for a limited window by our infrastructure providers for security and debugging.

• You can refresh or disconnect any verified platform at any time from the Connect page.
• You can sign out from any browser session via the Sign out button in the navigation bar.
• You can delete your own posts from the post page. Comments and replies under a deleted post are removed along with the post.
• You can request deletion of your account and associated personal data by emailing us (see “Contact” below). Public posts may be retained in an anonymized form for moderation history.
• If you are in a region that gives you specific data rights (e.g., the EEA, UK, or California), you can exercise those rights by contacting us.

Pufferbase is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has signed up, please contact us and we will remove the account.

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last updated” date at the top of this page and, where appropriate, notify you in the product or by email. Continuing to use Pufferbase after a change means you accept the updated policy.

Questions about this policy or about your data can be sent to cheng@muselab.dev.