How we handle your data
This page is maintained by the PrxjectSin team to answer common security and privacy questions about the PrxjectSin site, fan accounts, shop, and tour features. It is editable project content, not an independent certification or audit report.
ACCOUNTS & AUTHENTICATION
Fan accounts are created through our auth provider. Passwords are stored as salted hashes by the auth service — we never see plaintext passwords. Sessions are kept in your browser and can be ended at any time from the account menu.
Admin areas are protected by a server-side role check on every request; client-side flags alone never grant access.
WHAT WE COLLECT
Account profile fields you provide (display name, optional avatar), order details when you buy merch, RSVPs you make to tour stops, points earned from on-site activity, and messages you submit through the contact form. We also collect basic visit analytics (page, referrer, coarse geo from IP) to understand traffic.
HOW WE USE IT
To run your account, fulfill orders, send the newsletters you opt into, award and redeem fan points, and improve the site. We don't sell personal data. Marketing emails are only sent when you opt in, and every email includes an unsubscribe link.
SUBPROCESSORS & INTEGRATIONS
We rely on third-party services to operate: a managed database and auth provider for account data, a transactional email provider for newsletters and receipts, and a hosting platform that serves the site. Each provider only receives the data needed to perform its function.
COOKIES & ANALYTICS
We use cookies and local storage that are required for sign-in sessions, your cart, and language/theme preferences. Lightweight first-party analytics record anonymized page visits; we do not run advertising trackers on this site.
DATA RETENTION & DELETION
Account data is kept while your account is active. You can request deletion of your account and associated personal data by contacting us through the form below. Order records may be retained for accounting and legal obligations.
PRIVACY REQUESTS
To access, correct, export, or delete your personal data, use the contact form and tell us which request you'd like to make. We respond to verified requests within a reasonable time frame.
SECURITY CONTACT
If you believe you've found a security issue, please reach out through the contact form with the subject "Security" and a description of the issue. Please do not publicly disclose the issue until we've had a chance to investigate.
COMPLIANCE
We aim to handle personal data in line with applicable privacy laws including GDPR for visitors in the EU/EEA. This page describes our current practices and is not a substitute for legal advice or a formal certification.