Privacy Policy

• We don’t sell personal data, show ads, or use advertising or analytics cookies.
• Counting views and clicks on a wall stores no IP address and sets no cookie, so those counts are not tied to anyone.
• If you sign up to a creator’s email list on their wall, that list is the creator’s. We hold it, confirm your address on their behalf and, if they connected Mailchimp or Kit, send your address there.
• You can download your data and delete your account in the studio (Studio → Account), or ask us by email.

Pomink is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS IN MEXICO] (“Pomink”, “we”, “us”). For most of the personal data described here we are the controller (in Mexico, the responsable): we decide why and how it is used.

Two exceptions, because someone else decides:

• Email sign-ups on a wall. The creator who owns the wall chose to collect them and decides what to do with them, so the creator is the controller and Pomink processes them on the creator’s behalf (a processor; in Mexico, an encargado). See Email sign-ups on walls.
• Payments on a wall. Tips and product sales are paid to the creator, through Stripe, on the creator’s own Stripe account. The creator is the seller. See Payments.

Privacy questions and requests: [PRIVACY CONTACT EMAIL]. They are handled by [PERSON OR DEPARTMENT THAT HANDLES DATA REQUESTS]. Our representative in the European Union: [EU REPRESENTATIVE, IF ONE IS REQUIRED].

If you have an account

• From Google or Facebook, when you sign in: your name, email address, the address of your profile picture and your account ID with that provider. The provider also gives us sign-in tokens (an access token and, from Google, an ID token, with their expiry and scope), which are stored with your account. We never see your password. More in Signing in with Google or Facebook.
• Your walls and what you put on them: handle, display name, bio, avatar, theme and layout, and every block — titles, links, text, schedules, prices, event venues and addresses, questions and answers — and the images you upload. Images are resized and converted to WebP, which also strips the location and camera details a photo can carry; we keep their dimensions, size and main colour. A wall is public unless you unpublish it.
• Your first wall. When you first open the studio we create a wall for you, named after the name on your sign-in account (or the part of your email address before the @), with a handle made from it, a sample link and an email sign-up block. It is public from the start: rename it, change the handle, remove the blocks or unpublish it in the studio.
• Themes: the themes you save. If you publish one to the gallery, its name and settings become public, with how many people have used it and which theme it was remixed from. The gallery shows no author, and image backgrounds are not shared.
• Custom domains: the domains you connect, the code that proves you own each one, the results of our checks, and its status with our hosting provider.
• Live and latest-post blocks: the channel or feed you link (for example a Twitch username or a YouTube channel ID) and the public information we read about it: whether it is live, the stream’s title, category, viewer count and start time, or the newest post’s title, link, date and image.
• Imports: the address of the page you import from and what we read on it — a name, a bio, links, a profile image and colours. See Anthropic for the AI suggestions.
• Plan and payments: your plan; your Stripe customer ID if you subscribe; your Stripe connected-account ID, and whether payouts are enabled, if you accept payments. Card and bank details are collected by Stripe, never by us.
• Email tool connections: if you connect Mailchimp or Kit to a wall, the API key you give us (stored encrypted; we only ever show its last characters), the audience, form or tag you chose, and how deliveries are going — for each subscriber sent, whether it arrived and, if your tool turned it down, why.
• Moderation: the notes we send you about a takedown or a suspension, the appeals you write and our replies, and our record of each decision (see How long we keep it).
• Your requests: account deletion requests (a random confirmation code, whether it came from the studio or from Facebook, its status and dates) and the emails you send us.

If you visit a wall

• Views and clicks. When a wall is viewed, and when a link on it is followed or an embedded player started, we record which wall and block, the time, the referring page your browser reported (the Referer header) and, where the creator is testing two titles, which one you saw. We store no IP address, cookie or device identifier with these records, so they cannot be tied to you or to each other.
• Tap positions. On walls whose owner is on the Studio plan, we record where on the wall you tap or click — a position relative to the wall, the block, and the time — so the owner can see which parts of their page get attention. Nothing that identifies you is stored with it, and nothing is recorded at all if your browser sends a Global Privacy Control signal.
• Abuse protection. To stop floods of requests we use your IP address, or a short hash of it, as a counter key. It is held only in server memory, is never written to our database, and is gone whenever the server restarts.
• Bot check on email forms. When the bot check is switched on, a wall with an email sign-up form loads Cloudflare Turnstile as soon as the page opens, whether or not you sign up. It runs in your browser, and Cloudflare receives your IP address and details about your browser and device, under its own privacy policy.
• Server logs. Our hosting provider processes request details — IP address, browser user agent, the address requested and the time — to deliver pages and keep them secure, and keeps logs for a limited time.
• Error reports. If a page fails in your browser, it sends us the error, the page’s address and your browser’s user-agent string. Email addresses and secrets are removed before anything is recorded.

If you sign up to a creator’s email list

• Your email address, the wall, when you signed up, when we emailed you and when you confirmed. Until you confirm, we also keep a one-way hash of the code in your confirmation link.
• A normalised copy of your address (without any +tag and, for Gmail, without dots), used only to limit how many confirmation emails one inbox can be sent.
• If the form has the bot check (see above), we send Cloudflare the check’s result token and your IP address when you submit, to verify it.
• If the creator connected Mailchimp or Kit: a record of sending your address there — when it was sent, whether it arrived and, if their tool turned it down, the reason.

If you pay a creator

You pay on a Stripe page, and Stripe collects your payment details. From Stripe we receive the email address you gave it, the amount and currency, what you paid for, the time and Stripe’s reference for the payment, and we show them to the creator you paid.

If you report a wall

The reason you pick, anything you write, the wall and the time. We don’t store who you are with the report: your IP address is used in server memory to limit how many reports can be sent, and is not saved with it. Like every request, sending the report passes through our hosting provider’s logs (see Server logs, above).

Sensitive data

We don’t ask for sensitive personal data (such as health, religion, political opinions, sexual orientation or ethnic origin), and nothing we collect is treated as sensitive. Please don’t publish anyone else’s sensitive data on a wall.

To provide Pomink (these purposes are necessary for the service):

1. Creating and running your account, and signing you in.
2. Hosting and publishing walls, themes and custom domains, with their share cards and QR codes.
3. Taking email sign-ups for creators, confirming them, and delivering them where the creator asked: their list in the studio, their export, their Mailchimp or Kit account.
4. Showing creators the analytics of their own walls.
5. Taking payments: plan subscriptions, and tips and sales paid to creators through Stripe Connect, recorded for the creator.
6. Importing a page you point us at, including AI suggestions when that feature is on.
7. Keeping Pomink safe: rate limits and bot checks, reviewing reports, moderation, appeals, and keeping a record of the decisions taken.
8. Finding and fixing errors.
9. Answering your messages and requests — including data exports and account deletions, whether you ask in the studio or through Facebook — and meeting our legal obligations.

One purpose that is not necessary, and that you can refuse: our homepage shows a few public walls as live examples of what Pomink can do — today, the oldest public walls on Pomink. If yours is shown and you would rather it were not, email [PRIVACY CONTACT EMAIL]. Saying no changes nothing else about your account.

We don’t use personal data for advertising, sell it, build profiles of visitors, or send marketing email. If that ever changes, this policy will say so first, with a way to refuse, and we will ask for consent where the law requires it. No decision with legal or similarly significant effects is made about you automatically: our abuse checks turn some requests away on their own (too many sign-ups from one place, for example), and moderation decisions are made by people.

Where the GDPR or a similar law applies, we rely on:

• Contract — your account, your walls and what you publish, custom domains, plans and payments, imports, and the integrations you set up.
• Legitimate interests — wall analytics and tap positions (helping creators understand their page, without IP addresses or cookies); security, rate limits, bot checks and error monitoring; reports, moderation, appeals and the record of decisions (keeping the platform safe and being able to account for what we decided); and the homepage showcase. You can object to any of these (see Your rights).
• Consent — joining a creator’s email list, which you confirm through the link we send. The creator relies on it; you can withdraw it at any time.
• Legal obligation — billing and tax records, carrying out the access and deletion requests the law gives you, and answering lawful requests from authorities.

Mexican law has no “legitimate interests” basis. For people in Mexico, the aviso de privacidad sets out which of these uses need your consent there and which do not.

Whether you have to give us data

No law requires you to give us personal data. To open an account you sign in with Google or Facebook, and we need the email address and account ID that gives us: without them we cannot create one. Everything else is up to you, and a feature that needs some data — a custom domain, payments, an email tool — works only once you provide it. Joining a creator’s list takes your email address; visiting a wall takes nothing beyond what every browser sends.

The email block on a wall collects addresses for that wall’s creator. The creator is responsible for the list; Pomink runs it for them.

• When you enter your address, we store it as pending and email you a link “on behalf of” the creator. You join the list only when you press the button on the page that link opens. The link works once and expires after 7 days; sign-ups that were never confirmed are deleted after that (the clean-up runs as people use sign-up forms, so it can take a little longer).
• One inbox is sent at most three confirmation emails a day across every wall, so the form cannot be used to flood someone with email.
• If we cannot send email at all (no email service configured), the form adds addresses directly, without the confirmation step.
• Once you have confirmed, the creator can see your address and when you joined, and download it. Unconfirmed addresses are never shown to them, only counted.
• If the creator connected Mailchimp or Kit, we send your address — and nothing else about you — to their account there, normally right after you confirm, and keep retrying for about a day if their tool does not answer. A creator who connects one later can choose to send everyone already on the list. We never resubscribe someone who unsubscribed in the creator’s tool. If the creator picked a Kit form that uses double opt-in, Kit may send you its own confirmation email.
• From then on, how the creator uses your address is up to them, under their own privacy notice and their agreement with their email provider.
• Pomink does not add you to any list of its own, does not send you newsletters, and puts no tracking pixels in its confirmation emails.
• To leave a list, use the unsubscribe link in the creator’s emails or contact the creator. If you cannot reach them, email [PRIVACY CONTACT EMAIL] and we will remove your address from the list kept on Pomink and let the creator know. Copies already in the creator’s own email tools are theirs to remove.

We receive your name, email address, the address of your profile picture and your account ID, and the sign-in tokens described above. We use them to create your account and sign you in, to show you which account and sign-in method you are using, to contact you about your account, and to name your first wall. We keep the address of your picture but do not show the picture anywhere on Pomink.

We never post on your behalf, read your contacts, friends or other data, or use what Google or Facebook send us for advertising. The tokens are stored with your account but not used after you sign in, and they are deleted with it — or, for Facebook, when you ask Facebook to delete your data. Pomink’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect Pomink in your Google Account (third-party connections) or in Facebook’s settings (Apps and websites). That stops you signing in with it; to remove your data from Pomink, delete your account. If you also ask Facebook to delete your data, Facebook tells us, and we act on it as described there.

• Plans. Subscriptions are billed by Stripe. We give Stripe your email address and your Pomink account ID; Stripe collects your card details and tells us your plan’s status. Invoices are in Stripe’s billing portal.
• Getting paid as a creator. We open a Stripe connected account for you with your email address and Pomink account ID, and Stripe collects the identity and bank details it needs, under Stripe’s privacy policy. We keep the account’s ID and whether payouts are enabled.
• Paying a creator. Your payment goes to the creator’s Stripe account, minus Pomink’s fee. We record the order as described above and show it to the creator. Stripe’s privacy policy covers your payment details.

Only as described here. We don’t sell personal data or share it for cross-context behavioural advertising.

Service providers

Companies that run parts of Pomink for us, under contracts that limit what they can do with the data:

• Vercel (a US company) — hosting, servers, content delivery and logs. The custom domains creators connect are registered with Vercel so it can serve them.
• Neon (a US company) — our database.
• Cloudflare (a US company, with a worldwide network) — storage and delivery of uploaded images, and the Turnstile bot check on walls’ email forms.
• Stripe — plan billing and payment processing.
• Resend or Postmark (US companies) — sending confirmation emails: the recipient’s address and the message.
• Anthropic (a US company) — only when AI import suggestions are on: the text of the page being imported (up to 4,000 characters), its bio and the titles of the links found on it. Never link addresses, your email or your account details.
• [ERROR MONITORING PROVIDER, IF ANY] — error reports, with email addresses and secrets removed.

Platforms we read public information from

Twitch, YouTube (Google) and Kick, to look up the channels creators add to live blocks and to be told when they go live; those requests carry the channel’s name or ID, nothing about visitors. Our servers also fetch the feeds creators link and the pages they import.

Others

• Google and Meta (Facebook) see that you sign in to Pomink with them.
• Mailchimp or Kit, when a creator connects one: confirmed subscribers’ email addresses — nothing else about them — go to the creator’s own account there, sent with the API key the creator gave us, under the creator’s agreement with that company.
• Creators see the sign-ups, orders and analytics of their own walls — analytics as counts, referring sites and tap maps, not as individual visitors.
• Everyone can see what is published on walls and in the theme gallery. Public walls are listed in our sitemap and can appear in search engines; unpublishing a wall takes it out.
• Content from other sites on walls. When a wall shows a video’s preview image or a latest-post picture, your browser loads it from the site it belongs to. When you press play on an embedded player (YouTube, Vimeo, Spotify, SoundCloud, TikTok, Twitch, Apple Music), the player loads from its provider and may set its own cookies. Those sites receive your IP address and browser details, under their own privacy policies.
• Authorities and courts, when a law, a court order or a reasoned order from a competent authority requires it, or when we need it to establish, exercise or defend a legal claim.
• A buyer of Pomink, if the business is ever sold or merged: the data would pass to the new owner, bound by this policy. We would tell you before it happens, and ask for your consent where the law requires it.

Where our servers and database run is under International transfers.

Pomink is run from Mexico, and most of our providers store and process data in the United States: our servers and database run in [WHERE OUR SERVERS AND DATABASE RUN, e.g. the United States (US East)], and Cloudflare works worldwide. Wherever you are, your data will be processed in countries whose laws may differ from yours.

For data from the European Economic Area, the United Kingdom or Switzerland we rely on [TRANSFER SAFEGUARDS: standard contractual clauses and/or the EU-US Data Privacy Framework, per provider]; you can ask us for a copy of them at [PRIVACY CONTACT EMAIL]. Under Mexican law, sending data to the providers who process it for us does not require your consent, and today we make no transfers that do. If one ever becomes necessary — a sale of the business, for example — we will ask for your consent first.

• Your account and your walls, with their analytics and orders: while your account exists. A wall can be unpublished at any time, but it is deleted with the account. Analytics records have no automatic expiry today; the studio shows the last 7 or 90 days, depending on your plan, and your data export has the all-time totals.
• Blocks, uploaded images, themes and custom domains: until you delete them, or your account.
• Images nothing uses any more: deleted by a weekly clean-up, never sooner than a day after upload. Images withheld by a moderation decision are kept until a person decides otherwise, even if the wall stops using them.
• Unconfirmed email sign-ups: deleted once their 7-day link has expired. The clean-up runs as people use sign-up forms on Pomink, so it can take a little longer.
• Confirmed subscribers: until the creator deletes their account, or we remove an address at its owner’s request (see Email sign-ups). The record of sending one to Mailchimp or Kit is deleted with it, or earlier if the creator disconnects that tool.
• Mailchimp and Kit connections, with their API keys: until the creator disconnects them or deletes their account.
• Custom domains never verified: released after 14 days.
• Reports: until the reported wall is deleted, which happens when its owner deletes their account.
• Live status of linked channels: public information about a Twitch, YouTube or Kick channel (whether it is live, the stream’s title, category and viewer count), kept as a cache for that channel rather than for any account.
• Moderation records: kept after the account they concern is deleted, currently without an end date, because they are how we account for decisions and deal with appeals, repeated abuse and legal requests. They name the wall’s handle, or the account’s email address, as it was at the time.
• Deletion requests: the confirmation code, where the request came from, its status and dates are kept, no longer linked to you, so the status page keeps answering.
• Rate-limit counters: server memory only, gone on restart.
• Server logs and error reports: for the time our hosting and error-monitoring providers keep them.
• Backups: deleted data can remain in our database provider’s backups for [BACKUP RETENTION PERIOD].
• Stripe keeps its own records of subscriptions and payments, under its legal obligations.

• In the studio: Studio → Account → Delete your account, then type your account’s email address to confirm. Your walls go offline at once, you are signed out, and you get a confirmation code and a status page at pomink.com/deletion/<code>. Most deletions finish within minutes; a large account can take a few hours. Download your data first if you want a copy: once a deletion has started, the account can no longer be exported or signed in to.
• From Facebook: if you signed in with Facebook, remove Pomink in Facebook’s settings (Apps and websites) and ask for your data to be deleted. Facebook passes the request to us and shows you a confirmation code and the status link. If Facebook is your only way of signing in to Pomink, we delete your whole account, as above. If you also sign in with Google, we remove the Facebook connection and its sign-in tokens — and your name and profile picture, if they came from Facebook — and the rest of your account stays open; delete it from the studio if you want it gone too.
• By email: write to [PRIVACY CONTACT EMAIL] from the address on your account.

Deleting your account deletes it and everything attached to it: your sign-in connections and their tokens; your walls and blocks; your uploaded images, including copies withheld by a moderation decision, which are also cleared from our content delivery network; your themes, which leave the gallery at once; your custom domains, which are removed from our hosting provider; your analytics; your email lists, confirmed and unconfirmed, with their Mailchimp and Kit connections and delivery records; your orders; your appeals and the reports about your walls. Your customer record at Stripe is deleted too, which cancels any paid plan straight away.

What stays:

• our moderation records about your walls or account (see retention);
• the deletion request’s code, where it came from, its status and dates, no longer linked to you;
• Stripe’s own records of your subscription payments and invoices, and your Stripe connected account if you set up payouts — its balance is yours, and you close it with Stripe;
• copies of your published themes that other people made before you left — those are theirs;
• subscribers already sent to your own Mailchimp or Kit account;
• server logs, error reports and backups, until they expire.

Once the deletion is done, your handles are free for anyone to claim.

Depending on where you live, you can ask to access your personal data, correct it, delete it, object to or restrict how we use it, take a copy with you, and withdraw any consent you gave. Mexican law calls the first four your ARCO rights (access, rectification, cancellation and opposition).

• In the studio: edit your walls and profile; download your subscribers and analytics as CSV files; delete your account; and download your data (Studio → Account) — one JSON file with your account and sign-in methods, walls, blocks, themes, links to your images, custom domains, email tool connections, confirmed subscribers, orders, all-time analytics totals, and the moderation decisions, appeals and reports about your walls. It leaves out sign-in tokens and API keys, which are credentials; individual visits, which are records about your visitors; and who made a moderation decision, our internal notes on it and what reporters wrote, which concern other people. If you need something the file does not have, ask us by email.
• By email: [PRIVACY CONTACT EMAIL]. Tell us who you are and what you are asking for. We may ask you to show that the account is yours — usually by writing from its email address — before we act.

We answer within the time the law sets: 20 business days in Mexico, one month under the GDPR, 45 days under California law, extended only where the law allows and with an explanation. Using your rights is free.

• Mexico: the procedure, requirements and deadlines are in the Aviso de privacidad. If you disagree with our answer, you can go to the Secretaría Anticorrupción y Buen Gobierno, the federal authority for data protection.
• European Union, United Kingdom and Switzerland: you can also ask for a copy in a portable format, object to processing based on our legitimate interests, and complain to your data protection authority.
• California and other US states: you can ask what we collect and why, and to delete or correct it, yourself or through an authorised agent, and we will not treat you differently for it. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer anything about you. The tap heatmap honours the Global Privacy Control signal.
• Subscribers of a creator’s list: the creator is responsible for the list, so we pass your request to them and help them answer it, or act on it ourselves where they cannot.

Pomink sets only the cookies signing in needs, only once you start signing in, and only on our own domain — never on a creator’s custom domain. We use no analytics or advertising cookies, and our pages store nothing else on your device.

• __Secure-authjs.session-token — keeps you signed in; its contents are encrypted. 30 days.
• __Host-authjs.csrf-token — protects sign-in from cross-site request forgery. Until you close your browser.
• __Secure-authjs.callback-url — where to take you after signing in. Until you close your browser.
• __Secure-authjs.pkce.code_verifier — a one-time check on the way back from Google or Facebook. 15 minutes.

Other companies’ cookies can be set when you use their services through Pomink: Google’s or Facebook’s sign-in pages, Stripe’s payment pages, Cloudflare’s bot check (which loads with a wall’s email form when it is switched on), and embedded players once you press play. Their own policies apply.

You can block or delete cookies in your browser’s settings. Blocking ours stops signing in from working; nothing else on Pomink needs them.

Pomink is served only over HTTPS. You sign in through Google or Facebook, so we hold no passwords; session cookies are encrypted and unreadable by page scripts; confirmation links are stored only as one-way hashes; API keys for email tools are encrypted (AES-256-GCM) with a key kept in our server configuration, not in the database, and never sent back to the browser; moderation tools are open only to named staff; images withheld after a takedown are moved out of public storage; deletion status pages show a request’s status and nothing about the account; error reports are scrubbed of email addresses and secrets; and public forms are protected by rate limits and bot checks.

No system is perfectly secure. If a breach significantly affects your rights, we will tell you promptly, and the authorities where the law requires it.

Pomink is not meant for children. You must be at least [MINIMUM AGE] years old to open an account, and an adult to buy a plan or accept payments. We don’t knowingly collect personal data from children under 13, or under the age your country sets; if you think a child has given us some, email [PRIVACY CONTACT EMAIL] and we will delete it.

We will post every change here and update the effective date. If a change is significant, we will tell account holders in the studio or by email before it takes effect, and ask for consent where the law requires it.

[LEGAL ENTITY NAME], [REGISTERED ADDRESS IN MEXICO]. Privacy requests: [PRIVACY CONTACT EMAIL], handled by [PERSON OR DEPARTMENT THAT HANDLES DATA REQUESTS]. Everything else: [SUPPORT CONTACT EMAIL].