Privacy Policy

fav.ing is operated by Faving, Inc. ("fav.ing," "we," "our," or "us"). This Privacy Policy explains what information we collect when you use the fav.ing website, mobile apps, and related services (collectively, the "Service"), how we use and share that information, and the choices and rights you have.

fav.ing is a for-profit service. We are transparent about that here so the rest of this document reads as it should: we collect and use data to operate, improve, and monetize the Service, while honoring the privacy rights you have under applicable law (including the GDPR for users in the EU/UK and the CCPA/CPRA for California residents).

By using the Service, you acknowledge this Policy. If you don't agree with it, please don't use the Service.

• Provide, maintain, and improve the Service
• Create and manage your account, authenticate you, and recover access
• Power social features (following, messaging, contact sync, recommendations)
• Personalize your feed and surface lists, creators, and items we think you'll like
• Send transactional notifications (replies, follows, password resets) and, where permitted, product updates
• Measure and improve performance, debug crashes, and analyze usage
• Operate, measure, and improve advertising, affiliate, and creator-monetization programs (now or in the future)
• Detect, prevent, and respond to fraud, abuse, and Terms violations
• Comply with legal obligations and enforce our Terms

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data under one or more of the following GDPR legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the account, lists, messaging, and core features you've signed up for.
• Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent fraud, debug, run analytics, and operate measurement for our advertising, affiliate, and creator programs. You can object to processing based on legitimate interests at any time.
• Consent (Art. 6(1)(a)) — for non-essential cookies and similar technologies, marketing communications, optional contact sync, and any processing where consent is required by law. You can withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)) — to comply with applicable laws, court orders, and lawful requests from authorities.

We share information with the following categories of recipients. Some of these arrangements may qualify as a "sale" or "sharing" of personal information under California law (CCPA/CPRA) or similar state laws — see "California Privacy Rights" below for your opt-out.

California residents have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. We honor these rights for California residents and offer the same controls to all users globally where feasible.

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information we process. These include:

• TLS encryption in transit and at-rest encryption for our primary databases
• Row-level access controls and least-privilege service credentials
• Security review of code changes and dependency monitoring
• OAuth and password-based authentication delegated to Supabase Auth
• Logging and monitoring for suspicious access patterns

No system is perfectly secure, and we can't guarantee absolute security. We will notify affected users and regulators of confirmed personal-data breaches as required by applicable law.

Depending on where you live, you have one or more of the following rights:

• Access: get a copy of personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): request deletion of your account and personal data
• Portability: receive your data in a machine-readable format
• Restriction: ask us to limit how we use your data
• Objection: object to processing based on legitimate interests, including for direct marketing
• Withdraw consent: where processing is based on consent
• Lodge a complaint: with your local data-protection authority

Exercise these rights via the User Rights Portal or email privacy@fav.ing. We respond within the timeframes required by law (generally 30 days; extendable when permitted).

We use cookies and similar technologies (SDKs, mobile advertising identifiers, local storage) for authentication, security, performance, analytics, and personalization. You can control these via your browser settings, your device's mobile-OS controls, and our Cookie Policy.

On iOS, we ask for your permission before tracking activity across other companies' apps and websites (Apple's App Tracking Transparency framework). You can change this at any time in iOS Settings.

We retain personal information only as long as needed for the purposes described in this Policy. Specific retention periods include:

• Account data (email, profile, lists, items, comments): for the lifetime of the account, plus up to 30 days after deletion to handle deletion processing and reversal of accidental deletions, after which data is purged or anonymized.
• Backup snapshots: up to 35 days, after which deleted records are removed in normal rotation.
• Analytics events (PostHog): up to 7 years in aggregated form; identifiable event data is purged when the account is deleted.
• Server logs and security events: up to 90 days, except where retention is required for incident investigation or legal obligations.
• Reports and abuse records: retained as long as needed for safety enforcement and to defend legal claims.
• Legal/compliance records (e.g., consent records, tax records): retained for the period required by applicable law.

After a retention period ends, we delete or anonymize the data so it can no longer be associated with you.

fav.ing is operated from the United States, and our service providers may process data in the U.S. or other countries. Where personal data is transferred from the EU/UK or other regions with cross-border transfer rules, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, supplemented by our service providers' technical and organizational measures.

fav.ing is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If we learn that we have collected such information, we will delete it. If you believe a child has provided us with personal information, contact privacy@fav.ing.

We may update this Policy. When we make material changes, we'll update the "Last updated" date and, where required by law, give you additional notice (in-app banner, email, or both). Continued use of the Service after the effective date means you accept the updated Policy.

Questions about this Policy or your personal data? Reach us at:

• Privacy & data rights: privacy@fav.ing
• General support: support@fav.ing
• Mailing address: Faving, Inc., 4564 Wolf Rd, Western Springs, IL 60558, USA

EU/UK users may also contact their local data-protection authority. California residents may contact the California Attorney General's office.