Privacy policy
Last updated: November 1, 2026
Controller
Attila Varga, Varga-Tech, Leipziger Str. 3, 37085 Göttingen, Germany. vargatech@attila-varga.eu.
What we process
When you register, we store your username, creator display name, email, securely hashed password, public profile details, avatar, wallet address and creator updates. We use a secure session cookie necessary for account login and CSRF protection. We do not use advertising or tracking cookies in this application.
Tip records include the creator's receiving address, requested amount, optional supporter name and message, transaction ID if submitted, and payment state. Supporter information is published only when you explicitly opt in, after the blockchain payment is verified. Public blockchain transactions and addresses are independently visible on-chain.
Our server and reverse proxy may process and log technical connection data (including IP address, request time and user agent) for availability, abuse prevention and troubleshooting.
Why we process data
We process account information to provide the service (GDPR Art. 6(1)(b)); necessary operational and security logs to maintain a secure service (Art. 6(1)(f)); and optionally published supporter messages based on your voluntary choice (Art. 6(1)(a)).
Following and photo updates
When signed in, you may follow creators. FanBoost stores the follower and creator account IDs and the follow date. Public profiles display follower counts, not a list of individual followers. Photo updates and public posts are accessible without login; please do not upload sensitive content. Uploaded files are stored on the FanBoost server and served to visitors.
Recipients and third-party services
Public transaction data may be checked via VargaMesh's HTTPS blockchain API at vargamesh.com, or via a locally operated full node. FanBoost does not ask for wallet private keys. Creator-provided website links are third-party services subject to their own policies.
Retention and rights
Sessions expire after 30 days. Profile, post and tip records remain while an account is active and as reasonably required for service integrity, disputes and legal obligations; no automatic deletion schedule has been configured for all records. You may request access, correction, deletion, restriction, export or withdrawal of optional public display consent by contacting the controller. Withdrawal does not erase public blockchain data. You can also lodge a complaint with the relevant data-protection authority.
Data protection contact
This policy describes the implemented MVP data flow. Have it reviewed for your exact hosting, log retention and operational practices before broad public launch.