What we collect, and why
Last updated 2026-09-11 · Controller: Patrick Chen, trading as Sublimearts.io, Milano, Italy
PENDING LEGAL REVIEW
This reflects our real, current intent, but hasn't had a professional legal review yet. Questions in the meantime: reach out and we'll answer directly.
WHAT WE STORE
| Your email address | To identify your account and contact you about your rocket or a race you won. |
| Your sign-in provider ID | If you sign in with X or Google, so we can recognise you next time. We never receive your password. |
| Your rocket's content | Name, tagline, description, URL, and anything you add to a profile page. This is public by design. |
| Votes you cast (fuel) | Which rocket, which week. Needed to enforce one vote per rocket per week and to compute standings. |
| A hashed IP address per vote | A one-way HMAC, never the raw address. Used only to detect vote manipulation before a prize is paid. |
| Waitlist handle or email | If you joined the waitlist. Used only to tell you when a race opens. |
| Badge referrer domain | If you install the badge, we record that a request came from your own domain, to verify the badge is live. |
WHAT WE DON'T DO
- We don't sell your data.
- We don't store raw IP addresses against your votes — only a one-way hash.
- We don't run advertising trackers or third-party ad pixels.
- We don't email you marketing you didn't ask for.
WHO PROCESSES IT
We use a small number of providers, each only for what it says:
- Supabase — database and authentication
- Vercel — hosting, and aggregate page analytics
- Resend — sending transactional email
- Cloudflare Turnstile — bot protection on sign-in
- Stripe — payments, if you buy something. Card details go to Stripe and never reach us.
If you embed a video on a profile page, that video is served by YouTube, Loom, or Vimeo, and those services will see the visitor's request.
HOW LONG
Account and rocket data is kept while your account exists. Votes and race results are kept indefinitely, because a finished race is a permanent public record — that is the “nothing dies” premise of the site. Hashed vote IPs are kept for 12 months and then deleted.
YOUR RIGHTS
Email hello@sublimearts.io to get a copy of your data, correct it, or delete your account. We'll action deletion requests within 30 days.
Deleting your account removes your rocket from the track. Historical race results may retain the rocket name where removing it would falsify a published result; tell us if that's a problem for you and we'll discuss it rather than refuse.
If a listing describes your project and you didn't create it — a reserved pad — email us and we will remove it without argument.
As an Italy-based controller, we're subject to the GDPR regardless of where you're visiting from. Depending on where you live you may also have rights under the UK GDPR or CCPA, including the right to complain to your own data protection authority — this section still awaits professional legal review for completeness.
See also Terms and Contest rules.