Legal

Privacy Policy

Effective October 22, 2026 · A7A.IO LLC

The short version. We collect what we need to run the site: your Google account details, your posts, your wallet transactions, support messages you send us, and basic server logs. We use no analytics, no ad trackers, and we do not sell your information. Your posts are public. “Anonymous” hides your name from visitors, not from us. Email a7aezay@a7a.io to access or delete your data.

1. Who we are

A7A.IO LLC, a Washington limited liability company (“A7A,” “we,” “us”), operates a7a.io and its subdomains (the “Service”). We are the data controller for personal information processed through the Service. This policy explains what we collect, why, who we share it with, and the choices you have. It applies alongside our Terms of Service.

2. What we collect

Account information

You sign in with Google. Google sends us your name, email address, profile photo, and a Google account identifier. We do not receive your Google password. We create an account record and a wallet for you when you first sign in.

Content you publish

When you publish, we store the title, the message, whether you chose anonymous or named, and the time of publication and expiry. Posts are public at title.a7a.io and may appear in the Live gallery. If you publish as Anonymous, visitors see “Anonymous” instead of your name and photo; our records still link the post to your account.

Payment information

Wallet top-ups are processed by Stripe. Stripe collects your card number, expiry, security code, and billing details directly; those never reach our servers. We store the amount, currency, Stripe’s checkout session and payment identifiers, and the time of each top-up, along with your running balance and a history of what you spent it on.

Support requests

If you use the support form or email us, we receive the name, email address, subject, and message you provide, and, if you are signed in, your account identifier. Support messages are delivered to a7aezay@a7a.io so we can reply. We do not add you to any mailing list.

Technical information

Our web server records standard access logs: IP address, browser user agent, the page requested, time, and response status. We use the IP address to rate-limit the support form and to protect against abuse. We do not use these logs to profile you.

Cookies

We set only the cookies needed to operate the Service:

Cookie	Purpose	Lifetime
`sessionid`	Keeps you signed in and holds short-lived form state.	Two weeks, or until you sign out.
`csrftoken`	Protects forms against cross-site request forgery.	One year.
`django_language`	Remembers the language you picked.	One year.

We do not use analytics cookies, advertising cookies, or third-party tracking pixels. Stripe and Google may set their own cookies on their domains when you check out or sign in; those are governed by their policies.

What we do not collect

We do not collect your location beyond what an IP address implies, your contacts, your device identifiers, or your browsing activity on other sites. We do not infer sensitive characteristics about you.

3. How we use information

To provide the Service: sign you in, display your posts at their public address and in Live, run your wallet, and apply the publishing rules.
To process payments: credit your wallet when Stripe confirms a payment and keep accurate transaction records.
To support you: answer questions and resolve problems.
To protect the Service: prevent fraud, spam, abuse, and security incidents, and enforce the Terms.
To meet legal obligations: keep tax and payment records and respond to lawful requests.

Where the law of your jurisdiction requires a legal basis, we rely on performance of our contract with you (providing the Service you asked for), our legitimate interests (security, abuse prevention, and running a small service), compliance with legal obligations (tax and payment records), and, where applicable, your consent, which you may withdraw at any time.

We do not sell personal information and we do not share it for advertising. We share it only as follows:

Service providers. Google (sign-in), Stripe (payments), Amazon Web Services (hosting, in the United States), and the email provider that delivers support messages. Each processes information only to provide its service to us.
The public. Posts, titles, and, for named posts, your name and photo are public by design.
Legal. We may disclose information, including the account behind an anonymous post, when required by law, subpoena, or court order, or when we reasonably believe it is necessary to prevent imminent harm, protect our rights, or investigate a violation of the Terms.
Business transfer. If A7A is acquired or merges, information may transfer to the successor, who must honor this policy.

5. How long we keep information

Account and posts: until you ask us to delete your account. Expired posts leave their public address and Live but remain in your My Posts history until then.
Payment and wallet records: seven years from the transaction, to meet tax and accounting obligations, even after account deletion.
Support messages: as long as needed to resolve the request and for a reasonable period afterward.
Server logs: a limited period, typically under 90 days, unless needed for a security investigation.
Backups: deleted data may persist in encrypted backups for up to 30 days before being overwritten.

6. Your rights and choices

You can:

Access the information we hold about you and receive a copy in a portable format.
Correct inaccurate information. Name, email, and photo come from Google; update them there and they refresh on your next sign-in.
Delete your account and posts. Email a7aezay@a7a.io from the address on your Google account. We will complete the deletion within 30 days, remove live posts immediately, and retain only the payment records described in Section 5.
Object to or restrict processing based on legitimate interests, and withdraw consent where processing is based on consent.
Sign out at any time, which ends your session cookie.

We will not discriminate against you for exercising these rights. We may need to verify your identity before acting on a request. If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, the rights above include your rights to know, delete, and correct under the CCPA; we do not sell or share personal information as those terms are defined in California law.

7. Children

The Service is for adults 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

8. Security

All traffic to the Service is encrypted with TLS. Card data is handled by Stripe and never touches our systems. Access to production systems is limited to A7A personnel who need it. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as required by law.

9. International users

The Service is operated from the United States and information is stored there. If you use the Service from elsewhere, you understand your information is transferred to and processed in the United States, which may have different data protection laws than your jurisdiction. Where required, we rely on recognized transfer mechanisms with our service providers.

10. Changes to this policy

We may update this policy. If a change is material we will post the new version here with a new effective date and, where we have your email, notify you before it takes effect. Continued use after the effective date means you accept the change.

11. Contact

A7A.IO LLC
Washington, United States
a7aezay@a7a.io · Support form