Privacy Policy

V1 business policy · October 6, 2026

This describes the current implementation and proposed retention targets. It is not attorney-approved. Final privacy review is recommended before public launch. Retention and deletion automation is not active.

Data used

Supabase handles account authentication and stores account identifiers, property claims and ownership history, design drafts, public designs, purchase records, ad submissions, review decisions, and visitor reports. Ad submissions may contain uploaded images, business names, text, and links. Reports include a reason and optional explanation. Security or administrative records may be kept to operate and protect the service.

Payments

Stripe handles card details in its hosted checkout. Boardwalk District stores payment and purchase identifiers, amounts, statuses, and policy acknowledgment records, not complete payment-card numbers.

Analytics and browser storage

A property panel opening and a click on an advertiser's external website can be counted. A random browser token is hashed in the database to limit duplicate events by property, placement, type, and day. The event table does not store an IP address, name, or account ID. Owners can see aggregate metrics for their own properties. Necessary local storage also supports sign-in, interface preferences, and private previews; see the Cookie Policy.

Moderation and reports

Submitted ads and visitor reports are held for review. A report does not itself remove an ad. No external automated moderation provider is connected. If one is added, we will review the provider, data shared, retention, and this notice before activation.

Retention targets

• Active account and property data: while needed for the relationship and legitimate operations.
• Expired property designs and owner content: target approximately 90 days after expiration or release before deletion or anonymization, unless longer retention is reasonably needed.
• Rejected ad uploads: target approximately 90 days for unnecessary content; minimal review metadata may be kept longer for abuse, disputes, or legal duties.
• Reports and moderation records: target approximately one year, longer for unresolved investigations, security, disputes, or legal duties.
• Raw analytics events: target approximately 13 months; aggregated or anonymized statistics may be kept longer.
• Admin and security audit logs: target at least one year, longer for important ownership or security events where needed.
• Financial, transaction, and accounting records: according to applicable tax, accounting, payment, fraud, and dispute requirements.

These are policy targets. Automatic deletion and retention jobs have not been implemented.

Requests and contact

The intended privacy-request address is privacy@boardwalkdistrict.com. Reasonable identity and account verification will be required before sensitive account information is disclosed, changed, or deleted. For purchase or property support, the intended address is support@boardwalkdistrict.com. Mailbox delivery for both addresses must be verified before public launch. Do not send sensitive information through the public ad report form.