Privacy Policy

Last updated: September 6, 2026

1. What we collect

Account info you give us directly: name, email address, and a hashed password (we never store your password in plain text). If you link one, your VRChat display name. The images and captions you upload. Basic technical data like IP address, used for abuse prevention (rate limiting) and security logs — not for advertising or tracking. Billing is handled by Stripe; we don't store your card details ourselves.

2. How we use it

To run the Service: create and authenticate your account, process your subscription, display your disc content as intended, moderate uploaded content, send you account and billing notifications, and prevent abuse of the platform. We don't sell your personal information.

3. Who we share it with

We use a small number of service providers to operate Floor Disc, each only for what they need to do their job: Stripe (payment processing), Vercel Blob (image storage), a database host (account and subscription data), and an email provider (account verification emails). We don't share your data with anyone else except where required by law.

4. Data retention

We keep your account data for as long as your account is active. If you cancel your subscription, your disc's content isn't deleted — it's just not displayed in-world, so it's ready if you resubscribe.

Note for whoever finalizes this policy: the admin panel currently has a configurable “data retention (days)” setting, but as of this writing nothing in the code actually enforces it — no automatic deletion runs on that schedule. Don't publish a specific retention/deletion promise here until that enforcement is actually built, or the policy will describe behavior the app doesn't have.

5. Your rights

You can update your name and VRChat username at any time from your account page. To request a copy of your data, or to request deletion of your account and associated data, contact [fill in a real support email].

6. Cookies

We use a single session cookie to keep you logged in. It's required for the Service to function and isn't used for advertising or cross-site tracking.

7. Children

Floor Disc isn't directed at children and isn't intended for use by anyone under 18.

8. Security

Passwords are hashed (bcrypt) before storage. Sessions use a signed token rather than storing session state that could be tampered with. No method of storage or transmission is perfectly secure, but we take reasonable measures to protect your data.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.

10. Contact

Questions about this policy: send us a message from your account's Messages page. Not a subscriber yet? Create an account first — messaging is how we handle all support and privacy questions, we don't use a public support email address.