Privacy Policy

The Spooniverse is a patient reference platform operated by Timeless Biosciences LLC (“we,” “us,” or “our”), a Georgia limited liability company. This Privacy Policy explains how we collect, use, and protect information when you use our website at thespooniverse.org (the “Service”).

We are committed to handling your information with care. Because our users include people with complex chronic illnesses, we take data privacy seriously and collect only what is necessary to operate the Service.

Information collected when you create an account:

You may sign in using one of two passwordless methods. We do not collect or store passwords under either method.

• Magic link email: you provide your email address and receive a one-time sign-in link delivered via Resend. We store your email address to maintain your account.
• Google OAuth: you sign in using your existing Google account. Google provides us with your name, email address, and Google account identifier. We do not receive your Google password.

Information collected when you contact us: your email address and message content.

Information collected automatically:

• Vercel Analytics collects aggregated, anonymous usage data including page views, referral sources, and general geographic region (country/region level). This data is not linked to your account and does not identify you personally.
• Standard server logs may capture IP addresses and browser metadata for security and operational purposes. These are not used for tracking or profiling.

What we do not collect:

We do not store passwords, browsing behavior, search queries, saved treatments, or any record of which conditions or treatments you have viewed. Your activity on the platform is not logged or profiled.

Payment information: Payment card data is collected and processed directly by Stripe, Inc. We receive only a confirmation of successful payment and a Stripe customer identifier. We never see or store your card number, CVV, or billing address.

We use the information we collect for the following purposes:

• Account management: to create and maintain your account, verify your identity, and provide access to paid features
• Transactional email: to send magic link sign-in emails, account confirmations, and service-related communications via Resend
• Security: to detect and prevent fraudulent or unauthorized use of the Service
• Service improvement: to understand aggregate usage patterns via Vercel Analytics and improve the platform
• Legal compliance: to comply with applicable laws, including Georgia's data breach notification requirements

We do not sell your personal information. We do not use your information for behavioral advertising or cross-site tracking.

We share your information only with the following service providers, who act as data processors on our behalf:

Each provider is bound by their own privacy policies and applicable data protection laws. We do not authorize these providers to use your data for their own marketing purposes.

The Spooniverse is a platform for people managing complex chronic illnesses. We recognize that your presence on this platform may itself be sensitive: it could imply that you or someone you care for lives with a condition such as ME/CFS, Long COVID, POTS, MCAS, EDS, or fibromyalgia.

We take this seriously. Specifically:

• We do not log which treatments, biomarkers, or conditions you view
• We do not build health profiles linked to your account
• We do not share any user data with pharmaceutical companies, insurers, employers, or data brokers
• We do not use your information for research purposes without your explicit consent

The Spooniverse is a reference tool, not a clinical service. We are not a covered entity under HIPAA, and this policy does not constitute a HIPAA-compliant notice of privacy practices. If you are seeking clinical care, please consult a licensed healthcare provider.

We retain your account information for as long as your account is active or as needed to provide the Service. If you request deletion of your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law or for legitimate business purposes such as resolving disputes or enforcing our agreements.

Stripe retains payment records in accordance with their own data retention policies and applicable financial regulations.

You have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate information
• Deletion: request deletion of your account and associated personal data
• Objection: object to certain uses of your information
• Portability: request your data in a portable format where technically feasible

To exercise any of these rights, contact us at info@thespooniverse.org. We will respond within 30 days. We may need to verify your identity before processing your request.

We implement reasonable technical and organizational measures to protect your personal information, including encrypted connections (HTTPS), access controls, and use of reputable infrastructure providers. Our passwordless authentication model eliminates password-related attack vectors such as credential stuffing and brute force attacks.

No system is completely secure. In the event of a data breach affecting your personal information, we will notify affected users in accordance with Georgia's data breach notification law (O.C.G.A. § 10-1-912) and any other applicable requirements.

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we become aware that a user is under 18, we will delete their account and associated data promptly. If you believe a minor has created an account, please contact us at info@thespooniverse.org.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, the right to opt out of its sale (we do not sell personal information), and the right to non-discrimination for exercising your rights.

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. For material changes, we will notify registered users by email. Continued use of the Service following notice of changes constitutes acceptance of the revised policy.