Privacy Policy

1. Who We Are

ComeFront is operated by Parham Paziraie, a sole proprietor trading as ComeFront ("ComeFront," "we," "us," or "our"). For the personal data described in this policy, Parham Paziraie is the data controller, meaning the person who decides why and how it is used.

Postal address: 8506 Madison Ave, Fair Oaks, CA 95628, USA

Email: admin@comefront.com

This policy covers the ComeFront website and the ComeFront mobile app, for users in every country. We have not appointed a data protection officer and have not appointed a representative in the European Union or the United Kingdom. Contact Parham directly at admin@comefront.com or at the postal address above.

2. What We Collect and Why

Account data. When you register we collect your first and last name, email address, a username, and a password. Your password is stored only as a hash, never in plain text. You may add a bio and a headline. We use this to create and run your account, to sign you in, and to show your profile to other users as described in this policy.

Content you create. We store the agreements, desk items, blueprints, and notices you create, your friend connections, your block list, and your profile picture if you upload one. We use this to provide the features you asked for. Content you share is visible to the people you share it with, as described in section 6.

Settings and account status. We store your privacy settings, your chosen avatar look if you have one, your account status, the time you accepted the Terms, and timestamps for your last activity and your last name and username changes (we use the latter to enforce limits on how often they can be changed).

Backing and payment records. If you back ComeFront we store a record of each contribution: the amount, currency, date, status, the product or plan, and the identifiers the payment provider gives us (for example a Stripe session, subscription or customer ID, or an Apple transaction ID). We use these to show your Backer Badge and billing history, to work out your crowns, and to handle support and refunds. We never see or store your full payment card details. On iOS we also record, for each tap on a one-time backing option, which product was chosen and what outcome the device reported. We use this only to diagnose purchase problems.

Reports and moderation. If you report content or another user, we keep your report, including a copy of the reported content as it was when you reported it, so that we can review it. If you are reported or blocked, the report and its copy are kept by the same rules. Text you put in your name, headline, bio, and username is checked automatically against a list of prohibited terms when you save it; a match stops the save and nothing is filed against you.

Technical data. Like almost every website, the services that deliver ComeFront receive technical information when your browser or app connects: your IP address, device and browser type, and the time and address of each request. They use it to deliver the service, keep it secure, and limit abuse (see section 4 for who). On signup and sign-in, a bot-detection check (Cloudflare Turnstile) runs on your device, and on iOS signup the app may send a device-integrity attestation from Apple (App Attest) so we can tell genuine app installs from automated ones. Our own application code does not add an IP address to your account or store it with your content.

What we do not collect: advertising identifiers, location data, advertising, tracking or profiling data, or data from third-party trackers. We do not use cookies for advertising. No one else collects information about your activity across other websites or apps through ComeFront, and we do not track you across other sites, so we do not treat browser "Do Not Track" signals differently. Our website and app use only the cookies and local storage needed to keep you signed in and remember your settings.

You are not required by law to give us this data, but we cannot create an account or provide the service without the account data in the first paragraph.

3. Our Legal Bases (GDPR)

If you are in the European Economic Area, the United Kingdom, or another place with similar law, we process your data on these bases:

• Contract - to create your account, run the features you use, and process and record your backing (account data, content, backing and payment records).
• Legitimate interests - to keep the service secure, prevent abuse and fraud, review reports, filter prohibited terms from profiles, diagnose purchase problems, and respond to support requests (technical data, reports and moderation data, purchase diagnostics). We have weighed these interests against your rights and keep this data to what is needed.
• Legal obligation - to keep payment and accounting records that the law requires us to keep, and to respond to valid legal requests.
• Consent - we do not rely on consent for our core processing. If we ever ask for consent for something optional, you can withdraw it at any time and doing so will not affect what we did before.

4. Who Handles Your Data

We do not sell your data and we do not share it with advertisers or data brokers. These services handle data in order to run ComeFront:

• Supabase - our database, sign-in and authentication, file storage (profile pictures), and server functions. It holds nearly everything described in section 2. Our database is hosted in the United States (North Virginia). Supabase acts as our processor.
• Google (Google Workspace) - sends our account emails (sign-up verification and password reset) and hosts our admin@comefront.com mailbox, so it handles your email address, the content of those emails, and anything you write to us. Google acts as our processor.
• Vercel - hosts the website and the server code behind both the website and the app (including our payment and sign-in endpoints). It receives the technical data in section 2 for every request and keeps request logs. Vercel acts as our processor.
• Cloudflare (Turnstile) - the bot-detection check on sign-up, sign-in and password reset. Cloudflare processes technical signals from your browser or device, such as your IP address, to decide whether you are a person. The result is checked by Supabase, not by our own code.
• Stripe - processes card payments on the web. We pass your email address to Stripe when you check out so it can create your customer record and send receipts. Stripe handles your payment details as an independent controller under its own privacy policy.
• Apple - processes in-app purchases on iOS and sends us signed notifications about them (for example renewals and refunds). We receive Apple's transaction identifiers, not your Apple ID or payment details. Apple also provides the App Attest check. Apple acts as an independent controller under its own privacy policy.
• GitHub - runs a weekly scheduled job that triggers our cleanup of trashed items (section 8). It carries no personal data.

We may also disclose information if the law requires it, to respond to valid legal process, or to protect against fraud or harm. If we sell or transfer the service, your data may transfer with it and we will tell you first.

5. International Transfers

ComeFront is run from the United States (California). Our database is hosted in the United States (North Virginia), our server code runs on Vercel in the United States, and our email runs on Google; some of our providers also use servers in other countries. If you use ComeFront from outside the United States, your data is processed in the United States. When we pass your data to these providers, we protect it with the European Commission's standard contractual clauses and the UK addendum to them, which are part of each provider's data processing terms, and, where the provider is certified, with the EU-U.S. Data Privacy Framework and its UK extension (Vercel, Google, Cloudflare and Stripe are certified). You can ask us for a copy of these safeguards at admin@comefront.com.

6. Data Sharing With Other Users

Your name, username, headline, bio, cover colour, and profile picture and Backer Badge (if you have them and have not hidden the badge) are visible to other signed-in users who find your profile. Agreements, desk items, notices and blueprints are visible only to you and the people you choose to share them with. A friend request carries no free text.

7. Friends List Visibility

You control who can see your friends list and whether you appear in other people's friends lists. These settings live in Settings → Friends list privacy and have two independent controls:

• Who can see your friends list — Only me (private), My friends (the default), or Everyone
• Where you appear in others' lists — Hidden, Friends only (the default), or Everyone

You only ever appear in another person's friends list when both of you allow it. If you hide yourself, or the list owner restricts who can see their list, the connection is not shown.

By default, your friends list is visible to your friends, and you appear in a friend's list only to that friend's other friends.

8. Retention and Deletion

We keep your data while your account is open. You can delete your account at any time in Settings → Delete Account (app and website). There is no grace period and it cannot be undone. Here is exactly what happens when you do.

Removed or anonymized immediately:

• Your name becomes "Deleted User", your username is replaced with a random one, and your bio and headline are cleared.
• Your email address is removed from your account and the sign-in record, your sign-in methods are removed, your password is replaced with a random value, and sign-in is permanently disabled. The email address can be used to register again.
• Your friend connections, block list, blueprints, and unfinished agreement rooms are deleted, as are the items in your own trash.

Not removed by deleting your account:

• Agreements, desk items, and notices you shared with other people stay visible to those people, shown as from "Deleted User". Anything you wrote in them stays too. If you want content removed, delete it before you delete your account.
• Reports and saved copies of reported content are kept while we investigate a report, resolve an appeal, or need evidence to maintain a suspension or address repeat abuse. We review this need regularly and delete information that is no longer needed.
• Backing and payment records are kept to maintain active backing, meet accounting and tax obligations, and resolve refunds, disputes or legal claims. We determine retention from the applicable tax-record and claim periods and keep only the information needed for those purposes. Deleting your account removes your name and email from the account record but does not necessarily make retained payment records anonymous. Stripe and Apple keep their own records under their own policies.
• Account-linked purchase diagnostics (section 2) are kept only while needed to investigate purchase problems and verify their resolution. We review that need regularly and delete the diagnostics when the investigation no longer needs them. They are not retained as tax or accounting records.
• Your profile picture is not deleted automatically by account deletion. You can remove it yourself in your profile before you delete your account, or email us afterwards and we will delete it.
• Deleted data may remain temporarily in restricted database backups until those backups expire under our configured backup schedule. Provider security and request logs follow the retention settings and security requirements of the relevant provider. These copies are separate from live account data.

Trash. When you delete an agreement, desk item, notice, or blueprint, it goes to your trash. A cleanup that runs weekly removes items that have been in the trash for more than 30 days, so a trashed item can remain for up to about five weeks. An agreement is removed from the system for good only when both people in it have deleted it.

You can also ask us to delete your data by emailing admin@comefront.com (see section 9). We may keep data that the law requires us to keep.

9. Your Rights

Depending on where you live, you may have the right to: access the personal data we hold about you and get a copy; correct data that is wrong; have data erased; restrict or object to how we use it; receive the data you gave us in a portable format; and withdraw consent where we rely on it. You also have the right to complain to your local data protection authority.

You can correct most of your account data and delete your account yourself in Settings. For anything else, email admin@comefront.com from the address on your account, tell us what you want, and we will reply within 30 days. We may need to confirm that the account is yours first. Where the law allows, we may extend that period for complex requests and will tell you if we do. We do not charge for requests unless they are clearly unfounded or excessive.

We do not make decisions about you by automated means that have legal or similarly significant effects. The automated term check in section 2 only blocks a save; it does not suspend or penalize accounts.

10. Children

ComeFront is not intended for anyone under 16. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will delete it. If you believe a child has given us data, email admin@comefront.com.

11. Security

We use reasonable measures to protect your information, including password hashing, encrypted connections, and database-level access rules so that users can read only their own and shared data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your data, we will tell you and the authorities as the law requires.

12. Changes to This Policy

When we change this policy we will update the "Last Updated" date at the bottom. If a change is material, we will make reasonable efforts to tell you, for example by email or a notice in the app, before it takes effect.

13. Contact

For privacy questions, rights requests, or deletion requests, contact Parham Paziraie at admin@comefront.com or by post at 8506 Madison Ave, Fair Oaks, CA 95628, USA.