Privacy

Member accounts

A free member account unlocks the pick’em, comments, and the free Intro to AI Kit. You sign in with your email address only: I send you a sign-in link and a 6-digit code, and either one works. There are no passwords, no social logins, and no guest accounts.

• What is stored: your email address, the display name you choose (2 to 24 characters), your favorite teams (up to 12), the date you claimed the Intro to AI Kit, and who invited you, if anyone did.
• Where it lives: in my Supabase database. The sign-in emails are sent from rocky@haestus.dev through Resend.
• Staying signed in: your browser keeps a session cookie named sb-…-auth-token. It is essential: without it you would be signed out on every page.
• Invites: a link of the form /invite/<code> sets a first-party, httpOnly cookie named isr_ref for 30 days, so that if you sign up in that time the person who invited you can be credited. A member sees only a count of the friends who joined, not who they are. There are no rewards yet; if any are added later, they will come with their own written rules.
• Newsletter: from your account page you can switch InTheCut on or off. The record of your consent is kept, as described below.
• Who can see it: your display name is shown on your comments and in your leagues. Your email is not shown to other members. As the site’s owner I can see member counts, display names, reports, and inquiries.
• Deleting your account: on your account page, choose “Delete my account”. It immediately removes your account, profile, comments, the leagues you own, your league memberships, and your picks, and it unsubscribes you from the newsletter. For anything else, email rocky@haestus.dev.

Comments

Signed-in members can post comments: “I made this” notes on recipes, which are public, and chat inside a pick’em league, which only that league’s members can see.

• Your display name is shown with each comment. Pick one you are happy to have shown publicly.
• You can delete your own comments. League owners can hide comments in their league, and I can hide any comment. Anyone signed in can report a comment, and reports are visible to me.
• Posting is rate-limited to keep spam down.

InTheCut newsletter

If you subscribe, I collect your email address. The signup uses a double opt-in: you are added only after you click the confirmation link we email you.

• What is stored: your address, its subscription status, the wording you agreed to and when, which page you signed up from, and a keyed hash of your IP address used to limit abuse. The hash cannot be turned back into your IP address, and it is cleared 90 days after you sign up.
• What the confirmation link does: it works once and expires after 7 days. If the confirmation email was sent and you never confirmed, the request is deleted 7 days after it was sent. If email sending has not been switched on yet, your request waits and the email is sent as soon as it is, with a fresh link; a request whose email never went out is deleted after 90 days.
• Unsubscribing: every email has a one-click unsubscribe link. Afterward I keep only your address and a record of your consent, so the unsubscribe holds and you are not re-added by mistake.
• Email delivery: messages are sent through Resend once email sending is switched on. Until then, signups are saved as pending and no email leaves this site.
• Members: if you have an account, you can turn InTheCut on or off from your account page. Turning it off, or deleting your account, unsubscribes you, and the consent record stays as described above.
• Bounces and complaints: if a message bounces or is reported as spam, the address is marked so it is not mailed again.

Project inquiries

Program interest forms and partner applications use the same private inquiry system. They store your name, email, message, chosen program or partner role, any referral you provide, and your permission to be contacted about that request. Only the studio owner reviews these submissions. They do not enroll you in a program or subscribe you to a newsletter.

The inquiry form at /inquire collects the name, email, company (optional), what you need, a budget range (optional), and the message you write. It is stored so I can reply and follow up. A keyed hash of your IP address is stored with it to limit repeated submissions. If email sending is on, a copy of the inquiry is also emailed to me. The form is not shared with anyone else, and sending it does not create any obligation on either side.

Pick’em league

The pick’em is a free football game for friends. Playing requires a member account (see above), so your picks are tied to it.

• What is stored: the display name you choose, the leagues you create or join, and your picks and tiebreakers.
• Who can see it: other members of a league can see your display name. Your picks are visible to the other members of that league only after the game has kicked off.
• Pick a display name you are happy for your league to see. It does not have to be your real name.

Game clips

Signed-in adult members can upload short game videos. Every upload is private while it is processed and reviewed.

• What is stored: the video, its title and game label, the member who uploaded it, whether it is public or limited to a league, processing and moderation status, duration, thumbnail, and creation and review dates.
• Who can see it: approved public clips can be seen by anyone. Approved league clips can be seen only by members of that league. An uploader can see their own pending clip.
• Reports: a report records the clip, the reporting member, the optional reason, and when the report was made or resolved. Reports are visible to the site administrator, not other members.
• Video delivery: Cloudflare Stream stores, processes, and streams the video. Its player and thumbnail receive ordinary request information such as your IP address and browser details when they load.

Surveys

Surveys at /surveys need no account and no email address. When you vote, the site sets a first-party cookie named isr_voter that holds a random ID. It is httpOnly, so scripts on the page cannot read it. To allow one vote per poll, that random ID is combined with a keyed hash of your IP address, and only the resulting hash is stored, never the ID or the IP address itself. There is also a limit on how many votes one network address can cast in a short time.

A vote stores only the option you chose and that hash. Results are shown only as totals. The hash cannot be used to learn your name, and I do not use it for anything else.

The lab

The lab at /play is not open yet. It has no accounts, forms, or games today, and it collects nothing and saves nothing in your browser. If it opens with anything that handles personal information, this page will say so first.

College football data

The /cfp pages show schedules and results from CollegeFootballData. Your visit does not send them anything about you; the site’s server fetches the data and shows it to you.

Hosting and service providers

• Vercel hosts the site. Like any host, it processes request data such as IP addresses and browser details in its server logs to deliver pages and keep the service secure.
• Supabase stores the data described above (accounts, comments, newsletter, inquiries, pick’em, surveys) in its database and handles member sign-in.
• Resend delivers email: sign-in links and codes for members, and newsletter mail when sending is switched on. It receives the recipient address and the message.
• Cloudflare Stream stores, processes, and delivers member game clips and their thumbnails.
• CollegeFootballData supplies football data, as described above.

These providers have their own privacy policies. Links from this site to other websites, including Haestus, PayPro, client sites, and social platforms, are governed by those sites’ own practices.

Cookies and browser storage

• Your cookie preference (isr-cookie-choice) is saved for 180 days in a first-party cookie and local storage so it can be remembered and shared between tabs. It contains only your choice, a version, and an expiry time. This essential preference is saved even when you decline analytics. Open Cookie settings in the footer to change it.
• The project brief builder and website launch checklist save your entries in this browser as isr-build-brief-v1 and isr-launch-review-v1. These drafts are not sent to ISR or an AI service, and do not sync between devices. Use “Start fresh” inside a tool to clear its draft, or clear browser storage. Copy, download, and print let you keep a separate copy.
• Your light-or-dark theme choice is saved in your browser’s local storage as isr-theme.
• The fortune cookie saves a random ID (isr-visitor) and the day you last cracked one (isr-fortune-day) in local storage, or in a plain first-party cookie of the same name if storage is blocked. Both stay in your browser; the fortune is picked on your device and nothing is sent to the site.
• InTheCut remembers that you have seen its start-up screen (inthecut-booted) in session storage, which your browser clears when you close the tab.
• Member sign-in sets an essential session cookie named sb-…-auth-token so you stay signed in.
• An invite link sets a first-party, httpOnly cookie named isr_ref that lasts 30 days and exists only so a sign-up can be credited to the inviter.
• Surveys set a first-party, httpOnly cookie named isr_voter holding a random ID. It exists only to allow one vote per poll, and only a hash made from it is stored.

No analytics or advertising cookies are set. You can clear this data any time in your browser settings; the side effect is that you will be signed out on that device and any pending invite will be forgotten.

How long things are kept

• Unconfirmed newsletter requests: deleted 7 days after the confirmation email was sent, or after 90 days if that email never went out.
• Hashed IP addresses on newsletter signups: cleared 90 days after sign-up. Rate-limit counters are deleted after 48 hours.
• Unsubscribed addresses: kept (address and consent record only) so the unsubscribe is honored.
• Member accounts and everything attached to them (profile, comments, leagues you own, memberships, picks): kept until you delete your account, which removes them immediately.
• Clip metadata and unresolved reports: kept while needed for moderation and abuse prevention. Rejected or deleted videos are removed from Cloudflare Stream; a minimal database record may remain to enforce the daily upload limit and document moderation.
• Inquiries and survey votes: kept for as long as they are useful for the purpose above, or until you ask me to delete them.

Your choices

You can unsubscribe from the newsletter with one click, and delete your member account yourself from your account page. You can ask me to tell you what I hold about you, correct it, or delete it by emailing rocky@haestus.dev from the address in question. I will reply as soon as I reasonably can. I am an individual running a small studio, not a law firm, and this page describes what the site actually does rather than making promises about any particular law.

Changes to this page

When a feature that changes what is collected is added, I update this page first and change the date below. Past versions are not kept online, but ask me if you need to know what applied when you signed up.

Contact

Rocky Bunker, ISR Studio, St. George, Utah. Questions can be sent to rocky@haestus.dev.