Privacy Policy

We collect information in three ways:

• Account information you provide. Email address, password (stored hashed, never in plain text), username, and any profile details you add — display name, bio, tagline, location, tags, external links, and appearance preferences.
• Content you create. Posts and comments (text, images, audio, video) and their visibility setting (public, orbit-only, or private), and who you add to or join in an orbit.
• Payment information. When you subscribe, our payment processor Stripe collects your payment card details directly — we never see or store your full card number. We receive limited information back from Stripe, such as your subscription status and billing email, to manage your membership.

We do not run analytics, advertising trackers, or third-party tracking pixels on the Service, and we don’t collect information from any source other than what’s listed above.

The Service uses one category of cookie: a session cookie, set when you sign in, that keeps you logged in and lets our server confirm who you are on each request. This cookie is strictly necessary to operate the Service — we don’t use cookies for advertising, tracking, or analytics, so there’s nothing beyond this to opt into or out of.

We use your information to:

• Operate your account and display your content to the audience you choose.
• Process membership payments and manage your subscription.
• Communicate with you about your account, such as email confirmations or password resets.
• Maintain the security and integrity of the Service, and enforce our Terms.

We do not use your content or personal information to train AI or machine-learning models, and we do not sell it. This is a commitment we make in The Covenant as well as here.

We don’t sell your personal information. We share it only with the service providers that make The Galaxy work, each acting on our behalf:

• Supabase — hosts our database, authentication, and file storage (images, audio, video you upload). Data is stored on infrastructure in the AWS us-east-2 region (Ohio, USA).
• Stripe — processes membership payments and stores your payment method on our behalf.
• Vercel — hosts and serves the website.

We may also disclose information if required by law, to protect the rights and safety of The Galaxy or our users, or in connection with a merger, acquisition, or sale of assets (with notice to you where required).

Content you post as “public” is visible to anyone, including people without an account, and may be indexed by search engines. Content posted as “orbit-only” is visible to members of that creator’s orbit. Your username, display name, and public profile information are visible to anyone who visits your channel.

We retain your account information and content for as long as your account is active. If you delete a post or your account, we remove it from active systems; residual copies may persist briefly in backups before they age out, or longer where we’re required to retain records for legal or accounting purposes (for example, payment records).

You can access, edit, or delete your profile information and content at any time from within the Service. You can delete individual posts, or contact us to delete your account entirely. Depending on where you live, you may also have rights to request a copy of your data, correct it, or object to certain processing. To exercise any of these, email us at danny@thegalaxy.me and we’ll respond within a reasonable time.

The Service is not directed to, and is not intended for use by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us at danny@thegalaxy.me and we will delete it.

The Galaxy is operated from the United States and our infrastructure is located in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home country.

We rely on our infrastructure providers’ industry-standard security practices — encryption in transit, hashed passwords, and access controls — to protect your information. No system is perfectly secure, and we can’t guarantee absolute security.

We may update this Privacy Policy from time to time. If we make material changes, we’ll update the effective date above and, where appropriate, notify you.

Questions about this policy or your data? Email danny@thegalaxy.me.