Privacy Policy
Last updated: 24 October 2026
This policy describes what data SpawnParty actually processes, why, where it is stored and what rights you have. It is not legal advice and does not guarantee compliance with any requirement in every individual case.
1. Controller
The controller is SDP Studio, owner Ivan Kriuchenkov, Joseph-Haas-Str. 15, 76593 Gernsbach, Germany. Email: sdpstudio2025@gmail.com.
2. Account and sign-in
Name, email and account data are processed through Supabase Auth. Passwords are stored by the authentication provider as hashes; the operator cannot see them. The data is needed to sign in, protect the account and perform the service. It is kept while the account exists.
3. Jobs, Enthusiasm projects and companies
Text, tags, salary, location, application contacts (email, Telegram, WhatsApp, Discord, external link), company names and descriptions and images that you voluntarily publish. This information is shown publicly and can be seen by any visitor without an account. Do not include third-party personal data. Listings are deactivated automatically after 30 days unless renewed.
4. Talent profile
A talent profile is created only if you choose to, and it is not published by default. If you enable the public profile, the directory and profile page show: name or handle, avatar, role, bio, skills, experience, location, portfolio link and the contact you entered yourself. Your account email, system role and other account data are not included in the public directory. You can hide or delete the public profile in the dashboard at any time.
5. Content reports
When you report a job, project or profile, we store the reason, your message, the date and, if you provide it, your email for follow-up. If you are signed in, your user ID is linked to the report. Only administrators can see reports and they review them manually; the status and decision are recorded. Basis: legitimate interest in keeping the service safe and handling reports of violations.
6. Purposes and legal bases
Providing and managing accounts, publishing and administering listings and profiles, security and abuse prevention, handling reports. Depending on the situation, the basis is performance of a contract or pre-contractual steps, the operator's legitimate interest in a safe service, legal obligations and, for analytics, your consent.
7. Supabase (data storage)
Supabase provides authentication, the PostgreSQL database and file storage. Account, profile, company, listing and report data and uploaded images are stored there. Access is limited by account permissions and row-level security (RLS) policies. Public listing and company images are reachable by direct link. No service_role key is used in the browser.
8. Hosting
The site is deployed with a hosting provider (per the project configuration, Netlify). When you visit the site, the hosting provider technically processes your IP address and request data needed to deliver pages and protect against attacks.
9. Analytics (PostHog)
PostHog analytics loads only after you consent in the cookie banner. We send events such as page views, job views, searches and contact clicks; automatic interaction capture is disabled. We do not send passwords, application contents or your profile texts to PostHog. You can withdraw consent via Cookie settings in the footer.
9a. Visit statistics (no cookies)
To show employers how many people viewed their listings, and to understand how the site is used, we count on our own server views of listings, clicks on contact buttons and overall site traffic: which pages are opened, which domain or UTM tag a visit came from (the referrer path and query are not kept, except utm_source, utm_medium and utm_campaign), device type, browser, operating system, country and browser language in aggregated form, visit length and pages per visit, and the choice made in the analytics banner (accepted / rejected / not chosen) as an anonymous counter. Without your consent nothing is stored in your browser. To count unique visitors per day, the server computes a one-way keyed hash from your IP address, browser user-agent and the date; the hash changes every day, the IP address itself is not stored, and the hash is deleted after about two days. Only daily totals per listing and per metric are kept long-term, not linked to any individual. If you click “Allow analytics”, we additionally keep a random identifier with no personal data in your browser (localStorage key gdj-vid) and record against it on our server the days you visited, page views, first referral source, device type, country and language, so that new visitors can be told from returning ones. If you are signed in, we also store for your account the first and last activity date, the number of active days and page views, and link the browser identifier to it. This is done only with your consent (for signed-in users, as part of performing the contract and our legitimate interest); if you decline, the identifier is removed from your browser. Records of inactive visitors are deleted after about 14 months. Your IP address and user-agent are not stored with it. Bots, visits by the listing owner and admins, and visitors with Do Not Track or Global Privacy Control enabled are not counted. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in providing the service to employers and improving it. You can object by enabling Do Not Track in your browser.
9b. Requests to manage a company
If you send a "This is my company" request, we store the work e-mail, job title and comment you provide together with your account, in order to review the request and protect the company profile from unauthorised access. Only the site administrator can see this data. Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in protecting company profiles (Art. 6(1)(f) GDPR). We keep the request while your account or the company exists; you can ask us to delete it by writing to us.
9c. Job alert e-mails
If you subscribe to job alert e-mails, we store your e-mail address, your settings (profession, engine, remote, frequency), language, the consent text and the dates of subscribing, confirming and sending. E-mails start only after you confirm the subscription with the link we send you. E-mails are delivered through the Resend e-mail service. You can unsubscribe at any time with the link in every e-mail, after which no more e-mails are sent. Your address is never shared with employers or analytics.
10. External links
Listings and profiles may link to external sites, messengers and application forms. Their content and data handling are outside SpawnParty's control. SpawnParty does not receive applications: if you contact a listing author, they receive your data, not us.
11. Retention
Account data and published records are kept while the account or record exists. Expired listings are deactivated and can be deleted by the owner at any time. Reports are kept as long as needed for review and abuse prevention. After deletion, data may remain for a limited time in providers' backups and technical logs.
12. Your rights
Where GDPR provides, you may have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Write to the operator's email for requests. You may also lodge a complaint with a competent supervisory authority.
13. Account and data deletion
You can delete your account yourself in the dashboard: this removes your profile, talent profile, companies, jobs, projects and the images you uploaded. You can also delete a talent profile, job or company separately. If self-service deletion is unavailable, email the operator. Data we are legally required to keep may be retained for the statutory period.
14. Changes
This policy may change when the service, providers or law changes. The current version and its date are published here.