Privacy

Who this is about

Spilr operates this service and decides how the data described here is used.

For anything in this policy — a copy of your data, a correction, a deletion, or a complaint — email [email protected].

If you are sending a message

You do not have an account and we do not ask you to make one. There is nothing to log into and no profile of you being assembled.

We collect an email address only when you tip, and only to send the receipt and the creator’s response if one arrives. It is not shown to the creator and it is not used for marketing.

Your message is delivered to the creator without a name attached, unless you add one. That is the product working as intended, not a gap in our records.

The creator does see roughly where your message came from: a country, and where our network can work one out, a city and region — plus a timezone, the language your browser asks for, and which browser and operating system you used. All of it is worked out from the connection itself. We do not ask you for any of it, we load no tracking script on the page, and your IP address is never stored or shown. These details stay with the message for as long as the creator keeps it.

What we collect

• From creators: the account details you give us, your profile, what you publish, and what the payment provider needs to pay you.
• From people sending messages: the message itself, and an email address if you pay.
• From everyone: basic technical data a web server necessarily sees, such as an IP address and a browser identifier, kept for security and abuse prevention. From this we work out a rough location — a country, and where possible a city, region and timezone — the language your browser asks for, and your browser and operating system. Those are stored with the message and shown to the creator you sent it to; the IP address itself is not stored.
• Payment details are never collected by us. They go directly to the payment provider; we see the result of a payment, not the card.

Why we are allowed to hold it

Where the GDPR or a comparable law applies, our lawful bases are: performing the contract with you, for the parts needed to run an account and process a payment; our legitimate interests, for security, abuse prevention and keeping the service working; and legal obligation, for tax records and for reporting child sexual abuse material.

Where we rely on consent, you can withdraw it at any time and it does not affect what was done before.

Who else sees it

• Our payment providers, which hold funds and pay creators.
• Apple and Google, for subscriptions bought in their stores.
• Infrastructure and delivery providers: hosting, our content delivery network, and the service that sends receipt emails.
• A content moderation provider, which screens messages before delivery.
• Authorities, where a valid legal request requires it, and the National Center for Missing & Exploited Children where the law requires a report.

We do not sell personal data, and we do not share it for advertising.

How it is kept

Data is encrypted in transit and where we store it. Access inside Spilr is limited to the people who need it for their job — support, engineering, and the finance work of paying creators — and everyone with it is under a confidentiality obligation.

Quarantined messages are the strictest case: nobody reaches them through the product, including us, except through the reporting process the law requires.

No system is perfect. If there is ever a breach that puts you at risk, we will tell you and the relevant authority within the time the law sets, and we will say what happened rather than what it resembled.

Numbers, not people

We count things: how many messages a page received, how many were replied to, how much was paid. A creator sees their own figures and can publish them, and we may publish totals across the whole service.

Those are counts. They do not identify the person who sent a message, and a creator cannot work backwards from them to one.

Advertising

There are no ads on Spilr, and we do not sell or share personal data for anyone else to advertise with.

There is no advertising or tracking cookie on this site, which is why there is no banner asking you to accept one. If that ever changes, this page changes first and we say so before it takes effect.

How long we keep it

Account and published content: while the account is open, and for a period afterwards where we need it to settle payments or meet a legal obligation.

Payment records: as long as tax and financial rules require, which is longer than you might expect and is not our choice.

Messages that were blocked: preserved in sealed quarantine where the law requires it, and reachable by nobody through the product.

Technical logs: a short period, for security and abuse prevention.

Sender details shown beside a message — rough location, language, browser: for as long as the creator keeps that message.

Your rights

Depending on where you live, you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to some uses, or ask us to restrict them. These rights exist under the GDPR and UK GDPR, Indonesia’s Personal Data Protection Law, Brazil’s LGPD, Japan’s APPI and comparable laws elsewhere.

Email [email protected]. We will ask you to confirm you control the account or email address in question — an unverified deletion request is a way to erase somebody else.

Deleting an account has consequences worth reading before you ask for it; the next section sets them out.

We aim to respond within 30 days. You also have the right to complain to your local data protection authority.

Deleting your account

A creator can close their account by emailing [email protected]. We pay out a balance you are owed first — closing an account never forfeits money that is yours.

One thing does not go with it: records we are required to keep for tax and financial rules stay for as long as those rules say.

If you subscribed through the App Store or Google Play, deleting your Spilr account does not cancel the subscription — the store holds that, so cancel it there or it keeps renewing. We cannot cancel it for you.

If the company changes hands

If Spilr is bought, merges, or its assets are sold, the data described here moves with the service. Whoever ends up running it is bound by this policy, or has to tell you before anything about it changes.

If Spilr shuts down instead, we give creators notice, pay out balances, and delete what we are not required to keep.

Where your data goes

Our providers operate internationally, so data may be processed outside the country you are in — including in the United States and in Indonesia.

Where we transfer data out of the EEA or the UK we rely on the safeguards the law provides for it, such as standard contractual clauses.

Children

Spilr is for people 18 and over, and it is not directed at children.

If we learn we hold data about someone under 18, we delete it and close any account involved. If you believe a child is using Spilr, email [email protected].

Cookies

We use a small number of cookies and none of them track you across other sites.

One remembers the language you chose, so that a page you share opens in the language it should. Others keep you signed in if you are a creator.

There is no advertising cookie on Spilr, which is why there is no banner asking you to accept one.

Changes

We update this policy as the product changes. The date at the top is the date of the current version, and we will tell creators by email before a material change takes effect.

Contact

Email [email protected] for anything in this policy, including data requests and complaints.