Privacy Policy

The operator of MAD and mad-ads.com determines why and how personal information is processed and is responsible for that processing (or, in Ukrainian terminology, acts as the personal data owner). MAD is the public-facing service name used in this notice.

For privacy questions, rights requests, or complaints, contact the MAD operator at maximusik2@gmail.com.

Supabase Auth handles registration, email confirmation, login, password processing, and sessions. MAD does not store plaintext passwords in application code or public profile tables. Authentication cookies and related session information are used to keep users signed in and enforce access controls.

Avatar files are publicly readable so they can appear in the interface. Do not upload an image you do not want publicly accessible. Other profile details are limited by database access controls but may be displayed when a feature expressly presents them.

MAD uses essential cookies or similar storage for authentication, security, sessions, language routing, and service operation. These functions cannot be disabled through the marketing control.

Meta Pixel and Amplitude are enabled by default when configured. They help measure page views, confirmed registrations, campaigns, product use, and interaction quality. This default is a product setting, not a statement that a user gave legal consent. Where applicable law permits an opt-out model, MAD relies on legitimate interests or another available ground. Any mandatory rule requiring prior consent still controls.

The persistent Privacy choices control lets you disable or re-enable marketing analytics on the current browser. MAD stores that preference locally. Disabling stops new app-triggered Meta and Amplitude events after the choice takes effect and opts the running Amplitude client out; it does not retroactively delete events already sent. A verified rights request can address historical data where applicable.

If the configured Amplitude replay sample rate is above zero, Amplitude may create a video-like reconstruction from sampled DOM changes, navigation, clicks, scrolling, and visible page interactions. Replay uses browser storage such as IndexedDB and follows the Amplitude opt-out setting.

MAD configures replay with medium masking and blocks all forms and containers marked as sensitive, including account registration/login, profile, admin, community application, and merch pre-order interfaces. Form fields, passwords, private profile content, and submission answers are not intended to be captured. Remote Amplitude privacy settings can apply stricter controls and must not be configured to weaken these protections.

The codebase contains a protected Listmonk webhook and references possible newsletter infrastructure, but Listmonk is not described as an active marketing sender unless separately deployed and configured. The contact-only merch pre-order form is active, but MAD+ subscriptions, merch checkout, and a payment provider are not active paid services in the current product.

If MAD activates a new processor or materially different purpose, this notice and any required collection notice will be updated before or when that processing begins.

MAD does not sell personal information for money. Information may be disclosed to the processors above, authorized team members and contractors, professional advisers, a successor in a business transaction, or authorities when disclosure is lawfully required or needed to protect rights and safety.

Meta Pixel can be treated as a sale, sharing, or processing for targeted or cross-context behavioral advertising under some U.S. state laws even when no money changes hands. MAD therefore provides the Privacy choices opt-out and will apply any additional rights required where such a law applies.

Automated ingestion, localization, scoring, and AI tools may create or update internal drafts. They do not independently schedule or auto-publish public content. Public release requires an intentional publish instruction by an authorized editor or through authorized MCP publishing tooling.

Manual-only publishing means unattended ingestion or drafting jobs do not transition a draft to public status. MAD may retain prompts, sources, generated material, and editor activity to operate and audit that workflow.

Processors may handle data outside the country where a person lives, depending on the region and settings selected for Railway, Supabase, Resend, Meta, Amplitude, and OpenAI. Exact production regions and signed data-processing terms should be maintained in MAD's internal processor register.

Where required, MAD will use a lawful transfer mechanism, such as an adequacy basis, a data-processing agreement with appropriate contractual safeguards, standard contractual clauses, or another mechanism permitted by law. Transfers of Ukrainian personal data must also satisfy Article 29 of the Law of Ukraine On Personal Data Protection.

MAD keeps data only for the category-specific periods above or while it remains reasonably necessary for the stated purpose. Transactional email delivery records are targeted for no more than 24 months; verified privacy-request and dispute records may be kept for up to five years; security incidents and legal holds may require longer retention.

Deletion may be performed manually. Data removed from active systems may remain in restricted backups until the normal backup cycle expires. MAD may retain de-identified information, records required by law, and limited evidence needed to prevent fraud, resolve disputes, or prove compliance.

MAD uses measures designed to reduce risk, including server-side authorization, Supabase row-level security, restricted service-role use, scoped editor/admin access, input and upload validation, and replay blocking for sensitive interfaces.

No system is completely secure. Users must protect their credentials and email account. Please report suspected unauthorized access through the privacy contact without including passwords or unnecessary sensitive data.

Depending on applicable law, you may ask to know whether MAD processes your data; access, correct, update, delete, or obtain a copy; restrict or object to processing; withdraw consent where processing actually relies on consent; opt out of targeted advertising or sharing; appeal a denied request; and complain to a regulator or court.

Email maximusik2@gmail.com with the right you want to exercise, the account, application, or merch pre-order email involved, and enough detail to find the record. Do not send a password. MAD may verify identity proportionately, may ask an authorized agent for proof of authority, and will respond within the period required by applicable law. If a request is denied, reply with 'Appeal' and the reason you disagree. MAD will not discriminate against a person for exercising a legally protected privacy right.

For Article 12 collection notice purposes, the data categories, purposes, recipients, rights, MAD service identity, and monitored operator contact are stated in this Policy and beside account, community, and merch pre-order forms. Under Article 11, MAD maps processing to contract or requested steps, legal obligation, legitimate interests where available, or separately obtained consent; default-on analytics is not labeled as consent.

Article 8 rights include obtaining information about the owner and processing, access, reasoned objection, correction or deletion of inaccurate or unlawfully processed data, protection from unlawful processing and accidental loss, complaint to the Ukrainian Parliament Commissioner for Human Rights or a court, and withdrawal of consent where consent is the ground. Cross-border transfers are handled subject to Article 29 and other applicable Ukrainian requirements.

California's CalOPPA requires disclosure of online collection practices. MAD does not currently respond to the browser Do Not Track header because there is no uniform technical standard for that signal. MAD does honor a browser Global Privacy Control signal as an analytics opt-out when the browser exposes it, and everyone can use the persistent Privacy choices control.

Meta and other third-party analytics services may collect information about activity over time and across different websites or online services under their own policies. If a comprehensive U.S. state privacy law applies to MAD, eligible residents may receive the access, correction, deletion, portability, appeal, and opt-out rights required by that law. This notice does not claim that MAD currently meets a particular law's business-size or processing-volume threshold.

MAD obtains information directly from users, automatically from browsers and devices, from authentication/email/hosting providers, from authorized editors, and from public editorial sources. MAD does not intentionally buy profile, community-application, or merch pre-order data from data brokers.

Public editorial pages are intended for a general audience, but MAD accounts and community applications are only for people who are at least 18 years old. MAD does not knowingly create accounts for or accept community applications from anyone under 18. Contact the privacy address if you believe an ineligible minor submitted personal data.

MAD may update this Policy as the product, processors, or law changes. The page will show a new version and date. Material changes will receive additional notice, such as an account email or prominent on-site message, where appropriate or required; renewed acknowledgment will be requested when required.

Privacy requests, complaints, and Terms questions: maximusik2@gmail.com. This channel is operationally monitored; an email address in this notice is not a substitute for a working request process.