Privacy Policy
What Sen stores about creators, supporters and visitors, why, and what you can do about it.
Effective
The short version
- Sen keeps what it needs to run your page and record payments, and little else.
- Card and bank details go to Stripe and never reach Sen.
- No advertising, no tracking cookies, no third-party analytics. Your data is never sold.
- The only cookies keep you signed in and remember the page you’re managing.
- You can change or delete your data at any time; deleting your account removes your pages and their history.
Who we are
Sen is a service of Vaporsoft, based in New York, United States. Vaporsoft decides how the data described here is used (in EU and UK terms, it is the controller). Reach us at support@vaporsoft.dev.
What Sen stores
Sen stores only what you give it or what a payment produces:
- Your account
- Your email address
- How you sign in (an email link, or Google, GitHub or Microsoft, which share your name and email with Sen)
- When you last signed in, and your role (admin roles only)
- Your pages
- Username, display name and bio
- Page settings: palette, background, tip amounts, subscription tiers and their descriptions
- Whether a page is listed, deactivated or a brand page, and who owns it
- Payments
- Amount, Sen’s fee, date and status (paid, refunded, disputed)
- A tip’s message, and the supporter’s email if they give one (never for an anonymous tip)
- A subscriber’s email, tier, status and renewal date, whether it’s set to end, and the Sen account that subscribed (when signed in)
- Stripe’s reference numbers, to match payments with refunds and disputes
- Payouts
- Your Stripe account’s ID, email and whether setup is complete. Everything else stays with Stripe.
- Supporter and unlocks
- Your Supporter payment and date, which unlocks you’ve reached, and when, and whether you’ve earned the Vaporsoft badge (by paying the Vaporsoft page), and when
- For Supporter given as a gift, which account bought it (shown to the account that received it, and in the buyer’s own payments)
- Admin records
- A log of actions admins take, such as a refund or a role change, with who took them
A supporter who pays without an account leaves only the payment record: the amount, and the message and email they chose to give.
What Sen doesn’t store
- Card and bank details. Checkout, identity checks and payout details are handled by Stripe, which is certified to the highest payment-security standard (PCI DSS Level 1).
- Passwords. There aren’t any.
- Your IP address. Sen uses it for a moment to limit repeated requests, then discards it. Its hosting and sign-in providers record it in their own security logs, as their policies describe.
- Tracking. No advertising, analytics or social-media scripts, no cross-site cookies, no browsing history, location or contacts.
Who sees what
- Everyone sees a public page: its username, display name, bio, amounts and tiers, and the Supporter and Vaporsoft badges if its owner has them.
- Creators see the payments to their pages: amount, date, message, and the supporter’s email when one was given. Anonymous tips don’t show who sent them.
- Sen’s admins can see account and payment records to give support, issue refunds and stop abuse. Their actions are logged.
- Service providers handle data only to run Sen for us (see below).
- Nobody else. Sen doesn’t sell or rent data, or share it for advertising. We disclose data only where the law requires it, and only what it requires.
How it’s used
| Use | Legal basis (EU/UK) |
|---|---|
| Running your account and pages, and processing payments | Performing our agreement with you |
| Sign-in links and essential account emails (no newsletters) | Performing our agreement with you |
| Preventing fraud and abuse, and keeping Sen secure | Legitimate interests |
| Keeping payment records and answering lawful requests | Legal obligation |
Sen makes no automated decisions about you with legal effect, and doesn’t use your content to train AI models.
Service providers
| Provider | Does | Where |
|---|---|---|
| Stripe | Payments, payouts, identity checks for creators, and the subscription portal | United States |
| Supabase | Database and sign-in | United States (Ohio) |
| Cloudflare | Hosting, delivery and protection from attacks | Worldwide network |
| Resend | Sign-in and account emails | United States |
| Google, GitHub, Microsoft | Sign-in, only if you choose one of them | United States |
Data is stored in the United States. Where it moves there from the EU or UK, these providers protect it with the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
Cookies and your device
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| sb-…-auth-token | Cookie | Keeps you signed in | Until you sign out |
| sen_active_page | Cookie | Remembers which of your pages you’re managing | 30 days |
| sen-app-theme, sen-contrast | Local storage | Your appearance settings | Until you change them |
| Offline copies | App cache | Lets the Sen app open public pages without a connection | Replaced as pages change |
Each is needed for Sen to work or remembers a choice you made, and none follows you to other sites, so Sen doesn’t ask for cookie consent. Stripe sets its own cookies on its checkout pages, to process the payment and prevent fraud.
Keeping and deleting
- Your data is kept while your account exists. Deactivating keeps it, so you can return.
- Deleting your account (Settings) deletes your pages, tiers, and the tips and subscriptions they received, along with your sign-in, roles and Supporter status. Tips you sent to others keep their amounts, with your email and messages removed.
- Stripe keeps its own payment and tax records for as long as the law requires, and your Stripe account stays yours.
- Deleted data can remain in our providers’ backups for up to 30 days before it’s overwritten.
- A supporter without an account can ask us to remove their email or message from a payment at any time.
Your rights
Wherever you live, you can ask to see, correct, export or delete your data, or object to how it’s used. Most of it you can change yourself in the Editor and Settings; for anything else, email support@vaporsoft.dev from the address on your account. We answer within 30 days, free of charge.
- EU and UK: you can also restrict processing, and complain to your data protection authority.
- California and other US states: Sen collects identifiers (email, username) and payment records, for the purposes above. It doesn’t sell or share personal information, and won’t treat you differently for using your rights.
Security
- Every connection is encrypted, and data is encrypted where it’s stored.
- Database rules limit each account to its own records; payments are written only by verified messages from Stripe.
- A strict content security policy blocks scripts Sen didn’t write.
- If a breach ever affects your data, we’ll tell you and the relevant authorities without undue delay.
Children
Sen isn’t for children under 13, and doesn’t knowingly collect their data. If you believe a child has used Sen, email us and we’ll delete their account.
Changes
When this policy changes, the date at the top changes too. Material changes are announced at least 30 days ahead by email to account holders. The Terms of Service cover everything else.