1. Overview
The RPM Challenge ("we," "us," or "our") is operated by Unpossible Creative Corp, a registered nonprofit organization in Newfoundland and Labrador, Canada (corporation number 77547).
We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your data when you use our platform at rpmchallenge.com (the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information You Provide Directly
Registration & Account Creation
- Email address (required for account creation and verification)
- Username (chosen by you or auto-generated from your email)
Onboarding Process
- Biography/bio text (optional)
- Profile avatar image (optional)
- Password (optional - you can choose magic link authentication instead)
- Island selection (required - your cohort group)
- RPM 2026 Challenge signup preference (optional checkbox)
Profile Information
- Username, bio, website URL, location (all optional except username)
- Avatar image and cover image (optional)
- All profile information except email is publicly visible
Community Content
- Posts (text up to 1,900 characters)
- Images attached to posts
- Audio files attached to posts (including embedded metadata like artist/title)
- Hashtags and mentions in posts
- Comments and replies to other posts
- Reactions (emoji reactions to posts)
- Visibility settings for posts (public or island-only)
Playlists
- Playlist name and description
- Track information and selections
- Public/private visibility settings
Social Interactions
- Users you follow and who follow you
- Notification preferences
- Blocked accounts list
2.2 Information Collected Automatically
Authentication Data
- Session tokens and authentication cookies (managed by Supabase)
- Login timestamps and authentication method used
- Magic link verification tokens (temporary, expired after use)
Usage Information
- Pages visited and features used
- Browser type and device information
- IP addresses (logged by hosting services)
2.3 Default Generated Content
Avatar Generation: If you don't upload an avatar, we generate one using the Dicebear API (https://dicebear.com). This uses your username as a seed - no personal data is sent to Dicebear.
3. How We Use Your Information
We use your information for the following purposes:
Core Service Delivery
- Creating and managing your account
- Enabling you to participate in the RPM Challenge community
- Displaying your profile and content to other users (based on visibility settings)
- Facilitating connections with your island cohort members
- Providing access to Island Chat (spatial audio features)
Communication
- Sending authentication emails (magic links, verification emails)
- Sending notification emails about interactions (if enabled)
- Sending weekly digest emails (if enabled)
- Sending official RPM Challenge updates and announcements
Platform Improvement
- Understanding how users interact with the platform
- Improving features and fixing bugs
- Ensuring platform security and preventing abuse
Legal Compliance
- Complying with applicable laws and regulations
- Responding to legal requests and preventing fraud
- Enforcing our Terms of Use
4. How We Store Your Information
4.1 Database Storage (Supabase PostgreSQL)
Your account and community data is stored in a Supabase PostgreSQL database, which includes:
- User profiles and authentication records
- Posts, comments, and reactions
- Follows, notifications, and island memberships
- Playlists and social interactions
Security: Industry-standard encryption at rest and in transit
Supabase Privacy Policy: https://supabase.com/privacy
4.2 Media Storage (DigitalOcean Spaces)
Media files you upload are stored on DigitalOcean Spaces with CDN delivery:
- Avatar images (folder: community/avatars/)
- Cover images (folder: community/covers/)
- Post images (folder: community/images/)
- Audio files (folder: community/audio/)
Location: NYC3 region (New York)
File Naming: Files are named with your user ID and timestamp
DigitalOcean Privacy Policy: https://www.digitalocean.com/legal/privacy-policy
4.3 Data Retention
- Active Accounts: Your data is retained as long as your account is active
- Deleted Content: When you delete posts or media, files are removed from both database and storage (though CDN caching may persist briefly)
- Inactive Accounts: We may delete accounts inactive for extended periods after email notification
5. Third-Party Services
We use the following third-party services that may collect or process your data:
Supabase (Authentication & Database)
Purpose: User authentication, session management, database storage
Data Shared: Email, session tokens, all platform data
Privacy Policy: https://supabase.com/privacy
DigitalOcean Spaces (Media Storage)
Purpose: Storing and delivering uploaded images and audio files via CDN
Data Shared: Media files you upload, file metadata
Privacy Policy: https://www.digitalocean.com/legal/privacy-policy
ChatHack (Island Chat)
Purpose: Spatial audio chat for island cohorts
Data Shared: Username, user ID, island information
Usage: Only when you access Island Chat feature
Dicebear API (Avatar Generation)
Purpose: Generating default avatars if you don't upload one
Data Shared: Username (used as seed for avatar generation)
Privacy: No data is stored by Dicebear; avatars generated on-demand
7. Your Rights and Controls
You have significant control over your data and how it's used:
7.1 Content Deletion Rights
YOU CAN DELETE YOUR OWN CONTENT AT ANY TIME:
- Delete individual posts (including associated media files)
- Delete playlists
- Remove uploaded images or audio files
- Content deletion is immediate and permanent (no admin approval needed)
7.2 Account Controls
- Update Profile: Change username, bio, avatar, and cover image anytime
- Privacy Settings: Control post visibility (public vs. island-only)
- Notification Preferences: Toggle email notifications, push notifications, weekly digest
- Block Users: Block accounts you don't want to interact with
- Hide Visibility: Hide your project visibility from search/listings
7.3 Data Access and Portability
You have the right to:
- Access: Request a copy of all your personal data
- Export: Download your posts, playlists, and profile information
- Correct: Update incorrect information in your profile
- Request: Email info@rpmchallenge.com for data access requests
7.4 Account Deletion
To delete your account:
- Email info@rpmchallenge.com with "Account Deletion Request"
- We will delete your account and associated data within 30 days
- Note: Public posts may be cached by search engines or archived by third parties before deletion
8. Age Requirements and Parental Consent
8.1 Age Requirement
The RPM Challenge is open to users aged 13 and older.
If you are under 13 years old, you may not create an account or use the Service.
8.2 Users Ages 13-17 (COPPA Compliance)
If you are between 13 and 17 years old:
- You must have permission from a parent or legal guardian to use the Service
- Your parent/guardian should review this Privacy Policy
- We collect the same information from users 13-17 as we do from adult users
- Parents may request to review, delete, or stop further collection of their child's information by emailing info@rpmchallenge.com
8.3 Parental Rights
Parents or legal guardians of users under 18 have the right to:
- Review their child's personal information
- Request deletion of their child's account and data
- Refuse to allow further collection of information
- Contact us at info@rpmchallenge.com for any concerns
9. Security Measures
We take reasonable steps to protect your information:
- Encryption: All data transmitted using HTTPS/TLS encryption
- Authentication: Secure session management via Supabase Auth
- Access Control: Database access restricted to authorized personnel only
- File Security: Media files stored with access controls and secure naming
- Password Storage: Passwords encrypted using industry-standard hashing
However: No internet transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
11. International Users and Data Transfers
The RPM Challenge is based in Newfoundland and Labrador, Canada. Our services are hosted in:
- Supabase: Cloud-hosted database
- DigitalOcean Spaces: NYC3 region (United States)
By using the Service, you consent to your data being transferred to and processed in these locations, which may have different privacy laws than your country of residence.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do:
- We will update the "Effective Date" at the top
- We will notify you via email if changes are material
- We may display a notice on the platform
- Your continued use of the Service after changes means you accept the updated policy
13. Contact Us
If you have questions or concerns about this Privacy Policy or your data:
Email:
Legal Entity:
Unpossible Creative Corp
Corporation Number: 77547
Location: Newfoundland and Labrador, Canada
For data access requests, account deletion, or parental inquiries, please include relevant details in your email.