Privacy Policy

1. Introduction

Welcome to VastCurrent, a trust-first social platform operated by Alcin Technologies LLC ("we," "us," or "our"). We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains what information we collect when you use VastCurrent at vastcurrent.com, how we use it, and what rights you have in relation to it. Please read this carefully. If you disagree with any part of this policy, please discontinue use of our platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect the following:

• Email address — used for authentication and account communications.
• Username — a unique public handle you choose (e.g. @yourname).
• Display name — the name shown on your profile and posts.
• Password — stored as a secure hash; we never store it in plain text.
• Bio — an optional short description on your public profile.
• Website URL — an optional link you may add to your profile.
• Location — an optional country code (e.g. "US") you may provide.
• Avatar image — an optional profile photo you upload.

2.2 OAuth Sign-In Data

If you choose to sign in using Google, GitHub, or Facebook, we receive basic profile information from those providers (such as your name and email address) solely to create or link your VastCurrent account. We do not receive your social media passwords or access to post on your behalf on those platforms.

2.3 Content You Create

We store content you actively submit to the platform, including:

• Posts ("Currents") and replies you publish.
• Likes, follows, and reposts you perform.
• Reports you submit about other users or content.
• Direct interactions such as @mentions.

2.4 Automatically Collected Data

When you use VastCurrent, we and our service providers may automatically collect certain technical information, including:

• IP address and general geographic region.
• Browser type and device information.
• Pages visited, features used, and timestamps of activity.
• Referral URLs and session duration.

2.5 Bot Verification

During registration, we use Cloudflare Turnstile to verify you are a human. This process may collect device and browser signals. You can review Cloudflare's privacy practices at cloudflare.com/privacypolicy.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate your identity.
• Deliver the platform's core features — posting, replying, following, and notifications.
• Calculate your Trust Score — a transparency-first metric that reflects your account's standing. Trust Score tiers (New, Member, Trusted) are visible to other users as part of VastCurrent's commitment to authentic conversations.
• Detect and prevent spam, bots, and abuse.
• Respond to reports and enforce our Community Guidelines.
• Send transactional emails (e.g., email verification, password reset).
• Improve and maintain the platform's performance and security.
• Comply with legal obligations.

We do not sell your personal data. We do not use your data to serve third-party advertisements.

4. How We Share Your Information

4.1 Public Information

VastCurrent is a public social platform. The following profile and activity data is publicly visible to any visitor:

• Username, display name, bio, avatar, and website URL.
• Posts, replies, and reposts you publish.
• Your follower count, following count, and Trust Score tier.

Your email address, password, IP address, and OAuth tokens are never publicly visible.

4.2 Service Providers

We share data with trusted third-party providers who help us operate VastCurrent:

• Supabase — database, authentication, and file storage. Data is stored on infrastructure hosted in their cloud environment.
• Cloudflare — bot verification via Turnstile.
• Google, GitHub, Facebook — OAuth identity providers, only when you choose to sign in with them.

All providers are contractually obligated to use your data only for the purpose of providing their services to us.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Trust Score & Moderation

VastCurrent's Trust Score is a key platform feature designed to promote authentic conversations. It is calculated based on account age, activity patterns, verification status, and community signals. Trust Score tiers are:

• New — accounts below a score threshold, typically recently created.
• Member — established accounts in good standing.
• Trusted — accounts with consistently positive community signals.

If your account is found to violate our Community Guidelines, we may apply moderation actions including warnings, shadow limiting (your posts remain visible to you but are suppressed in others' feeds), or account suspension. Suspension reasons are communicated to you and are not publicly disclosed.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal, compliance, or fraud prevention purposes.

Content you have posted (posts, replies) may be anonymised or removed as part of account deletion. Aggregated, anonymised analytics data that cannot identify you may be retained indefinitely.

7. Data Deletion

You may delete your VastCurrent account at any time from Settings → Danger Zone → Delete Account within the app. Account deletion permanently removes your profile, posts, and associated personal data.

If you signed in using Facebook and wish to request deletion of the data we received through that connection, you may do so by emailing us at hello@vastcurrent.com with the subject line "Data Deletion Request." We will process your request within 30 days and confirm by email when complete.

8. Your Privacy Rights

8.1 All Users

Regardless of where you are located, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data directly within the app (Settings → Profile).
• Delete your account and associated data (Settings → Danger Zone).
• Withdraw consent where processing is based on consent.

8.2 EU / UK Users (GDPR & UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) and UK GDPR, including:

• Right to portability — receive your data in a structured, machine-readable format.
• Right to restrict processing — request that we limit how we use your data.
• Right to object — object to processing based on legitimate interests.
• Right to lodge a complaint — with your local data protection authority.

Our legal bases for processing your personal data include: performance of a contract (providing the platform services), legitimate interests (security, fraud prevention, platform improvement), and consent (optional features and communications).

8.3 California Users (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how it is used, the right to delete your personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right not to be discriminated against for exercising your rights.

To exercise any of these rights, contact us at hello@vastcurrent.com.

9. Cookies & Tracking

VastCurrent uses essential cookies and browser storage to maintain your authenticated session. We do not use third-party advertising cookies or tracking pixels. Our authentication provider (Supabase) may set cookies necessary for session management.

You may configure your browser to reject cookies; however, doing so will prevent you from logging into the platform.

10. Children's Privacy

VastCurrent is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information without verifiable parental consent, we will take steps to delete it promptly. If you believe a child has provided us with personal information, please contact us at hello@vastcurrent.com.

11. Data Security

We implement industry-standard security measures to protect your personal information, including encrypted connections (HTTPS/TLS), hashed password storage, row-level security policies on our database, and restricted access to production systems. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

If you suspect any unauthorised access to your account, please change your password immediately and contact us at hello@vastcurrent.com.

12. International Data Transfers

Alcin Technologies LLC is based in the United States. If you access VastCurrent from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers maintain infrastructure. By using VastCurrent, you consent to this transfer.

Where required by applicable law, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) for transfers of personal data from the EEA or UK to countries without an adequacy decision.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will update the effective date at the top of this page and, where appropriate, notify you via email or an in-app notice. Your continued use of VastCurrent after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: