What we collect, and why.
- 01
What we collect
Account: your email address, and if you sign in with Google, the name and profile picture Google shares with us. Sign-in is handled by Supabase, which stores a hashed session for you and records sign-in timestamps and IP addresses for security.
Membership: your clearance tier, subscription status and renewal date, and a Stripe customer id. Stripe holds your payment details and billing address; we never receive your full card number.
Watch list: if you join the watch list on the home page, we store your email address and where you signed up from.
Usage: standard hosting logs (IP address, browser, pages requested) kept for a short period to keep the site running and to detect abuse. We also count public case-page views and membership-button clicks by case and referral source. These event payloads contain no name, email, visitor identifier or full URL, and use no tracking cookies or browser storage. Hosting logs may still contain ordinary request information.
Referrals: when you start a membership from a case page, its case number and referral source are attached to the Stripe checkout and subscription. This lets us see which case pages lead to paid memberships. We do not use advertising trackers.
- 02
Why we use it
To sign you in and keep your session secure, to bill you and give you the access you have paid for, to email you about new case files and changes to the service, to understand which public case pages lead to membership, and to keep the site running safely.
The legal bases, where they apply, are performance of our contract with you, our legitimate interest in running and securing the site, and your consent for the watch list emails, which you can withdraw at any time by unsubscribing.
- 03
Who else sees it
Supabase (authentication and database hosting), Stripe (payments), Vercel (hosting and server logs), and our email provider (transactional and watch-list mail). Each processes data only to provide its service to us.
Embedded YouTube players are served by Google and may set cookies under Google's own privacy policy when you play a video. We don't sell personal data, and we don't share it with advertisers.
- 04
Cookies
We set the cookies needed to keep you signed in and to remember your display preferences (dark or light mode, animation on or off). These are strictly necessary or stored locally in your browser; we don't use cookies for tracking or advertising.
- 05
How long we keep it
Account and membership data for as long as you have an account, then deleted within 30 days of closure except where we must keep billing records for tax and accounting law (typically seven years). Watch-list emails until you unsubscribe. Server logs for a short rolling period.
- 06
Your rights
You can ask to see the personal data we hold about you, correct it, have it deleted, or receive a copy in a portable format. If you are in the UK or EU you can also object to or restrict certain processing and complain to your data protection authority.
To exercise any of these, email hello@cnx51.com from the address on your account. We respond within 30 days.
- 07
Changes
If we change how we handle personal data in a way that matters, we will update this page and, for material changes, email account holders before the change takes effect.