SpillHub Privacy Policy
- SpillHub is a public discussion and community platform. By default, your posts, comments, handle, karma, and community participation are visible to everyone and indexed by search engines.
- We collect information you provide directly (such as your email, handle, and bio) as well as technical telemetry and authenticated session data necessary to operate the platform reliably.
- We never sell your personal data or creator metrics to data brokers, advertising networks, or third-party marketers.
- We protect your data with strict PostgreSQL Row Level Security (RLS), anti-privilege-escalation database triggers, and TLS 1.3 transit encryption.
- You have the right to access, rectify, export, or permanently delete your account and personal data at any time via your account settings or by contacting our Data Protection Officer at support@fomospills.in.
1. Introduction & Data Controller Identity
Welcome to SpillHub, an interactive community platform designed for digital creators, engineers, founders, and community builders. SpillHub is owned, operated, and maintained by FOMO Spills ('SpillHub', 'FOMO Spills', 'we', 'our', or 'us'), operating through our primary web domains at fomospills.com and fomospills.in.
This Privacy Policy describes how we collect, use, store, process, and disclose personal data when you access or use SpillHub websites, web applications, creator tools, application programming interfaces (APIs), embeds, widgets, newsletters, and related interactive services (collectively, the 'Services').
For the purposes of applicable data protection legislation—including the European Union General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and India's Digital Personal Data Protection Act, 2023 (DPDP Act)—FOMO Spills acts as the Data Controller responsible for your personal information. If you have questions about our data practices, our Data Protection Officer and Grievance Officer can be reached at support@fomospills.in.
2. SpillHub is a Public Platform
SpillHub is fundamentally structured as an open, public forum. Much of the activity you conduct on the Services is public and accessible to anyone, whether or not they possess an active SpillHub account.
When you publish a post ('Spill'), submit a comment, reply to a thread, or curate a community ('r/[slug]'), that content is permanently associated with your unique creator handle ('u/handle') and timestamp. Your public profile displays your chosen display name, avatar, bio, total karma points, cake day (registration anniversary), list of joined public communities, and complete public submission history.
Public content is distributed across our edge content delivery network, cached globally, indexed by third-party search engines, and made accessible via our public developer feeds. While you may edit or delete your content at any time, search engines and third-party caching archives may retain historical snapshots according to their independent crawling schedules.
3. Information We Collect
We categorize the information we collect into three operational tiers: information you provide voluntarily, information collected automatically through your interaction with the platform, and information received from verified third-party authentication services.
3.1 Information You Provide Directly
- Account Credentials: When creating an account, you provide an email address, a unique creator handle (conforming to ^[a-z0-9_]{3,32}$), and a cryptographic password hash managed via our enterprise authentication infrastructure (Supabase Auth).
- Creator Profile Details: You may optionally provide a display name, public biography, website link, and avatar image uploaded directly to our cloud storage.
- Onboarding Preferences: During account initialization, you may supply creator identity details (gender identity, optional), topic interests (e.g., Technology, Gaming, Startups, Design, Creators), and sub-topics, used to curate your initial home feed and auto-join recommended communities.
- User-Generated Content: All submitted posts, rich-text markdown descriptions, image attachments uploaded to our Supabase Storage 'media' bucket, nested hierarchical comment trees, upvotes, downvotes, moderation reports, and private bookmarks.
- Direct Communications: Messages, support inquiries, accessibility requests, or bug reports submitted to support@fomospills.in.
3.2 Information Collected Automatically
- Device & Connection Metadata: Internet Protocol (IP) addresses, browser type, operating system version, screen resolution, viewport parameters, and preferred interface language.
- Session Tokens & Security State: HTTP-only session refresh tokens, cryptographic anti-CSRF signatures, and secure cookies managed via @supabase/ssr.
- Usage & Telemetry Data: Referrer URLs, page dwell time, scroll depth, search query terms, interaction timestamps, and client-side error telemetry used to optimize network throughput and UI responsiveness.
3.3 Information Received from Third Parties
- OAuth Authentication Providers: When authenticating via Google OAuth or Apple Sign-In, we receive identity tokens containing your verified email address, full name, profile picture URI, and unique provider subject identifier. We do not obtain access to your external passwords, contacts, or private Google/Apple cloud repositories.
4. How We Use Your Information
We process your personal information strictly in accordance with lawful legal bases and in furtherance of providing high-performance community infrastructure. Specifically, we use your data to:
- Deliver, maintain, and enhance core platform capabilities, including real-time post publishing, nested thread rendering, and community moderation workflows.
- Personalize your feed based on your subscribed communities ('r/[slug]') and chosen onboarding interests.
- Prevent spam, automated sybil attacks, bot-driven vote manipulation, and unauthorized scraping.
- Enforce our User Agreement, SpillHub Community Rules, and Moderator Code of Conduct through automated filtering and moderator escalation queues.
- Transmit critical transactional notices, password reset links, magic login emails, security advisories, and administrative service updates.
- Improve digital accessibility and multi-device usability, ensuring compliance with Web Content Accessibility Guidelines (WCAG 2.1 Level AA) across devices ranging from 240px keypad phones to 4K displays.
6. Security Architecture & Data Retention
SpillHub deploys an institutional-grade security framework to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure.
Transport & Rest Encryption: All network transmissions are strictly enforced using Transport Layer Security (TLS 1.3) with forward secrecy. All database tables, audit logs, and media assets in Supabase Storage are encrypted at rest using AES-256 cryptographic standards.
PostgreSQL Row Level Security (RLS): All database operations execute through granular RLS policies. User bookmarks, draft states, private email records, and moderation report logs are mathematically partitioned in the relational engine, preventing cross-tenant leakage even in the event of application layer anomalies.
Anti-Privilege Escalation Triggers: Automated PostgreSQL database triggers prevent unauthorized role alteration, ensuring administrative permissions cannot be elevated through client-side API requests.
Retention & Deletion Cascades: Personal data is retained only for the duration required to fulfill the operational purposes set forth herein. When you delete your account, our database triggers an immediate ON DELETE CASCADE sequence that expunges your private credentials, personal profile metadata, and private bookmarks.
7. Your Rights, Choices & Account Controls
Regardless of your geographic location, SpillHub empowers you with direct, autonomous control over your personal data:
- Account Rectification: You can update your display name, bio, avatar, and notification preferences at any time via your Account Settings (/account).
- Content Management: You retain the autonomous capability to edit or permanently delete your posts and comments directly within each thread.
- Private Bookmarks: You may bookmark posts for personal reference. Bookmarks are strictly private to your authenticated session and are never displayed on public creator profiles.
- Data Export & Portability: You may request a machine-readable JSON export of your profile history and submitted posts by contacting support@fomospills.in.
- Permanent Account Deletion: You may permanently terminate your SpillHub account at any time. Upon deletion, your public handle is disassociated from your contributions or replaced with '[deleted]', and private records are expunged.
8. International Data Transfers & Global Infrastructure
SpillHub operates a globally distributed cloud architecture designed for high availability and sub-millisecond edge response times. Our edge routing is orchestrated across global points of presence via Vercel Inc., while our primary relational database and object storage repositories reside in AWS Tokyo (ap-northeast-1) managed through Supabase Inc.
Consequently, your personal data may be transferred to, stored, and processed in jurisdictions other than your country of residence, including India, Japan, the United States, and the European Union. Where we transfer personal data across international borders, we implement recognized legal transfer mechanisms, including European Commission-approved Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums.
9. Data Privacy Framework (DPF) Commitments
FOMO Spills adheres to the principles of the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States.
In compliance with the DPF Principles, we commit to resolving complaints about our collection or use of your personal information. European, British, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the DPF should first contact our compliance team at support@fomospills.in.
10. Rights for European Economic Area (EEA) & UK Users
If you reside in the EEA or the United Kingdom, your data protection rights are guaranteed under Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018.
Our Legal Bases for Processing include:
- Contractual Necessity (Art. 6(1)(b) GDPR): Processing required to perform our User Agreement, host your creator account, and publish your contributions.
- Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary to secure the Services, detect fraud, verify creator integrity, and preserve platform uptime, balanced against your fundamental rights.
- Consent (Art. 6(1)(a) GDPR): Where you explicitly grant permission, such as voluntary onboarding topic preferences or browser notification permissions.
- Legal Obligation (Art. 6(1)(c) GDPR): Compliance with binding statutory or judicial orders.
Your Statutory Rights under Articles 15–22 GDPR
- Right of Access (Art. 15): Obtain confirmation of data processing and copies of your personal data.
- Right to Rectification (Art. 16): Correct inaccurate or incomplete profile records.
- Right to Erasure ('Right to be Forgotten', Art. 17): Delete personal data where retention is no longer necessary.
- Right to Restriction of Processing (Art. 18): Restrict processing under contested circumstances.
- Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21): Object to processing grounded in legitimate interests.
- Right to Lodge a Complaint: You retain the right to lodge a complaint with your local supervisory authority in your EU Member State or the UK Information Commissioner's Office (ICO).
11. Rights for California & US State Residents
This section supplements our Privacy Policy and applies solely to residents of California, Virginia, Colorado, Connecticut, Utah, and other US states enacting comprehensive privacy statutes pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).
Exercise of California Rights
- Right to Know & Access: You may request disclosure of the specific pieces of personal information collected about you over the preceding 12 months.
- Right to Delete: You may request permanent deletion of your personal information.
- Right to Opt-Out of Sale or Sharing: Because SpillHub does not sell or share personal data for cross-context behavioral advertising, we do not provide an opt-out link.
- Right to Non-Discrimination: We will never discriminate against you, alter service tiers, or degrade platform performance because you exercised any CCPA/CPRA right.
- Submit a Verified Request: California residents may submit requests by emailing support@fomospills.in with 'CCPA Request' in the subject line.
| Category of Personal Information | Collected | Source | Commercial Purpose | Sold / Shared |
|---|---|---|---|---|
| Identifiers (Handle, Email, IP) | YES | User Direct & Telemetry | Account creation & security | NO |
| Protected Classifications (Gender, optional) | YES | User Direct Onboarding | Experience personalization | NO |
| Commercial Activity (Submissions, Votes) | YES | Platform Interaction | Feed ranking & curation | NO |
| Internet Activity (Logs, Device Info) | YES | Automatic Telemetry | Uptime & abuse prevention | NO |
| Geolocation Data (Approximate IP City) | YES | Network Connection | Edge CDN routing | NO |
12. Notice for Indian Residents & DPDP Act 2023 Compliance
SpillHub is proudly operated by FOMO Spills and complies fully with India's Digital Personal Data Protection Act, 2023 ('DPDP Act') and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Consent Architecture: Digital personal data is processed solely for lawful purposes for which you have provided clear, affirmative consent or for legitimate uses specified in Section 7 of the DPDP Act.
Consent Manager Rights: You may withdraw consent at any time through account settings or via a registered Consent Manager recognized by the Data Protection Board of India.
Statutory Grievance Redressal Officer: Pursuant to Rule 3(2) of the IT Rules 2021 and Section 13 of the DPDP Act 2023, FOMO Spills has designated a Grievance Officer responsible for redressing grievances within 36 hours of receipt and resolving them within statutory timelines:
Grievance Officer Contact Details
- Name: Grievance Officer, FOMO Spills & SpillHub
- Official Email: support@fomospills.in
- Registered Entity: FOMO Spills Ecosystem
- Jurisdiction: Mumbai, Maharashtra, India
- Response Protocol: Grievances are acknowledged within 24–36 hours and resolved within statutory windows.
13. Notice for Brazilian Residents (LGPD)
Pursuant to Brazil's Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018), Brazilian data subjects hold rights of confirmation, access, correction of incomplete or outdated data, anonymization, blocking or elimination of unnecessary data, portability to another service provider, and revocation of consent. To exercise your LGPD rights, please contact support@fomospills.in.
14. Revisions & Official Contact Channels
We may amend this Privacy Policy from time to time to reflect technological evolution, legislative developments, or architectural updates. When material modifications occur, we will provide advance notice via prominent banner notifications on the Services, email alerts to registered account holders, or updated timestamp headers.
Your continued access to or use of SpillHub following the effective date of an amended policy constitutes acceptance of the revised terms.
For privacy inquiries, supervisory authority communications, or legal service of process, please contact:
FOMO Spills / SpillHub Data Protection Office
Email: support@fomospills.in
Web: https://fomospills.com and https://fomospills.in
If you have questions regarding this policy, need clarification on creator terms, or wish to exercise data subject rights under GDPR, CCPA/CPRA, or India's DPDP Act, contact our legal and privacy team at support@fomospills.in.