What we collect

• Account email — when you sign in. We use magic-link sign-in, so there's no password to store.
• Event reports — the fields on the report form (did it fire, attendance bucket, format played, optional notes). Submitting anonymously is fine and supported.
• Interest signals — the "going / likely / interested" pill on an event page, scoped to a 48-hour rolling window before each event.
• Profile preferences — display name, favorite formats, identity tags. All optional; defaults are privacy-preserving (badges hidden by default until public profiles ship).
• Page-view analytics — Vercel Analytics records aggregate page-view counts for performance and traffic monitoring. No behavioral profiling, no third-party ad cookies.

What we don't collect

• Real names (unless you put one in your display name).
• Phone numbers.
• Payment information for free accounts.
• Browser fingerprints, cross-site tracking pixels, or ad IDs.
• Anything we don't actually need to make the directory work.

What store owners see

Claimed-store admins see aggregate signals about their store and events: report counts, attendance distributions, reliability classifications. They never see individual users, individual report identities, or who clicked an interest pill. This is enforced at the database layer with row-level security, not as an application-layer policy that could drift.

Anonymous reports stay anonymous to store owners. Moderators see the original submitter only when adjudicating moderation decisions on content (e.g., a slur in an open-ended note); the moderation queue is gated to site moderators and platform admins.

What we never do

• Sell user data. Not to data brokers, not to ad networks, not to anyone.
• Let paid placements affect search ranking, event report display, or badge visibility.
• Build public leaderboards or ranking scorecards on specific businesses.
• Surface individual user activity to store owners. Aggregate-only, always.

For the full version of the funding model and what stays separate from it, see Trust Principles.

Data requests

Want to see what STLTCG has on you, or delete it? Email admin@stltcg.com from the address you signed up with and we'll handle it manually. There's no automated pipeline yet because there's not enough volume to need one — but the request will be honored.