Privacy Policy.

01 What we collect

Information you give us

When you create an account: email address, display name, handle. When you fill in your profile: bio, avatar, banner, profile song, friends list. When you post: the text and any image or GIF you choose to share. When you message someone: the contents of those DMs.

When you subscribe to Plus: payment information is collected by Stripe, not by us. We see only your billing email, country, and last four digits of your card.

Information we collect automatically

When you use the Service, we collect:

• Usage data: which pages you view, what actions you take, when you logged in last.
• Device info: browser type, operating system, screen size — used to render the site correctly.
• IP address: stored briefly (max 30 days), used for security and abuse prevention. We hash IPs in logs longer than 7 days.

What we deliberately don't collect

• We don't fingerprint your browser across sites.
• We don't read your contacts.
• We don't track your location.
• We don't use third-party advertising cookies or pixels.

02 How we use it

We use the information above to:

• Provide the Service — show your profile to friends, deliver DMs, render your feed, process Plus subscriptions.
• Prevent abuse — detect spam, scan images for child sexual abuse material (as required by U.S. federal law), and enforce our Community Guidelines.
• Communicate with you — send confirmation emails, notify you about replies and friend requests, and (if you opt in) send a periodic digest. We never send ads.
• Improve the product — understand which features people use and where they get stuck. We use aggregated, non-identifying analytics for this.
• Comply with law — respond to legal requests (subpoenas, warrants) when we're required to.

03 Who we share with

We share data only with service providers we use to run B-side, and only what they need to do their job:

We do not sell or rent your personal information to anyone. We don't share it with advertisers or data brokers. We don't share it with anyone for marketing.

If we're ever required to disclose data in response to a legal process (subpoena, court order), we'll tell you unless we're legally prohibited from doing so. We publish an annual transparency report once we have anything meaningful to report.

04 Cookies & tracking

We use a minimal set of cookies to keep you signed in and remember your preferences. We do not use third-party advertising cookies. We do not use cross-site tracking pixels.

Our analytics provider, Cloudflare Web Analytics, is cookieless and does not track individuals across sites. We do not honor "Do Not Track" headers explicitly because our default behavior already matches what they request.

05 Your rights

Regardless of where you live, you have the right to:

• Access — see what we have. Self-serve from your settings, or email us.
• Export — download everything as a portable archive. Self-serve from your settings.
• Correct — update inaccurate information about you.
• Delete — delete your account and all associated data. Self-serve, immediate.
• Opt out — of any non-essential emails. Plus subscribers can still get billing emails (those are required).

If you're in California: you have the rights described above under the California Consumer Privacy Act (CCPA). We do not sell or share your personal information for cross-context behavioral advertising; there is no "Do Not Sell" because there's nothing to opt out of.

If you're in the EU/EEA or UK: see §9 below.

To exercise any right, email privacy@bside.social. We respond within 30 days.

06 How we keep it safe

We encrypt data in transit using TLS 1.2+. We encrypt sensitive data at rest, including third-party music tokens and your media files. We use industry-standard practices for authentication, access control, and incident response.

We are a small team. We do not have a fully staffed security operation. If you discover a vulnerability, please report it responsibly to security@bside.social. We do not yet offer a paid bug bounty but we will credit you publicly if you'd like.

In the event of a data breach affecting your information, we'll notify you and any regulators required by law as quickly as we can — typically within 72 hours of confirming it.

07 How long we keep it

• Account data: while your account is active. Deletion is immediate; backups are wiped within 30 days.
• Posts, messages, profile content: as long as you want them up. Removed on deletion.
• Server logs (with IP): 7 days raw, 30 days hashed.
• Billing records: 7 years, as required by tax/accounting law.
• Safety records (reports, moderation decisions): retained as needed to detect repeat violations; typically 2 years.

08 Children

B-side is strictly 18+. We do not knowingly collect any information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete their account and data immediately.

If you believe a B-side user is under 18, please report it to safety@bside.social.

09 International users

B-side is operated from the United States. If you're outside the U.S., your data will be transferred to and stored in the U.S. By using the Service, you consent to that transfer.

If you're in the EU/EEA or UK: you have rights under the General Data Protection Regulation (GDPR), including the rights described in §5 above plus the right to lodge a complaint with your supervisory authority. The legal basis for our processing is contract performance (running the Service for you), legal obligation (CSAM scanning, tax records), and legitimate interest (preventing abuse, improving the product).

10 Changes & contact

We may update this Policy from time to time. If we make material changes, we'll notify you by email and post the updated Policy here at least 14 days before it takes effect.

Questions, requests, anything else:
privacy@bside.social — privacy team
hello@bside.social — everything else

Mailing address: B-side Social LLC, 239 Auburn View Road, Rock Hill, SC 29730