DOOMSDAY/DEFCON 5
...·...
PRIVACY & DATA PROTECTION // EFFECTIVE AUGUST 2026

PRIVACY POLICY

Your privacy and transparent data practices are fundamental to The Doomsday Clock. This document outlines what data is collected, how it is processed, and your rights.

Zero Stored Card Data

All credit card handling is tokenized directly via Stripe PCI-DSS Level 1 infrastructure.

Public Submissions

Name, @handle, message, and URL are broadcasted publicly on the global live leaderboard.

GDPR & CCPA Compliant

You retain the right to request deletion or redaction of personal public identifiers.

1. Overview & Commitment to Transparency

The Doomsday Clock is designed as a minimalist, privacy-first web application. We collect only the minimum information necessary to execute live countdown extensions, process secure payments, and display your promotional submissions on the public leaderboard.

We do not sell, rent, monetize, or broker your personal data to third-party advertisers or data aggregators.

2. Information We Collect

We categorize the data collected during your interaction with the platform into two distinct types:

A. Public Submission Information (User-Provided):
  • Contributor / Project Name: The display name you specify when saving the clock.
  • Social Handle: Your provided X (Twitter) or social handle.
  • Project URL: Your optional promotional website link.
  • Survival Broadcast Message: Your short message broadcasted to live visitors.
  • Contribution Amount & Timestamp: The dollar amount paid and the exact time of the transaction.

Notice: By submitting this information, you acknowledge that it is intended for immediate public broadcast on the global leaderboard and live ticker feeds.

B. Technical & Session Data:
  • Session Visitor Counter: A temporary flag stored in your browser's sessionStorage to prevent duplicate visit counting during a single browsing session.
  • Server Logs: Standard edge diagnostic logs (HTTP request method, response status, generalized user-agent) maintained transiently for security and performance optimization.

3. Financial Data & What We Never Store

We never collect, process, or store raw financial credentials on our servers. All financial transactions are processed directly by our merchant gateway, Stripe, Inc.

  • We never see or store full 16-digit credit card numbers, CVVs, or expiration dates.
  • We do not store passwords, bank account logins, or billing addresses.
  • Stripe transmits only a cryptographically verified webhook confirming the transaction amount and unique payment identifier (cs_test_... / pi_...).

4. Third-Party Infrastructure & Service Providers

To operate the real-time multiplayer protocol reliably, we integrate with trusted third-party cloud infrastructure providers:

  • Stripe (Payment Gateway): Handles encrypted payment transactions, fraud detection, and regulatory compliance. Governed by Stripe's Privacy Policy.
  • Supabase (PostgreSQL Database & Realtime Channels): Stores the public countdown state and broadcasts atomic clock updates via WebSocket channels worldwide.
  • Vercel (Hosting & Edge Compute): Delivers edge-cached frontend assets, serverless API execution, and dynamic OpenGraph image rendering.

5. Cookies & Local Storage Practices

We believe in a tracking-free web:

  • We do NOT use third-party advertising cookies or cross-site tracking pixels (e.g. Meta Pixel, Google AdSense).
  • We utilize ephemeral sessionStorage exclusively to count unique visitor sessions during your active tab session without tracking your identity across external websites.

6. Your Rights (GDPR, UK GDPR & CCPA/CPRA)

Depending on your location, you possess statutory rights regarding your personal data:

  • Right of Access & Portability: You may request a copy of the public submission entries associated with your payment reference.
  • Right of Erasure / Redaction: You may request that your display name, social handle, or website link be redacted or anonymized on the public leaderboard.
  • Right of Rectification: If a submitted broadcast contains an unintentional typographical error, you may request manual administrative correction.

To exercise any of these rights, please contact our administrative team via our official community support channels with proof of transaction (e.g. Stripe checkout receipt).

7. Data Security & Storage Architecture

We employ military-grade security safeguards:

  • All web traffic is strictly encrypted in transit using TLS 1.3.
  • PostgreSQL database tables are protected with strict Row Level Security (RLS) policies, ensuring write access is restricted exclusively to authenticated server-side API microservices via SUPABASE_SERVICE_ROLE_KEY.
  • Stripe webhooks are cryptographically validated using HMAC-SHA256 signature verification (stripe.webhooks.constructEvent()).

8. Changes to this Policy & Contact

We may update this Privacy Policy from time to time to reflect operational or regulatory changes. The date at the top of this page indicates when the latest modifications went into effect.

If you have questions, concerns, or data requests regarding this Privacy Policy, please reach out via our official Twitter/X communication channels.

TRANSPARENT & OPEN PROTOCOL

The clock is ticking. Learn the game rules or jump straight into the live command center.

LAUNCH COMMAND CENTER (LIVE CLOCK)VIEW OFFICIAL RULES