Legal

Privacy Policy

Effective October 8, 2026

1. What we collect

Account data - email address, display name, password-less authentication identifiers, and (if you sign in with Google or Apple) the basic profile fields those providers share with us.

Profile data you provide - name, location, bio, headline, profession, company, social handles, links, profile photo, and similar fields you choose to fill in. You control whether to provide these and can remove them at any time from your settings.

Private profile data - birthday and email-marketing preferences are stored separately and visible only to you and our admins; other members cannot see them.

Payment data - card details are collected and stored by Stripe, Inc., our payment processor. We never see or store full card numbers; we receive only a customer ID, the last four digits, and the subscription status from Stripe.

Usage data - pages you visit, features you use, approximate location derived from your IP, browser and device metadata, and event timestamps. We use this to operate and improve the Service.

Referrals - if you arrive through someone’s affiliate link and agree to credit them, we record who referred you. That person sees your display name, the date you joined and whether you are a paying member. They never see your email address or the amount you pay. If you join the affiliate program yourself, your payouts are sent through Stripe, and Stripe (not CreateIRL) collects and holds your identity and tax details.

Content you create - posts, comments, messages, RSVPs, and reactions you submit through the Service.

2. How we use it

To provide the Service (accounts, content, events, messages, billing); to communicate with you about your membership; to improve and secure the Service; to enforce our Terms of Service; and to comply with legal obligations.

3. Sub-processors we share data with

We use a small set of trusted vendors to run the Service. We share only what each needs to do its job, and each is contractually required to protect your data.

Supabase - primary database and authentication. Hosted in the United States.
Vercel - web hosting, serverless compute, and request logging.
Stripe - payment processing, billing, and subscription management.
Upstash - rate-limiting and ephemeral cache.
Google - calendar and video-meeting links for member events; OAuth sign-in (if you choose it).
Apple - OAuth sign-in (if you choose it).
PostHog - product analytics: which pages are viewed and how quickly they load. It does not record what you type, the text on the page, or your screen.
Resend - sending account and event emails.
X (Twitter) - X’s ad pixel records that you visited from one of our posts or ads on X, whether you signed up and, if you buy a membership, what it cost, so we can see which of them work. When you sign up or buy, it also receives a one-way scrambled (hashed) form of your email address - never the address itself - so X can match it to the account that saw the ad. It never follows members around the site (only the moment you join or pay is reported), never runs when your browser sends a Global Privacy Control signal, and in the UK, the EU and EEA, Switzerland, Brazil and Quebec runs only if you choose Accept in our cookie notice.
Daily - live video rooms for online events, and recordings of a session when its host turns recording on.
Cloudflare - storage and playback of video, including recordings of sessions.
OpenAI - automated safety checks on uploaded images and video, and written summaries of recorded sessions (it receives the session’s transcript to write them).

4. Cookies & similar technologies

We use first-party cookies and similar storage, such as your browser’s local storage, to keep you signed in, remember your preferences, protect against abuse, and measure how the Service is used through PostHog. In the UK, the EU and EEA, Switzerland, Brazil and Quebec nothing is stored for analytics or advertising until you choose Accept in our cookie notice. Elsewhere it runs unless you opt out, and never when your browser sends a Global Privacy Control signal. You can turn it off, or change your choice, here at any time: . The one exception to first-party storage is X’s ad pixel above, which sets X’s own cookies; a cookie of ours lasting at most 30 minutes tells it that you have just joined. You can clear cookies and site data at any time in your browser; doing so will sign you out.

5. How long we keep your data

Account and profile data are retained for as long as your account is active. If you delete your account, we remove or anonymize personally identifying data within 90 days, except where we are required to retain it for tax, accounting, fraud prevention, or legal obligations (typically up to 7 years for billing records).

6. Your rights

You have the right to access, correct, export, or delete your personal data. You can update most fields directly in your settings. To request export or full deletion, email our support page. If you are in the EEA, UK, or California, you also have rights under the GDPR, UK GDPR, and CCPA respectively, including the right to object to or restrict processing.

7. Children

The Service is not directed to anyone under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided us data, contact us and we will delete it.

8. International transfers

Our infrastructure is primarily hosted in the United States. If you use the Service from outside the U.S., you understand that your data will be transferred to and processed in the U.S., which may have different data-protection laws than your home country. We rely on appropriate safeguards, such as standard contractual clauses, where required.

9. Security

We use industry-standard safeguards: TLS in transit, encrypted storage at rest, server-side authorization with row-level security on user data, scoped service-role keys, and structured audit logging on sensitive operations. No system is perfectly secure; we will notify affected users without undue delay if a breach affects their data.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or by a prominent notice in the Service. The effective date at the top reflects the latest revision.

11. Contact

Questions or requests? Email us at our support page, or write to us at the address below. It is the same postal address that appears on your receipts.

Animor Studios, Inc.6505 Blue Lagoon Dr., Suite 130Miami, FL 33126United Statesour support page