Privacy Policy

Last updated: April 28, 2026

This page explains what GBFans.com collects, why we keep it, and how you can exercise your rights under the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and similar US state privacy laws.

What we collect

  • Account information. Email, display name, and any profile fields you fill in (bio, location, interests, social links, avatar).
  • Content you submit. Wiki edits, news/blog posts, gallery uploads, profile comments, marketplace listings, product reviews, event listings.
  • Order / payment records. If you make a purchase, we capture the email, name, shipping/billing address, phone, and IP address at the time of the order along with the line items. We do not store full card numbers; payment is tokenized through PayPal.
  • First-party analytics. Anonymous session and pageview data tied to a cookie-based identifier so we can understand traffic patterns and fix broken pages.
  • Cookies and similar storage. Authentication cookies (Clerk), an analytics identifier, and any preference you set on the site.

Why we keep it

  • To run the site. Authentication, content attribution, and showing you what you posted.
  • To complete orders. Shipping, customer support, returns, fraud prevention.
  • Legal obligations. We retain order, tax, and accounting records to meet US and EU tax/audit requirements. Deletion requests do not cover this data, see below.
  • Community continuity. Wiki articles, news posts, gallery uploads, and other community-submitted content are licensed to GBFans.com under our Terms of Service so the platform can keep displaying them after an account is closed. We anonymize the author rather than deleting the contribution. This is the same model used by Wikipedia, Stack Overflow, and Discourse.

Your rights

  • Right to access / portability. Request a copy of the personal data we hold on you in a structured machine-readable format (JSON).
  • Right to erasure ("right to be forgotten"). Request that we anonymize your account. We rewrite your email and display name to a non-identifying sentinel, hard delete tracking and profile data (notification preferences, push subscriptions, friend lists, contribution scores, analytics sessions, saved address book, saved payment methods, marketing list subscriptions), revoke saved PayPal tokens and active subscriptions on PayPal, and ask Clerk and Discourse to forget you. Per GDPR Art. 17(3), we keep legally-required records (orders/payments) and your community-contributed content (anonymized).
  • Right to correct. Update profile fields via the dashboard, or email us if a non-editable field is wrong.
  • Opt out of marketing. Every marketing email carries an unsubscribe link. Use it.
  • Opt out of "sale" / "sharing" of personal information (CCPA/CPRA). We do not sell personal information. We do not "share" personal information for cross-context behavioural advertising as defined under CPRA.

How to make a request

Send an email to [email protected] from the email address on your account. Include:

  • What you want, access (export), correction, or erasure.
  • For erasure: any specific gallery uploads or photos you want hard-deleted (rather than anonymized in place). The default for community content is anonymize-don't-delete; we delete only what you explicitly ask us to delete.

We respond within 30 days of verifying your identity (the statutory window under GDPR / most US state laws). Identity verification is intentional friction, deletion is irreversible.

We will not delete order, tax, or accounting records, even on request, because they are required for legal and audit reasons. The captured email/name/address/phone/IP on those rows stays as-is. Everything else listed under "What we collect" is in scope.

How long we keep things

  • Active account data: as long as the account exists.
  • Marketing list subscriptions: until you unsubscribe or request deletion.
  • Order, tax, accounting records: retained per US/EU tax and audit requirements (typically 7 years minimum). Not in scope for deletion requests.
  • Analytics sessions: tied to a cookie-based anonymous identifier; rotates when you clear cookies or switch devices.
  • Audit / security logs: retained for legitimate security interests.

Who we share with

We use a small number of third-party services to run the site. None of them are given more data than they need:

  • Clerk, authentication. Holds your email, login history, and any session metadata.
  • PayPal, payment processing. Holds your billing details for any orders you place.
  • Plunk (self-hosted via AWS SES), transactional and marketing email.
  • Google Cloud Storage, image and file storage. Holds the bytes of files you upload.
  • Discourse, discussion forum at forum.gbfans.com. Holds your forum username and posts.
  • Meilisearch, site-wide search. Holds author names, titles, and excerpts so search can find things.

Children

GBFans.com is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we've collected information from a child, email us at [email protected] and we'll remove it.

Contact

Privacy questions, complaints, and data subject requests: [email protected].