Privacy Policy

Privacy isn't an afterthought at Obsydian — it's the product. This policy explains what personal data Obsydian ("Obsydian", "we", "us") collects when you use obsydian.vip, why we collect it, who we share it with, and the rights you have under UK data protection law.

1. The short version

• We collect account, profile, content and usage data — no more than we need.
• We never sell your personal data.
• We strip EXIF/GPS metadata from images you process, by default.
• On-device video scrubbing happens entirely in your browser; the file is never uploaded to us.
• You can access, correct, export or delete your data — see section 10.

2. Who is responsible for your data

Obsydianis the "controller" of your personal data for the purposes of UK GDPR. For any privacy question, email support@obsydian.vip.

3. What we collect

Information you give us

• Account data — your email, username/handle, and authentication details, handled by our authentication provider.
• Profile & page data — your display name, bio, links, theme choices and anything else you add to your public page.
• Content you upload — images and other media you process, watermark or store with us.
• Billing data — if you subscribe, our payment processor handles your card details; we receive only limited billing information (such as plan, status and the last four digits), not your full card number.
• Communications — messages you send us for support.
• Abuse reports — if you report a page (at obsydian.vip/report), we collect the reason, your description, the page reported, and — only if you choose to give it — your email. We use this solely to review and act on the report and to follow up with you; providing your email is optional and you can report anonymously.

Information we collect automatically

• Usage & device data — IP address, browser/device type, and how you interact with the Service, used to keep it secure and working.
• Page analytics — aggregate views and link clicks on your public page, which power the analytics we show creators.

Some content you upload may be sensitive. If you upload intimate imagery, that may be treated as special category data under UK GDPR; we process it only to provide the Service to you and protect it accordingly.

4. Why we use it, and our legal bases

• To provide the Service (host your page, process and watermark your media, run your account) — legal basis: performance of our contract with you.
• To keep the Service secure and prevent abuse — legal basis: our legitimate interests in running a safe platform.
• To handle billing — legal basis: performance of our contract and compliance with legal obligations (e.g. tax records).
• To show you analytics and improve the product — legal basis: legitimate interests.
• For sensitive (special category) content — legal basis: your explicit consent, given when you choose to upload it, and/or that you have made it manifestly public.
• For marketing emails, where applicable — legal basis: consent, which you can withdraw at any time.

5. On-device processing

Some of our tools run entirely in your browser, on your device. Video metadata scrubbing is the main example: the video file is processed locally and never uploaded to our servers. We don't receive, store or have access to files processed this way. Likewise, EXIF/GPS data we strip from images isn't retained by us after processing.

6. The Media Vault

If you use the Media Vault (an optional feature, currently in closed beta), we store the media you add to it, together with an ownership record for each file: the date and time we received it, a cryptographic hash of the stored bytes, and any capture metadata (such as an EXIF date or device) we read at the point of upload. The stored file itself is scrubbed of that metadata; we keep the reading separately as supporting detail.

Who can see it.Vault files are private to you. They are served only through authenticated, owner-only links — we don't publish or expose public URLs for them. The Vault is not "zero-knowledge": we retain the technical ability to access your stored files in order to run and secure the Service, comply with the law, and enforce our Terms. We access them only for those purposes.

Legal basis. We process Vault content to provide the storage service to you (performance of our contract) and to keep it secure (legitimate interests). Where the content is intimate and therefore special category data, we rely on your explicit consent, given when you choose to store it. You can delete any file, or your whole Vault, at any time — see sections 9 and 11.

7. Who we share it with

We do not sellyour personal data. We share it only with service providers ("sub-processors") who help us run the Service, under contracts that require them to protect it, and with authorities where the law requires.

Our current sub-processors include:

• Clerk — authentication and account management.
• Vercel — website hosting and infrastructure.
• TODO — database hosting (e.g. Neon / Railway — to confirm at deploy).
• Cloudflare R2 — file / media storage.
• Stripe — payment processing.
• TODO — transactional email (provider to confirm).

We may also disclose data to comply with a legal obligation, enforce our Terms, or protect the rights and safety of our users and the public.

8. International transfers

Some of our providers may process data outside the UK. Where they do, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision — to keep your data protected to UK standards.

9. How long we keep it

We keep your personal data for as long as your account is active, and then only as long as we need it — for example, to comply with legal, tax or accounting obligations, or to resolve disputes. When you delete content or your account, we delete or anonymise the associated personal data within a reasonable period, except for limited copies in secure backups, which are overwritten on our normal backup cycle.

10. How we protect it

We use technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and access controls. No system is perfectly secure, but protecting your content is the core of what we do. A dedicated security page will follow with the launch of our media vault.

11. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data ("right to be forgotten");
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time, where we rely on consent.

To exercise any of these, email support@obsydian.vip. We'll respond within the timeframes the law requires (usually one month).

12. Cookies

We use cookies and similar technologies that are strictly necessary to run the Service — for example, to keep you signed in. If we add any non-essential or analytics cookies, we'll ask for your consent first and update this section.

13. Children

Obsydian is intended for users aged 18 and over. The Service is not directed at anyone under 18, and we do not knowingly collect data from anyone under 18. If we learn we have, we will delete it.

14. Changes to this policy

We may update this policy from time to time. If we make material changes we'll let you know by email or an in-app notice. The "last updated" date at the top always reflects the current version.