Privacy Policy

1. Who we are

Poor Decisions (“we”, “us”) provides the Service at poordecisions.money. Contact: hello@poordecisions.money

For UK GDPR, we are the controller of personal data described in this policy, except where a provider (such as Stripe) acts as an independent controller of payment-card data.

2. What we collect

• Visitor ID — a random identifier in your browser (local storage) so we can keep your site credit and session.
• Payment / transaction data — amount, status, and Stripe identifiers. We do not receive or store your full card number.
• Service usage — credit balance, spend events in the experience, communal tally, and approximate online presence.
• Technical logs — IP address, browser/user-agent, timestamps, and error logs for security and reliability.
• Contact data — if you email us, the content of that correspondence.

Thoughts typed into the burn box are intended to stay in your browser for animation. Do not enter sensitive personal data there.

3. Why we use it (lawful bases)

• Contract — to provide digital credit and the entertainment Service you request.
• Legitimate interests — security, fraud prevention, service analytics, communal tallies, and improving reliability, balanced against your rights.
• Legal obligation — accounting, tax, and responding to lawful requests.

4. Payments

Card payments are processed by Stripe. Stripe’s privacy notice covers how it handles cardholder data. We use payment results only to credit your account and operate the Service.

5. Cookies and similar tech

We use browser local storage for your visitor ID and local prototype state. Stripe checkout may set cookies needed to process payment securely. We do not run third-party advertising trackers on the main experience.

6. Sharing

We do not sell your personal data. We share information only with:

• processors needed to run the Service (for example Stripe and our hosting provider, currently Vercel);
• professional advisers; and
• authorities when required by law or to protect our legal rights, users, or the public.

7. Retention

We keep payment and credit records as long as needed to operate the Service and meet legal/accounting duties. Browser-side IDs last until you clear site data. Logs are kept for a limited operational period unless needed longer for security or disputes.

8. International transfers

Providers may process data outside the UK/EEA. Where they do, they typically use appropriate safeguards (such as standard contractual clauses) described in their policies.

9. Your rights

Under UK GDPR you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability. You may also complain to the ICO.

Email hello@poordecisions.money to exercise rights. We may need to verify your request.

10. Children

The Service is for adults aged 18+. We do not knowingly collect children’s data. If you believe a child has used the Service, contact us and we will take appropriate steps.

11. Security

We use reasonable technical and organisational measures appropriate to a small web Service. No method of transmission or storage is perfectly secure.

12. Changes

We may update this policy. The “Last updated” date will change when we do. Material changes may also be signposted on the site.