Privacy notice

Who manages your data

Antti Põder operates Small Dot and is responsible for your personal data. Contact support@smalldot.world for privacy requests. See our seller and contact details.

Your account and public profile

We use your email to send sign-in links and operate your account. Supabase stores accounts, profiles and photos; Resend delivers sign-in emails. Your email is not displayed on the map. We store your profile name, selected country and city, interests, and optional biography, Homepage, Instagram, Linktree and photo. These profile fields become visible to visitors when your paid profile is published. Do not publish sensitive information you do not want to share. We place your dot automatically at a random spot in your chosen city. The map position does not identify your home address.

We privately store your confirmation that you are at least 18 and the age-policy version with your account. This is your own declaration, not verification of your age or identity. We do not collect your date of birth or identity documents for this check. The confirmation is deleted when your account is deleted.

Sign-in abuse protection

We use Cloudflare Turnstile on the sign-in form to help prevent automated abuse. Cloudflare processes technical browser and network information for this security check. Supabase validates the resulting verification token before sending a sign-in email. See Cloudflare’s privacy policy and the Turnstile Privacy Addendum.

Automatic content checks

Before saving a profile, we send its name, biography, selected keywords, submitted profile links and any new profile photo to OpenAI’s free Moderation API for automated safety checks. An older photo that has not yet been checked is checked when you next save your profile. We do not include your sign-in email, payment details or selected location in these requests. Photos are resized and stripped of image metadata before the check. Rejected photos are not added to public profile storage. If the check is unavailable, the changes are not saved.

We use these checks for the legitimate interests of preventing abuse and keeping public profiles suitable for a general audience. API processing is subject to OpenAI’s privacy policy and its API data controls and retention. We also apply local profanity and link rules, including a bundled list of known adult-content domains. Submitted links are checked locally against these rules; we do not crawl destination pages or links inside a Linktree profile. Automated checks can miss nudity, offensive wording or unsafe links, and can make mistakes. Contact support@smalldot.world to request a review. A check does not verify a person’s identity or guarantee that an external website is safe.

Reports record the reporting account, the reported profile, a reason category and the report date. Reports are private to the operator; the reported person does not receive your identity. We retain reports while needed to investigate abuse, with routine cleanup of reports older than 90 days. Deleting an account also deletes reports tied to that account. Moderation decisions are kept while the profile exists.

Payments and technical data

The payment provider shown at checkout processes your payment details under its own privacy notice. Small Dot stores the payment reference, amount, status and terms acceptance, not full card numbers. Stripe and, when offered, PayPal receive the information needed to process payments and prevent fraud. Our hosting, email and map providers process normal web-request information such as IP address and browser details. OpenFreeMap and OpenStreetMap provide map data. External profile links take you to independently operated sites.

Website statistics

We use Cloudflare Web Analytics to measure visits, page views, referring websites, country, device and browser type, and page performance. This helps us understand and improve Small Dot. This analytics service does not use cookies or identify individual visitors. We do not send profile content, account emails or payment details to it. Cloudflare does not log URL query strings. Statistics are available for up to six months.

Purpose, legal basis and retention

We process account and purchase data to provide the service and fulfill our contract; retain necessary payment records to meet legal obligations; and use proportionate technical logs for the legitimate interests of security and abuse prevention. Your browser stores the session needed to keep you signed in and your language choice. We do not use advertising tracking cookies.

You can edit your profile, remove its photo or delete your account in My profile. Account deletion removes the active account, profile and photo. Providers may retain temporary backups according to their retention schedules. Payment records required for accounting or disputes are retained for the legally required period. Support correspondence is kept only as needed to resolve the request and relevant obligations.

Your rights and international processing

You may request access, correction, deletion, restriction, objection or portability where applicable by contacting support. We may verify your identity before acting. Our service providers may process data outside the EEA under their applicable transfer safeguards. You can complain to the Estonian Data Protection Inspectorate at aki.ee, or your local supervisory authority. See our purchase terms.

Founding Dot registry

Your Founding Dot number, if issued, appears on your published profile. When your account is deleted, the number remains reserved without its account identifier so that it cannot be assigned again. The public counter shows the number of issued memberships, not private account details.

Viewed profiles

When you are signed in, we privately save which profiles you open so the Unexplored filter can hide them on later visits and on your other devices. This history is available only to your account and is removed when your account is deleted. Visitors cannot see who viewed their profile. Website and Instagram links you add are public with your published profile.