Privacy Policy

SimplyNickish ("we", "us", "our") operates the website simplynickish.com and associated sub-domains. The data controller for your personal information is Nick Fraser, trading as SimplyNickish.

If you have any questions about this policy or how we handle your data, contact us at simplynickish@gmail.com.

We collect the following categories of personal data:

Account data: when you create an account, we collect your email address, display name, and OAuth profile data (name, avatar) from providers you choose to connect (Google, Discord, Twitch, X/Twitter). We do not store your OAuth passwords.

Subscription & billing data: if you subscribe, payment is processed by Stripe. We receive your subscription status and plan tier. We do not store your full card details.

Usage data: our hosting provider (Vercel) generates standard connection logs (IP address, browser type, timestamps) as part of running the site. We do not run any separate analytics or tracking system, and we record IP addresses ourselves only in narrow cases: when you redeem an early access code, or when you apply as a marketplace seller, to prevent abuse.

Communications: if you contact us or join our waitlist, we store your email and the content of your message.

Early access codes: if you redeem an access code, we record that redemption against your account to prevent re-use.

• To provide, operate, and improve the SimplyNickish platform and its apps
• To authenticate you and manage your account and subscription
• To process payments and fulfil your subscription plan
• To send transactional emails (account confirmation, subscription receipts, password resets)
• To send you platform updates and launch announcements, if you opted in
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising.

We process your personal data on the following legal bases under the UK GDPR and GDPR:

• Contract: to provide services you have requested (account creation, subscription)
• Legitimate interests: for security and fraud prevention
• Consent: for marketing emails, which you may withdraw at any time
• Legal obligation: where required by applicable law

We share your data only with trusted third-party service providers required to operate the platform:

• Supabase: authentication and database hosting (EU/US infrastructure)
• Stripe: payment processing (PCI-DSS compliant)
• Vercel: hosting and edge delivery
• Resend: transactional email delivery (account confirmation, receipts, password resets)
• Google, Discord, Twitch, X/Twitter: OAuth providers you connect
• Google Fonts: loads the fonts used on this site. Your browser contacts Google's servers directly to fetch them, which shares your IP address with Google, for every visitor, regardless of whether you sign in
• YouTube (Google): used to embed videos on some pages. Playing a video shares your IP address with Google

Each provider processes data under their own privacy policies and data processing agreements. We do not share your data with advertisers, data brokers, or any other parties.

We use cookies and similar technologies to operate the site. See our Cookie Policy for full details.

Essential cookies (authentication sessions, CSRF protection) are required for the site to function. Preference cookies are optional. You can manage them via your browser settings.

We retain your account data for as long as your account is active.

When you delete your account, you can choose between two options. By default, your account is deactivated immediately and your personal data is held for 30 days before permanent erasure, so an accidental or unauthorised deletion request can be undone by simply logging back in during that window. You can also choose to skip this window and have your data permanently erased right away instead.

Some things happen immediately either way, regardless of the option you choose: connected third-party accounts are disconnected, marketing communications stop, and any content you had made public (such as adoption stories) is taken down.

Purchase, order, and payment records are kept longer where we are required to retain them for legal compliance (e.g. tax and accounting records, retained for 7 years), with the personal details on those records removed at the time of deletion.

Standard connection logs generated by our hosting provider are retained according to their own infrastructure policies, not a fixed period we set ourselves.

You have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your data ("right to be forgotten")
• Portability: receive your data in a machine-readable format
• Restriction: request we limit how we process your data
• Objection: object to processing based on legitimate interests
• Withdraw consent: for marketing emails, unsubscribe at any time

To exercise any of these rights, email simplynickish@gmail.com. We will respond within 30 days.

If you are located in the European Union or the United Kingdom, you have additional rights under the GDPR and UK GDPR respectively. The above rights section applies in full. You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk.

Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses or adequacy decisions to ensure it remains protected.

For any privacy-related enquiries, data subject requests, or complaints, contact:

Nick Fraser, SimplyNickish
simplynickish@gmail.com

We aim to respond to all requests within 30 days.