icreate is designed around a simple commitment: you are a listener or a creator, not a data product. This policy explains what we collect, what we deliberately don't, and how to control it.
1. What we collect
- Account info — your email (for sign-in and receipts), your handle, optional display name, optional bio and avatar, and (for listeners) a private login slug.
- Content you create — audio files, transcripts, cover and featured images, post metadata, comments, and Echo Survey answers.
- Billing identifiers — your Stripe customer ID and subscription IDs. Your card details are handled by Stripe; we never see or store them. See "Data firewall" below.
- Operational logs — IP address, user agent, and basic request logs retained briefly for security, abuse prevention, and debugging.
- Private usage signals — listen counts, comment counts, and tip totals are recorded so the Platform can pay creators correctly and surface private analytics to them. These numbers are never displayed publicly to other users.
2. Pseudonymity
Your handle does not have to match your legal name. Listener accounts in particular are designed for pseudonymous use — your public identity on the Platform is the handle you choose. We do not require or encourage you to link your real name to your behavioral activity. You may use a private email forwarder or alias if your provider supports one.
Some legal/regulatory obligations may require legal name disclosure (for example, U.S. tax forms for Creator payouts above IRS reporting thresholds). When that applies, the disclosure is limited to the regulatory recipient and is not used to relink your Platform behavior to your legal identity.
3. Data firewall
We separate billing identity from behavioral activity:
- Card details and full billing PII live with Stripe, not with us. The Platform retains only the Stripe customer/subscription IDs needed to start the next billing cycle.
- Behavioral activity (what you listen to, what you tag, what you tip) is stored under your Platform account ID, not your billing identity.
- We do not sell, rent, or syndicate user-level behavioral activity to third parties, and we do not run third-party analytics or advertising trackers in our pages or audio streams.
4. What we deliberately do NOT do
- Sell, rent, or syndicate your personal data.
- Run third-party advertising trackers on our pages.
- Profile you across other sites or apps.
- Surface public engagement counts (listens, likes, followers) on Creator pages. These exist privately for the Creator's own analytics only.
- Use behavioral data to personalize the public discovery feed in Phase 1. Discovery is newest-first for everyone.
5. Sub-processors
- Supabase — authentication, primary database, and row-level security for your data.
- Stripe — payment processing, billing, and Stripe Connect creator payouts. Stripe handles all card data under PCI DSS.
- Bunny.net — application hosting (Magic Containers) and CDN delivery of audio files and cover art.
- Cloudflare — DNS and edge protection.
- Groq (Whisper) — automated audio/video transcription. Uploaded media is sent to Groq for speech-to-text processing; Groq's data-use terms apply.
- Google (Gemini) & Qwen — AI-assisted post tagging (Major Theme / Sub Theme / Sub Topic), matchmaker ranking, rubric scoring, and AI-assisted editor suggestions. Transcripts and metadata may be sent to these providers for these features; their data-use terms apply.
- Resend — transactional email (sign-in links, billing receipts).
6. Automated audio & video processing
We utilize automated algorithmic software and machine-learning models to process uploaded audio and video files. This processing includes the generation of text transcriptions and automated metadata indexes. These automated background activities are strictly mandatory and conducted exclusively to optimize internal Search Engine Optimization (SEO), facilitate search querying, generate captions, and dynamically connect content creators with relevant user feeds via the Echo Survey.
Public Visibility Control. While background AI processing is required for all hosted media, content creators retain absolute control over whether these generated transcripts are visible or accessible to their subscribers and public listeners. Creators may toggle transcript visibility "ON" or "OFF" at any time via their dashboard — including after publication. Toggling visibility to "OFF" hides the text pane from the user interface, preventing public viewing, scraping, or copying of the text. This processing remains entirely mechanical; human personnel do not review or read these transcriptions or metadata files in the ordinary course of business unless a file is flagged manually for severe safety or security violations.
7. Copyright & safe-harbor disclosures
We reserve the right to share your account information, upload logs, communication history, and identifying infrastructure data (such as IP addresses) with third parties when required to comply with statutory legal frameworks, including but not limited to the Digital Millennium Copyright Act (DMCA). If a valid DMCA Counter-Notification is executed by you, be advised that the DMCA requires us to forward your entire Counter-Notification — including your full legal name, physical address, phone number, and statement of justification — directly to the original third-party copyright claimant. By submitting a counter-notification, you explicitly consent to the disclosure of your personal data to that third party.
8. Cookies
- ia_session — HttpOnly session cookie when you're signed in. Required for authentication.
- ia_guest — anonymous token that pairs you with your per-creator 60-minute preview budget so it doesn't reset on every new tab. No personal data.
No third-party tracking cookies.
9. Your rights
You can update or delete your account at any time. Account deletion removes your profile, posts, comments, and survey answers from the active Platform. Anonymized records of past financial transactions may be retained for accounting and regulatory compliance.
Depending on where you live, you may have additional rights under the GDPR, CCPA, or other regional law (access, correction, portability, objection). To exercise any of these rights, email hello@icreate.blog.
10. Children
icreate is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have, please contact us so we can delete it.
11. Changes
Material changes to this policy will be announced via email or in-app notice before they take effect.