CrowdSpeaker ("we", "us", "our") operates crowdspeaker.live (the "Service"), a live audio broadcasting platform. This Privacy Policy explains what information we collect, how we use it, who we share it with, how we share it, and the security practices we use to protect it.

1. Information We Collect

We collect the following categories of information:

Account information — when you sign up as a speaker, we collect your email address, password (stored hashed), display name, and authentication identifiers.
Profile and content — display name, session titles and descriptions, scheduled tour details, contact lists you upload, and messages you compose.
Listener information — when someone joins a broadcast, we collect a chosen display name, optional email (for follow-up), questions submitted, and tip amounts. Anonymous listeners are identified by a short-lived join code.
Payment information — when you subscribe, tip, or book a paid tour, payment details (card number, billing address) are collected and processed directly by Stripe, our payment processor. We receive only a payment status and the last 4 digits of the card.
Payout information — speakers who connect a payout account provide identity and bank information directly to Stripe Connect; we do not store this data.
Audio and broadcast data — live audio is streamed through AWS IVS. We retain session metadata (duration, listener counts, tip totals) but do not retain raw audio recordings unless you explicitly enable recording.
Technical data — IP address, browser type, device information, timestamps, and basic analytics about how you use the Service.
Cookies — we use cookies and local storage to keep you signed in, remember preferences, and detect abuse.

2. How We Use Your Information

To provide, maintain, and improve the Service.
To authenticate users and secure accounts.
To process payments, subscriptions, and payouts.
To deliver transactional emails (receipts, session summaries, password resets, tour notifications).
To respond to support requests.
To detect, prevent, and respond to fraud, abuse, or violations of our terms.
To comply with legal obligations.

3. Who We Share Information With

We share information only with the following categories of recipients:

Service providers (sub-processors) who help us run the platform:
- Supabase — database, authentication, file storage.
- AWS (Amazon Web Services) — live audio streaming via Interactive Video Service (IVS).
- Stripe — payment processing, subscription billing, and Connect payouts.
- Resend — transactional and notification email delivery.
- Google AI / OpenAI — content moderation and AI-generated descriptions (no personal identifiers sent).
Other listeners and speakers — your chosen display name, public session content, and questions you submit are visible to other participants in the same session.
Legal and safety — we may disclose information when required by law, subpoena, or to protect the rights, safety, or property of CrowdSpeaker, our users, or the public.
Business transfers — if CrowdSpeaker is acquired or merged, your information may be transferred as part of that transaction.

We do not sell your personal information, and we do not share it with advertising networks.

4. Method of Disclosure

All disclosures to service providers occur over encrypted connections (HTTPS/TLS) using authenticated API calls. Service providers act as processors under contractual obligations to use the data only to deliver their service to us. Disclosures to other users happen inside the Service UI when you choose to publish a session, accept a listener, or send a message. Legal disclosures are made in writing in response to formal requests.

5. Security Practices

We use the following safeguards to protect your information:

Encryption in transit — all traffic between you and the Service uses HTTPS/TLS.
Encryption at rest — databases and file storage are encrypted at rest by our infrastructure providers.
Authentication — passwords are hashed; sessions use signed JWTs with short expirations.
Row-level security — our database enforces per-user access policies so users can only read and write their own data.
Payment isolation — card and bank data is handled directly by Stripe; we never see or store full card numbers.
Least privilege — backend functions run with scoped credentials and role-based access controls.
Monitoring — we log authentication events and suspicious activity, and apply rate limiting to sensitive endpoints.
Regular review — dependencies and security policies are reviewed and updated regularly.

No method of transmission or storage is 100% secure. If we learn of a security incident affecting your information, we will notify you as required by applicable law.

6. Data Retention

We retain account data for as long as your account is active. Session metadata, tips, and payout records are retained for as long as required for tax, accounting, and legal obligations. You may request deletion of your account at any time by emailing hello@crowdspeaker.live.

7. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at hello@crowdspeaker.live.

8. Children

The Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect information from children.

9. International Transfers

Our service providers operate in the United States and other regions. By using the Service you consent to your information being processed in those jurisdictions.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date above reflects the most recent revision. Material changes will be communicated by email or in-app notice.

11. Contact

Questions about this policy or your data? Email hello@crowdspeaker.live.