Privacy

Account details you give us: name, email, date of birth and country.

Social accounts you connect (up to three): your handle, account ID and public profile data such as name, bio, avatar, follower count and recent posts, refreshed daily. If you verify an Instagram account by messaging us, we read that message to confirm the code.

Profile photos you upload.

Your email if you sign up for updates.

To run your account, confirm you are 18 or older and in a supported country, verify the social accounts you connect, and send updates you asked for. We do not sell your data.

Only the services that run DamnReal, each processing data only to provide its service to us: Vercel (hosting), Supabase (our database, sign-in and file storage), Resend (sign-in emails, and the code we send to a school email), the platforms you connect, Apify (reads public Instagram and X profile data for us), OpenAI (checks your profile photos, answers and past work notes meet our standards; not used to train its models), Amazon Web Services (runs the optional human verification scan) and Stripe (processes tips and pays influencers out; Stripe collects an influencer's identity and bank details and a supporter's card details directly, and we never see full card or bank numbers). Tips are anonymous: an influencer sees the amount, the date and a reference for each tip, never who sent it. If you sign up through someone's referral link, we record that they referred you; they see counts on their profile, and once your referral counts, an email naming your @username. Your profile, including the social accounts and follower counts you connect, is public on DamnReal. We do not sell your data.

Connecting YouTube uses YouTube API Services. With your permission (the read-only youtube.readonly scope) we read your channel's ID, handle, name, description, avatar, country, creation date and public statistics: subscribers, videos and views. We use this only to confirm the channel is yours and show your audience on DamnReal.

We use that access once and revoke it right away; we never store your Google access token. After that we refresh your channel's public statistics daily through the YouTube Data API. We never post, upload, comment or change anything on your channel.

Who we share, transfer or disclose YouTube and Google user data to:

• Visitors to DamnReal: your channel's handle and subscriber count appear on your public DamnReal profile, where anyone, including brands and agents, can see them.
• Vercel, which hosts the servers that request and process this data, and Supabase, which stores it. Both act only on our instructions to run DamnReal.
• Authorities, only if the law requires it, or to protect the rights and safety of our users.

No one else. We never sell YouTube or Google user data, and we never transfer it to anyone for advertising, to data brokers or information resellers, to decide credit-worthiness or lending, or to train artificial intelligence or machine learning models. It is not sent to Apify, OpenAI or Amazon Web Services.

You can disconnect YouTube in DamnReal at any time, which deletes all YouTube data we hold immediately. You can also review or revoke Damn Real's access in your Google security settings.

By connecting YouTube you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. DamnReal's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting TikTok, X or Twitch uses their official login with read-only access to your profile and public stats. We never post, follow, comment or message for you. Disconnecting revokes our TikTok access and deletes everything we hold for that account.

To become verified as human, you can take a short live scan of your face from My profile. It is optional, and only you can start it. The scan runs through Amazon Rekognition (Amazon Web Services): it checks that a live person is at the camera, then compares that person to the profile picture on one of the social accounts you connected (any network; one match is enough), and to the photos on your DamnReal profile. We keep a copy of each connected account's profile picture for this comparison, and refresh it when the picture changes.

We do not keep the video, any frame of it, or any face template or measurement. We keep only the result: whether it passed, the similarity and liveness scores Amazon returned, and when. Amazon processes the scan to run the check, under its own terms, and we have opted out of Amazon using scans to improve Rekognition or its other machine-learning products. Its Rekognition FAQ explains how it handles data. If the profile picture your verification was matched to changes, we compare the new picture to your verified DamnReal headshot; if it no longer matches, or that account is disconnected, your verification is removed until you scan again. Deleting your profile deletes the picture copies and the results.

An influencer can add posts from their past work, with a short note on what they did. When they add one we ask that network who posted it, and only posts from the influencer's own connected account are accepted; the note is checked by OpenAI. We keep the network, the post's ID and the note, and a post is removed if the account it came from is disconnected. A post shows on their public page as a tap to load embed: nothing is requested from Instagram, TikTok, YouTube or X until a visitor taps it, and then that network's own player loads and its privacy policy applies to that visit. Influencers can remove a post at any time. To report a post, write to support@damnreal.com.

From My profile you can show the school you attend. You enter a school email, we send a code to it, and you enter the code. We use the address once, to send that code: we never save it, show it or share it. The code is worked out from the address and a secret on our servers, so there is nothing to store. It goes out through Resend, our email provider, which delivers it and keeps delivery records under its own policy.

What we keep is the school (its name, website and country) and the date you confirmed it, shown on your page as "Attends" only if you leave it on. A confirmation lasts a year; before it ends we email your sign-in address to ask you to confirm again, and until you do the line leaves your page. A school email shows you can read mail at that school; it does not prove you are enrolled. Removing the school deletes it. Our list of schools comes from the Research Organization Registry (CC0) and the U.S. Department of Education's IPEDS data. If your school isn't on it, you can ask us to add it: we keep only the school's name as you typed it and the part of your address after the @, with a count of requests, never the address and never who asked.

If you tap Use my location, your browser asks first. We use your position once, to suggest the cities nearest you, and never store it. We keep only the cities you pick. City names come from GeoNames (geonames.org), licensed under CC BY 4.0.

You can disconnect a social account at any time from your account, which deletes everything we hold for it. You can delete your whole profile yourself from My profile (below), or email support@damnreal.com and we will do it within 30 days.

Deleting your profile is immediate and can’t be undone. We delete your account, your sign-in, your profile and photos, your answers, collaborations and cities, every connected social account with its stats, history, posts and the profile picture copy, your face verification results, and our access to those networks where we held it.

Financial records are the one exception. Once DamnReal handles payments, records of money you were paid or that moved through DamnReal (amounts, dates and a reference for each side) go into a ledger that can only be added to: nothing in it is edited or erased, so it stays as long as tax, accounting and anti-fraud laws require and after you delete your profile. By then it holds no name, email, handle or photo, only a random internal ID that no longer points to anyone. It is used for nothing else.

DamnReal sets two kinds of cookie, both needed for the site to work, and no advertising or tracking cookies.

• Sign-in cookies (names starting sb-), set by Supabase when you sign in. They keep you signed in until you sign out, and they are the only way the site knows who you are.
• A referral cookie (dr_ref), set only when you open a link an influencer shared. It holds their username for 30 days so the referral counts if you join, and is removed when you choose an account type.

Your theme (light or dark), whether you have seen the cookie notice and whether you have visited the board are kept in your browser’s own storage, not in cookies, and never leave your device. A bot check runs in your browser before a few actions (sending a tip, uploading a photo, finding an Instagram account, sending a school code); it tells us only whether a browser or a script asked. Our hosting measures page speed without cookies or any identifier. Stripe sets its own cookies inside its checkout frame when you send a tip, under its policy.

Questions: support@damnreal.com