Privacy Policy

1. Introduction

Taffy ("Taffy," "we," "us," or "our") operates the platform at heytaffy.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

We are committed to protecting your privacy. Taffy is designed to be tracker-free — we do not use Google Analytics, advertising cookies, third-party tracking pixels, or any invasive data collection tools. Paying by card is the exception we cannot make: the card form is Stripe's and it runs Stripe's own fraud checks, which Section 2.2 describes in full. This policy applies to all users worldwide, including those protected under the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and other applicable privacy laws.

2. Information We Collect

2.1 Information You Provide

• Account information: email address, password (hashed and stored securely by our authentication provider), display name, and chosen handle.
• Google sign-in information: if you choose "Continue with Google" instead of creating a password, Google returns your email address, name, and profile photo to us so we can create or open your account. This happens only if you use that option.
• Profile information: optional bio, avatar image, and linked wallet handles (e.g., Venmo username, Cash App cashtag) that you choose to display on your public pay page.
• Transaction data: sender and recipient identifiers, transaction amounts, fees, status, timestamps, and Wrapper messages (memos, stickers, or notes attached to payments).
• Receipt email: if you enter an email address for a receipt when you pay, we pass it to Stripe so Stripe can email you the receipt, and Taffy does not store it.
• Candy Jar data: fundraising jar titles, descriptions, goals, categories, updates, and donor information for community fundraising campaigns.
• Support communications: any messages, feedback, or support requests you send to us.

2.2 Information Collected Automatically

• Activity on your account: the records the Service creates as you use it — payments and Candy Jar donations you send or receive, and their amounts, statuses, and timestamps. We do not run behavioural analytics, and we do not build a profile of the pages you browse.
• Request information: the IP address, browser user agent, and requested URL that every web request carries. Our hosting provider processes these in the course of serving the page (see Section 4). We do not build a browsing profile from them. Separately, a handful of sensitive endpoints are rate limited so that one source cannot hammer them: joining the waitlist, starting a payment, donating to a Candy Jar, reading a receipt with The Snap, and closing an account. A request to one of those may be counted in a rate-limit counter, and whatever is being limited is what gets written into it — the IP address the request came from, the email address typed into the waitlist form, the Candy Jar or recipient being paid, or, when you scan a receipt or close your account, your account id. A counter row records that value, the name of the limit, when its counting window started, and how many requests that window has seen. We use those rows to decide whether to slow the next request down, not to build a profile of you.
• Fraud signals at the payment step (collected by Stripe, not by us): when a payer reaches the card form on a Taffy payment page, that page loads Stripe.js directly from Stripe. Stripe.js gathers device and browser signals of its own — the kind of information a fraud system uses, including a device fingerprint, and characteristics of the browser, screen, and time zone — and sends them to Stripe for fraud screening and for 3‑D Secure authentication with the card issuer. Our security headers deliberately allow Stripe's fraud and telemetry hosts so this works; card payments are not safe to run without it. Those signals go to Stripe, not to us: what comes back to Taffy is Stripe's assessment of the payment, not the underlying fingerprint. Taffy runs no script of its own that collects them, on that page or any other.
• Cookies: essential cookies required to sign you in and keep you signed in. See Section 7 for the full list.

2.3 Information We Do NOT Collect

• Credit card numbers, debit card numbers, CVVs, or full bank account details. All payment credentials are collected and stored exclusively by Stripe and never touch Taffy's servers.
• Social Security numbers or government-issued identification numbers.
• Precise geolocation data.
• Biometric data.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: processing transactions, managing your account, displaying your public pay page, and enabling features like Wrappers, Candy Jar, and The Snap.
• Communication: sending account emails (such as confirming your email address or resetting your password), Sweet Line waitlist emails, a payment alert each time you get paid on Taffy, and notices about changes to the Service or this policy. We use Resend as our email delivery provider.
• Safety and fraud prevention: detecting and preventing fraudulent transactions, abuse, and unauthorized access to accounts.
• Improvement: diagnosing errors and fixing bugs from our own server logs. We do not use behavioural or third-party analytics to do this.
• Legal compliance: fulfilling legal obligations, including tax reporting (e.g., 1099-K for qualifying transactions) and responding to lawful requests from government authorities.

4. Third-Party Service Providers

We share your information with the following trusted third-party service providers, solely to the extent necessary to operate the Service:

We do not sell, rent, or trade your personal information to any third party. We do not share your information with advertisers. Apart from the optional Google sign-in described above, we do not use Google Analytics, Google Fonts, Google-hosted CDN resources, or any Google advertising product.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account data: retained while your account is open. Closing your account takes effect immediately — there is no waiting period and no recovery window, so please export your data first if you want a copy. See "What closing your account actually does" below.
• Transaction records: retained for a minimum of 7 years to comply with tax reporting and financial record-keeping obligations (including IRS 1099-K requirements).
• Account closure records: when an account is closed we write a security record of the closure itself. It carries the date, the action taken, the handle and email address the request came from, the account's internal id, and, where we anonymized the account rather than erasing it, a count of how many payment records made that necessary — so we can answer questions about that account afterwards. It is kept separately from your account and is not on an automatic deletion schedule.
• Support communications: retained for 3 years after the last communication.

When data is no longer required, it is securely deleted or anonymized in accordance with industry best practices.

5.1 What closing your account actually does

You can close your account yourself from Settings > Privacy > Close your account. We act on it immediately. What happens next depends on what is attached to the account:

• A paid plan that can still be billed — we refuse to close the account. If you are on a Taffy plan that is still live — trialing, active, past due, unpaid, incomplete, or paused — we decline the request, tell you that the plan is what is blocking it, and leave your account exactly as it was. Cancel your plan in Settings > Billing first, then close your account. This is deliberate: closing an account permanently disables sign-in, and we will not lock you out of an account whose card is still being charged. A plan you have already canceled, or one that expired before it ever completed, cannot be billed again, so it does not stop us acting on your request — and on its own it is not what decides between the two outcomes below. That is decided by the payment records listed in the last bullet.
• No money records attached — your account is erased. If none of the things in the next bullet apply to you, your login and your profile are removed and cannot be restored, and the records that hang off your profile go with them: your pay page and its branding, your custom links, your social links, your saved wallet tags, and your notifications. If you joined the Sweet Line waitlist, closing your account also removes the entries we can tie to you — the email address and handle you claimed, your referral code and your referral score — along with the referral links attached to them. We match an entry two ways: by the link it carries to your account, and — once your sign-in email address has been confirmed — by an exact match on that address. So an entry you joined under a different address stays where it is, and if your sign-in address has not been confirmed, an entry that would only have matched on the address stays too, until you ask us to remove them. And anyone who signed up using your referral code keeps that code on their own entry, where it no longer resolves to anybody. Some records also sit outside your account by design and are not covered by the erasure at all — the closure record described above is one. If you want records like those removed as well, email support@heytaffy.com and we will look at what we are able to remove. One exception can send you down the other path instead: if some other account's record still points at yours — for example, someone scheduled a payment to you — the database refuses the erasure, and we anonymize your account exactly as described below rather than leave you stuck.
• Money records attached — your account is anonymized. Any one of these five means we cannot erase you: you have sent a payment; you have received a payment; an accounting ledger entry references your account; you created a Candy Jar, even one that never took a donation; or you donated to someone else's Candy Jar. We are required to keep those records for 7 years (see above) and they reference your account, so we anonymize it immediately instead: your handle is replaced with an anonymous one ("deleted-" followed by a short code); your display name, profile photo, and bio are cleared; your pay page is switched to private, its banner, logo, tagline and saved wallet tags are deleted, and its custom links and social links are taken off the page, so anyone who opens it sees a short "this page is private" notice instead of a page that identifies you or takes a payment; any Candy Jar you still have open is closed, so it stops taking contributions; and your sign-in is permanently disabled. The transaction and ledger records themselves remain, along with the email address on the disabled login and the billing identifiers needed to close out any subscription.

We do not hold your old handle for you. It is not reserved, and it may end up in use by another account — so treat a link containing it as no longer yours once your account is closed.

We do not offer a reactivation window, and anonymization cannot be reversed. If you have a question about which outcome applies to you, ask us before you close your account — see Section 12.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest.
• Row-level security (RLS) enabled on every table in our database, so who may read or write a record is decided by the database itself and not only by our application code.
• Secure password hashing via our authentication provider (Supabase Auth).
• Regular security assessments and vulnerability monitoring.
• Stripe-managed PCI DSS compliance for all payment card data.

While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Cookies

Taffy uses only essential cookies required for the Service to function. We do not use advertising cookies, analytics cookies, or third-party tracking cookies.

7.1 Essential Cookies

• Authentication cookies: session tokens issued by Supabase Auth to keep you signed in securely. In normal use these are the only cookies Taffy sets.
• Pre-launch access cookie: we keep the ability to put sign-in and sign-up behind a shared access code. While that is switched on, entering the code sets one cookie that remembers you did. It is off by default and sets nothing when it is off.

We do not set a separate anti-forgery cookie. Requests that change your account have to be POSTed and have to carry a valid session, which is what protects them.

7.2 Local Storage

We use browser local storage for things that belong to the device rather than to your account. That includes your light or dark theme choice and other display preferences, banners you have dismissed, your own referral code if you joined the Sweet Line, and a few features that are kept entirely on your device — a receipt you split with The Snap, or a shortcut you saved for paying someone, which can include that person's name, handle, and the amount you usually send them. All of it stays in your browser: it is not transmitted to our servers, it is not in your data export, and clearing your browser data removes it.

Settings that change what other people can see — such as whether your pay page is public — are account settings, not browser settings. They are stored with your profile on our servers so they apply on every device you sign in from.

You can manage cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

8.1 Rights for All Users

• Access: request a copy of the personal information we hold about you. You can download your data at any time through Settings > Privacy > Download your data.
• Correction: update or correct inaccurate personal information through your account settings.
• Deletion: close your account yourself from Settings > Privacy > Close your account. It takes effect immediately and cannot be undone. If you are on a paid plan that can still be billed, we decline the request until you cancel that plan in Settings > Billing. If your account has money records attached we anonymize it rather than erase it, because the underlying transaction records are retained for 7 years — Section 5.1 explains exactly what is removed, what stays, and what sits outside your account altogether. You can also write to support@heytaffy.com if you would rather we handle it.
• Data portability: export your profile and transaction data via the data download feature, either as a human-readable text file or as machine-readable JSON. A very large history is trimmed to the most recent records for payments, donations, and reactions; the file itself says so where that happens.

8.2 Additional Rights Under CCPA (California Residents)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act:

• Right to Know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: you may request that we delete personal information we have collected from you, subject to certain legal exceptions.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA rights.
• No Sale of Personal Information: we do not sell your personal information as defined under the CCPA. We do not share your personal information for cross-context behavioral advertising.

To exercise your CCPA rights, email support@heytaffy.com with the subject line "CCPA Request." We will verify your identity before processing your request and respond within 45 days.

8.3 Additional Rights Under GDPR (EEA, UK, and Swiss Residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following additional rights under the General Data Protection Regulation:

• Legal basis for processing: we process your personal data based on: (a) your consent (account creation); (b) performance of our contract with you (providing the Service); (c) our legitimate interests (fraud prevention, service improvement); and (d) legal obligations (tax reporting, financial regulations).
• Right to Restrict Processing: you may request that we restrict the processing of your data in certain circumstances.
• Right to Object: you may object to processing based on our legitimate interests.
• Right to Withdraw Consent: where processing is based on consent, you may withdraw consent at any time.
• Right to Lodge a Complaint: you have the right to file a complaint with your local data protection authority.

To exercise your GDPR rights, email support@heytaffy.com with the subject line "GDPR Request." We will respond within 30 days.

9. International Data Transfers

Taffy is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate. By using the Service, you consent to the transfer of your information to these countries, which may have different data protection laws than your country of residence. We take steps to ensure that your data is treated securely and in accordance with this Privacy Policy.

10. Children's Privacy

The Service is not directed to children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under the applicable minimum age, we will take steps to promptly delete that information. If you believe a child has provided us with personal information, please contact us at support@heytaffy.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@heytaffy.com
• Company: Taffy
• Website: heytaffy.com

For privacy-specific inquiries, use the subject line "Privacy Inquiry" to help us route your request to the appropriate team.