Privacy Policy
Last updated: 2026-08-30
Who we are
CamSpike ("CamSpike", "we", "us") operates this website as a live webcam discovery and affiliate-analytics product for adults 18+.
Controller identity: [TODO - legal entity name to be completed manually]. Registered address: [TODO - to be completed manually]. Contact: [TODO - a monitored privacy contact email to be completed manually - see also /legal/contact].
What we collect and why
We only collect what is described below - this section is based on an internal audit of the actual running system, not a generic template.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email + password (if you sign up) | Create and secure your account, so your watchlist/alerts persist | Contract (performing the service you asked for) |
| Watchlist (followed performers) | Show your followed rooms and sort them by relevance | Contract / legitimate interest |
| Alert rules and delivered alerts | Notify you in-app when a followed room goes live or nears a goal | Contract / legitimate interest |
| Anonymous visitor identifier (`camspike_vid` cookie) | Attribute an outbound affiliate click to a later conversion, even if you're not logged in | Legitimate interest (core function of an affiliate service) |
| Outbound click context (page, section, rank, viewers, goal state) | Measure which discovery surfaces drive genuine outbound interest, and attribute commission correctly | Legitimate interest |
| IP address (rate limiting only) | Detect and slow down automated/abusive sign-up or login attempts | Legitimate interest (security) |
| Analytics (if you consent): page views, device/browser class, referrer, navigation flow | Understand traffic and improve the product | Consent (Google Analytics only loads after you accept the Analytics cookie category) |
Authentication and accounts
Accounts are created and managed via Supabase Auth (email + password only - no third-party sign-in). Email confirmation is currently disabled, so an account is active immediately after sign-up.
Session cookies are managed by the Supabase client library and are strictly necessary for you to stay signed in; they are not used for tracking or advertising.
Favorites, watchlist and alerts
If you sign in, you can follow performers (stored as a row linking your account to that performer) and configure alert rules (e.g. "notify me when this room goes live"). This data is protected by database-level access rules so only you can read or change your own favorites and alerts.
Affiliate attribution and conversion tracking
When you click an outbound "Watch Live"-style link, CamSpike records the click (performer, platform, page/section, rank, viewer/goal state at the time, your anonymous visitor id or account, and a randomly generated tracking code) on our servers - this is a normal database record, not a browser cookie.
If the affiliate program later reports that the click led to a registration or purchase (a "postback"), CamSpike records that conversion and links it back to the original click via the tracking code, so far as the affiliate program's own postback data allows. CamSpike does not fabricate or guess at attribution when the tracking code is missing or unrecognized.
Analytics
CamSpike uses Google Analytics 4 to understand aggregate traffic (page views, sessions, referrers, device/browser class, navigation flow, and which discovery sections lead to an outbound click). This is only loaded and only begins collecting data after you explicitly accept the "Analytics" category in the cookie consent banner - see the Cookie Policy for the technical detail (cookie names, duration).
Analytics events never include your email, password, IP address as a stored field, or any free-text content (such as a room's live subject line).
Google Analytics is provided by Google, which acts as a data processor for this purpose; data is transferred to and processed by Google, including outside the EEA, under Google's own data processing terms.
Security and abuse prevention
Sign-up and sign-in requests are rate-limited by IP address to slow down automated abuse (e.g. mass account creation). The IP address is processed only for this purpose, keyed alongside a short time window, and is not linked to your profile or used for any other purpose.
Cookies and browser storage
See the dedicated Cookie Policy for the full, itemized list of cookies and browser storage CamSpike actually uses.
Processors / service providers
Supabase (database, authentication, and realtime delivery of in-app alerts).
Google (Google Analytics 4, only if you consent).
Hosting/CDN provider: [TODO - to be completed once a production hosting provider is finalized].
International data transfers
Where a processor above operates outside your country (e.g. Google's global infrastructure), personal data may be transferred internationally under that processor's own applicable safeguards (such as the EU Standard Contractual Clauses). CamSpike does not itself operate infrastructure outside its hosting provider's region(s).
Retention
Account data, favorites and alert rules are kept for as long as your account exists, and deleted if you request account deletion (see "Your rights" below).
Affiliate click/conversion records currently have no automatic deletion schedule implemented - retention criteria are under review. This will be updated here once a fixed retention period is defined.
Rate-limiting records are short-lived (on the order of a day) and are cleaned up automatically.
Your rights (GDPR / UK GDPR)
Subject to applicable law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your account and associated data; object to processing based on legitimate interest; withdraw consent for Analytics at any time (via the "Cookie settings" link in the footer) without affecting the lawfulness of processing before withdrawal; and lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, use the contact method on the Contact page. [TODO - a dedicated privacy/data-request contact email should be added once available.]
Children
CamSpike is intended exclusively for adults 18+ and is not directed at children. See the 18+ Only page and the separate age-gate confirmation (unrelated to cookie consent - see the Cookie Policy).
Changes to this policy
We will update the "Last updated" date above when this policy changes. Material changes that affect how Analytics consent is scoped will reset the stored consent version, so you will be asked again.