PRIVACY POLICY

• Email address — required to create an account, sent to us by our authentication provider (Clerk) when you sign up.
• Name and profile picture — if you sign in with Google or Apple, we receive your name and profile picture from those providers; we do not store the profile picture on our servers.
• Uploaded photographs — the photos you choose to turn into cards.
• Card details you enter — player name, team name, jersey number, year, position, stats, sport, and any sponsor or school logo you optionally add.
• Profile information — saved athlete profiles you optionally create to speed up future cards.

When you buy a credit pack, we receive confirmation of the transaction from our payment processor (Stripe on the web, Apple In-App Purchase on iOS, Google Play Billing on Android) via RevenueCat. We store: the pack you bought, the credits granted, the amount in cents, the platform's transaction ID, and the date.

We do not see or store your full payment card number, bank account number, or other sensitive payment credentials.Those are handled directly by Stripe, Apple, or Google and never touch BoastIt's servers.

• Generation history — a record of each card you generate, the style you chose, the sport, the AI provider used, the status (success / refunded / error), and the credits consumed. Used for billing accuracy and to refund failed generations.
• Consent logs — when you accept the Terms of Use or confirm photo permissions, we record the version accepted, your IP address, and your user-agent string for legal-audit purposes.
• Basic technical information — browser type, device type, and IP address logged by our hosting provider for security and abuse-prevention purposes.

We do not use third-party advertising trackers, browser fingerprinting, or cross-site analytics tools.

• Your full name (unless you choose to use it in a player profile)
• Your address, phone number, or date of birth
• Social Security numbers, government IDs, or biometric data
• Your contacts, calendar, location, or microphone
• Health information
• Any information from third parties about you

When you tap Generate, we send your photo and your card details to one or more AI providers (currently Anthropic Claude for color analysis and Google Gemini or fal.ai for image generation) to produce your card. These providers process your photo only to fulfill that single request and return the result to us.

We send AI requests under enterprise / API terms with each provider that prohibit them from using submitted images to train their models. Specifically, Anthropic and Google both publish API data-use policies stating that API customer content is not used to train their generally-available models. If a provider materially changes its policy in a way that conflicts with this commitment, we will switch providers.

Email support@boastit.app from the email address on your account and we will delete your account, your uploaded photos, and your generation history. Generated card images stored at AI-provider URLs may take a short time to expire from their caches.

The following companies process information on our behalf:

• Clerk — authentication (email, sign-in events, OAuth tokens)
• Neon — managed PostgreSQL hosting (all account data)
• Vercel — web application hosting and serverless functions
• Stripe — web payment processing
• RevenueCat — mobile in-app purchase reconciliation (when you use the iOS or Android apps)
• Apple — App Store In-App Purchase processing (iOS users only)
• Google — Google Play Billing (Android users only); Google OAuth (if you sign in with Google)
• Anthropic — Claude API for image color analysis
• Google — Gemini API for image generation
• fal.ai — image generation (failover and certain styles)

Each of these processors is contractually required to use your information only to provide their service to us.

We may disclose information if required to comply with a valid subpoena, court order, or other legal process; to enforce our Terms; to protect the rights, property, or safety of BoastIt, our users, or the public; or in connection with a merger, acquisition, or sale of assets (in which case the acquirer would be bound by this Policy until amended with notice to you).

BoastIt does not sell or share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA / CPRA). We have not done so in the past 12 months and have no plans to do so.

BoastIt is used to make sports cards of athletes, many of whom are minors. We require that the BoastIt account be held by a person 18 years or older. When the subject of a photo is a minor, our Terms (Section 3.1) require the uploader to be the parent or legal guardian of that minor, or to have express permission from one.

In compliance with the U.S. Children's Online Privacy Protection Act (“COPPA”), we do not knowingly collect personal information directly from children under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly. Parents or guardians who believe a child under 13 has submitted personal information through the Service may contact us at support@boastit.app.

When a parent or guardian uploads a photo of their minor child, the only data we receive about the minor is the photo itself and any information the parent enters (player name, jersey number, stats). We do not solicit additional information about minors. The photo is processed exclusively to generate the requested card and is subject to the same protections described elsewhere in this Policy — never used for training, never sold, deletable on request.

All BoastIt account data is stored on servers operated by our subprocessors (primarily Neon for database storage and Vercel for application servers), located in the United States. By using the Service, you consent to the transfer of your information to the United States.

• Uploaded photos — processed and then removed shortly after generation completes.
• Generated card images — stored at URLs returned by our AI provider and may expire. Download anything you want to keep.
• Account information (email, credit balance, purchase records) — retained as long as your account is active and for a reasonable period afterward to meet our tax, accounting, and dispute-resolution obligations (generally up to 7 years).
• Consent logs — retained for the life of the account plus 7 years.
• Generation history — retained as long as your account is active.

You may request deletion of your account and associated data at any time by emailing support@boastit.app. We will process verified deletion requests within 30 days, except for records we are required to keep for legal, tax, or accounting purposes, which will be retained in a minimal form.

• Right to know what personal information we have about you.
• Right to access a copy of the personal information we hold.
• Right to correct inaccurate information.
• Right to delete your information (subject to legal retention rules).
• Right to opt out of any future marketing communications.

To exercise any of these rights, email support@boastit.app from the email address on your account. We will verify your identity and respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including:

• The right to know what categories of personal information we collect and the purposes for which we use them (described in Sections 2 and 3 above).
• The right to request a copy of the specific pieces of personal information we hold.
• The right to request deletion (subject to legal retention rules).
• The right to correct inaccurate personal information.
• The right to limit our use of sensitive personal information (we do not collect sensitive personal information as defined under CPRA).
• The right to non-discrimination for exercising your privacy rights.

We do not sell or share personal information for cross-context behavioral advertising, so the right to opt out of such sale or sharing does not apply.

To make a request, email support@boastit.app. You may also designate an authorized agent to make a request on your behalf, subject to identity verification.

If you are located in the EEA, UK, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the rights of access, rectification, erasure, restriction, portability, and objection. Our legal basis for processing your information is the performance of our contract with you (the Terms of Use), your consent (where applicable), and our legitimate interests in operating and securing the Service. You may contact us at support@boastit.app to exercise any of these rights, or lodge a complaint with your local data protection authority.