Privacy Policy

• Email address (for the original Space Kit waitlist, optional boarding-pass launch alerts, Magic Link sign-in, and updates you subscribe to)
• Order and fulfillment information: name, email, phone, shipping address, order items, customization text, coupon code, and order notes collected during checkout.
• Payment information: payment provider, payment status, provider session / transaction identifiers, and limited payment metadata returned by the provider. We never receive or store your full card number, card security code, private wallet key, or seed phrase.
• Country (derived from IP via Cloudflare; not GPS or precise location)
• IP hash (SHA-256, irreversible) and device fingerprint (FingerprintJS) — used only for fraud detection
• Optional survey answers (preferred destination, source, role)
• Google OAuth profile data when you choose Google login: email address, Google account ID, display name, and profile picture if provided by Google.
• Passkey credentials: public key, credential ID, sign-in counter, device label, and transport hints. We never receive or store your fingerprint, face data, or device unlock secret.
• First-party anonymous behavior analytics: page views, referrer host, country, device type, section visibility time, image/video/game interactions, checkout funnel steps, and payment success events. We do not record checkout form contents, raw IP addresses, emails, phone numbers, shipping addresses, or typed messages in analytics.
• Photo wall uploads (only after explicit user submission, with moderation)
• Project feedback you choose to submit (the current invitation form focuses on the boarding-pass project): the initial suggestion and any later additions in the same private receipt; optional reference images, short videos or documents; optional name, contact email, and role or professional background; the source page and limited anti-abuse data.

• Notify you when the Kickstarter goes live
• If you separately sign up and confirm your email, send boarding-pass launch alerts and important product updates. This list is separate from the older Space Kit waitlist; existing waitlist addresses are not imported automatically. You may unsubscribe at any time.
• Track referral conversions and issue digital / physical rewards
• Create orders, process payment status, arrange shipping, provide customer support, and handle order issues.
• Authenticate accounts with email verification code, Google OAuth, or Passkey sign-in.
• Send mission updates (drip emails) — unsubscribe at any time
• Aggregate, anonymized analytics for product improvement
• Review project suggestions and later additions privately, track their status, and respond about a suggestion only if you provide a contact email. A feedback email is not added to a marketing or launch-alert list. We request separate permission before publicly quoting your words or displaying your materials, name, or role.
• Your submitted work remains yours. The initial submission only permits Vokar to read and evaluate it privately; using a complete original design or other work in a commercial product requires a separate agreement.

• Performance of a contract: checkout, payment status, shipping, account access, and order support.
• Consent: marketing emails, photo wall submissions, project feedback, optional surveys, and non-essential advertising or third-party analytics tools if enabled later.
• Legitimate interests: fraud prevention, site security, abuse prevention, internal diagnostics, first-party anonymous behavior analytics, and improving our products.
• Legal obligations: tax, accounting, sanctions screening, and compliance recordkeeping where required.

• Sell your data to third parties.
• Send marketing emails outside the updates you signed up for.
• Track you across other websites.
• Share personal data for cross-site behavioral advertising.
• Profile minors. (We do not knowingly collect data from anyone under the age of 16, unless local law allows a lower age with valid guardian consent.)

• Cloudflare — CDN, DDoS protection, HTTPS
• Resend — Email delivery, including verification and updates you subscribe to
• Stripe — Card payment processing when enabled
• PayPal — PayPal payment processing when enabled
• NOWPayments — Previously used for crypto payment processing. Crypto checkout is currently paused; Vokar retains related historical payment identifiers and status with order records for reconciliation, support, refunds where applicable, dispute handling, tax, accounting, and compliance.
• Kickstarter — Campaign hosting; their privacy policy applies separately
• Etsy — External purchase of Starship and Card Holder products
• Google OAuth — Optional Google sign-in when enabled
• FingerprintJS — Device fingerprinting for fraud prevention
• Reown / WalletConnect — Previously used to connect wallets for the now-paused crypto checkout; analytics were disabled in our app configuration. Vokar retains related historical payment records as described in this policy.

We use first-party anonymous behavior analytics to understand whether real visitors can find the product, which sections hold attention, which media gets opened or watched, and where the purchase funnel drops off. This analytics system runs on vokar.studio and is used for product improvement, security diagnostics, and checkout reliability.

We do not record checkout form contents, address fields, email fields, phone fields, card details, private wallet keys, raw IP addresses, full user-agent strings, keystrokes, screen recordings, or heatmap recordings. IP and user-agent values may be hashed for bot and abuse filtering only.

We do not currently use Google Analytics, Meta Pixel, TikTok Pixel, or cross-site advertising tracking. If we add advertising pixels or third-party non-essential analytics later, we will update this policy and request consent where required.

• Verified email accounts: until you request deletion
• Pending account email verification: 48 hours, then automatically purged
• Boarding-pass alert confirmation links expire after 48 hours; unconfirmed alert requests are cleaned up periodically. After you unsubscribe, we keep a suppression record to prevent further alerts until you request deletion.
• Orders and fulfillment records: kept as long as needed for delivery, customer support, tax, accounting, chargeback, and compliance purposes.
• Payment provider identifiers and payment status: kept with the order record for reconciliation, support, refunds where applicable, and dispute handling.
• Email verification code records: 10 minutes until expiry; stored as a hash, not the plain verification code.
• Google OAuth temporary state cookies: 10 minutes, then deleted after callback or expiry.
• Anonymous boarding pass previews: 180 days
• Project feedback, later additions, optional contact details, and private attachments: retained for 365 days after the original submission, even if you add more later, and removed by the next daily cleanup. You can request earlier withdrawal using the private receipt or by contacting us.
• Server access logs: 90 days
• Referral records: 5 years (audit/compliance)

For project feedback, keep your private receipt link to add later suggestions, view the status, or request withdrawal. If you lose the link, contact [email protected]; we may need to verify that you are the original submitter before changing or deleting the submission.

We currently use only essential cookies and localStorage for login, language, preview access, referral attribution, cart, checkout continuity, and first-party anonymous behavior analytics. We do not currently use advertising pixels or third-party non-essential behavior analytics cookies. If we add them later, we will request consent where required.

• vokar-user — user account session, 60 days
• vokar-admin — admin session for internal operations, 30 days
• vokar-gate — private preview access gate, up to 1 year while preview mode is enabled
• vokar-boarding-preview — scoped boarding-pass invitation access, until the invitation expires
• vokar-goog-state / vokar-google-state — Google OAuth CSRF state token, 10 minutes
• vokar-goog-next — Google OAuth return path, 10 minutes
• lang — language preference, 1 year
• vokar-cart — localStorage cart data, kept on your device for checkout continuity
• vokar-analytics-session / vokar-analytics-anon — sessionStorage and localStorage anonymous analytics identifiers for first-party aggregate reporting