Privacy Policy

This policy describes what Vig collects when you use the website and, later, the native apps; how it is used; who can see it; and the choices you have. It applies to everyone with an account and to anyone who views a public Vig or receipt without signing in.

Account. Your email address and the identifier from your sign-in provider (magic link or Google). We do not store passwords for normal accounts. Session cookies keep you signed in.

Profile. Name, username, city, bio and avatar. Vig computes and stores activity statistics: Vigs posted, Vigs completed, success rate, average rating and lifetime totals earned and spent.

Vig content. Everything a Poster writes in a Vig: title, public description, instructions, proof requirements, tags, deadlines and any private details or links. Notes a Runner attaches when expressing interest.

Proof. What a Runner submits to show a Vig was done: text, photos, video, screenshots, external links and checklist responses, plus basic device metadata (for example browser and capture source). Vig does not request or collect your precise location when you submit proof. Vig stores a cryptographic hash of every uploaded file so tampering can be detected. These signals feed automated verification and fraud checks. If Vig later introduces Vigs that require being in a specific place, any location capture would be optional, requested at that moment, and described here first.

Payments. A ledger of every funding, payout and refund tied to your account, in cents. During the MVP period these entries are simulated. When real payments launch, card and bank details will be collected directly by the payment processor, not by Vig; Vig will store only processor identifiers.

Activity. Product analytics events (for example viewing a Vig, publishing, taking, submitting proof, being paid), notifications sent to you and when you read them, and a timeline of status changes on each Vig. Moderation findings and Vig Review records are kept with the Vig they relate to.

Ratings. Scores and comments you leave for other users and that they leave for you.

• To run the marketplace: publish Vigs, match Runners, deliver private details to approved Runners, collect proof, release Payoffs and issue refunds.
• To keep people safe: automated moderation of every Vig before it goes live, automated verification of proof, fraud detection and human review when something is flagged or disputed.
• To show trust signals: public profile statistics and ratings help Posters and Runners decide who to work with.
• To notify you: in-app alerts about interest, approvals, proof, payment, expiry and moderation. Push and email notifications will be added later and will be opt-in where the law requires.
• To understand and improve the product: aggregate analytics on how Vigs move from posted to paid.
• To comply with law, enforce the Terms and resolve disputes.

• Profiles, ratings and public Vig content are visible to anyone, including people who are not signed in.
• Private details on a Vig are visible only to the Poster, Runners the Poster has approved, Runners who have taken it, and Vig staff.
• When a Poster approves a Runner, the Poster sees that Runner's full public profile and statistics. When a Runner is approved, they see the Vig's private details.
• Proof is visible to the Runner who submitted it, the Poster of that Vig, and Vig staff. Proof media is stored privately and served through short-lived signed links.
• Receipts for paid Vigs have a shareable public page showing the Vig title, the Payoff and the Runner's public profile. Runners choose whether to share them.
• Payment ledgers are visible to the account they belong to, the Poster of the related Vig where relevant, and Vig staff.
• Vig staff with admin access can view moderation flags, Vig Review records and the full history of a Vig. Every admin action is logged.

Vig runs on Supabase (Postgres database, authentication, file storage and realtime delivery of notifications) and is hosted on Vercel. Google receives your sign-in request if you choose to sign in with Google. When real payments launch, Stripe will process funding and payouts and will collect identity information from Runners as required for payouts. Analytics may later be sent to a third-party analytics provider; if so this policy will name it.

Vig does not sell personal information and does not share it with advertisers.

• Data is stored in Supabase-managed Postgres. Row-level security limits what a signed-in session can read; all writes go through Vig's server code after authorization checks.
• Proof files live in a private storage bucket. They are never served from a public URL.
• Money is recorded as integer cents with idempotency keys so the same action is never applied twice.
• Transport is encrypted. Access to production credentials is limited to the people who operate the platform.
• No system is perfectly secure. If a breach affects your data we will notify you as the law requires.

Account and profile data is kept while your account exists. Vig, proof, ledger and Vig Review records are kept for as long as needed to run the marketplace, resolve disputes and meet legal and financial record-keeping obligations. Specific retention periods, including how long proof media is kept after a Vig closes, are placeholders pending attorney review.

• You can edit your name, username, city and bio at any time from your profile.
• You can request a copy of your data, correction of inaccurate data, or deletion of your account by emailing privacy@vig.link (placeholder). Some records, such as payment ledgers and dispute decisions, may be retained after deletion where the law allows or requires.
• Depending on where you live you may have additional rights, for example under GDPR or the CCPA. The mechanics of honoring those rights are a placeholder pending attorney review.

Vig is for adults. You must be at least 18 to hold an account. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

We may update this policy. The date at the top changes when we do, and material changes are announced in-app before they take effect.

Privacy questions and requests: privacy@vig.link (placeholder). See also the Terms of Service.