Privacy Policy

Data Collection

Favly is committed to protecting your privacy. We do not collect any unnecessary personal information. The only data we store includes:

• Email address (for account creation and communication)
• Username (for your public profile)
• Password (encrypted and securely stored)
• Your favorite movies, books, games, and other content preferences
• Who you follow and who follows you

Followers

Following someone records a link between the two accounts. Your follower and following counts are always public on your profile. Whether visitors can open those counts to see the actual names is up to you — the two lists have separate switches in Settings, and both start visible. Turning a list off hides it from everyone but you; it does not hide the number, and it does not remove anyone.

Following is one-way and needs no approval, so anyone may follow a public profile. If you delete your account, every follow relationship involving you is deleted with it, in both directions.

Data Storage & Security

All your data is securely stored using Supabase, a trusted cloud database service. We use industry-standard encryption and security measures to protect your information. Your passwords are never stored in plain text and are encrypted using secure hashing algorithms.

Third-Party Services

We use the following third-party services to provide our platform:

• Supabase: For backend services, authentication, and database storage
• Vercel: For hosting and deployment
• External APIs: For content discovery (TMDB, Google Books, IGDB)
• Google Analytics (GA4): For privacy-preserving product analytics — see “Analytics & Cookies” below
• Stripe: For payment processing on paid plans

These services have their own privacy policies, and we ensure they meet our security standards.

Analytics & Cookies

We use Google Analytics 4 (GA4) to understand how people use Favly so we can improve the product. GA4 sets first-party cookies / identifiers in your browser to recognise return visits and measure flows (for example, how many visitors create a profile or add their first work).

• When you are signed in, we associate analytics with a pseudonymous User-ID (your internal account ID), never your email, username, or profile content.
• We measure actions and outcomes (sign-up, first work added, share, checkout, purchase) — not the titles, reviews, search text, or files you add.
• We use analytics only for service improvement and product decisions, never to sell your data.

You can opt out by using the Google Analytics opt-out browser add-on, by blocking analytics cookies in your browser, or by enabling “Do Not Track”.

Referrals

If you invite someone with your referral link, we record that the two accounts are connected so we can give you both the free Pro time the invite promises.

• Your referral code is a random 6-character string shown on your public profile — like your username, it is public information. Entering someone’s code at signup stores it briefly in your browser (in the app, on your device) until the referral is settled, then it is cleared.
• We store who invited whom, when, and whether the reward was granted — so the reward can be paid once and only once.
• The person whose code you used can see your username on their referral page — you chose to enter their code, and usernames are public identifiers. Nothing else about you is shown to them.
• Referral records are never shared with third parties, and they are not used for advertising.
• Deleting your account removes your identity from any referral record it appears in. The other person keeps the Pro time they already earned.

Data Usage

We use your data solely to:

• Provide and maintain your account
• Display your public profile and preferences
• Send important account-related communications
• Improve our service based on usage patterns (anonymized)

Your Rights

You have the right to:

• Access your personal data
• Update or correct your information
• Delete your account and all associated data
• Export your data
• Opt out of non-essential communications

Data Breach Response

In the unlikely event of a data breach, we will:

• Notify affected users within 72 hours
• Work with security experts to contain the breach
• Implement additional security measures
• Provide guidance on protecting your account