Privacy policy.

1. What we collect

What	Why
Name, email, password	To run your account. Passwords are stored hashed. We cannot read yours, and neither can anyone who obtained the database.
Phone number	Only if you give us one. Used for order questions, never sold.
What you licensed, and when	Your library, and the proof of what you are entitled to use. We keep this for as long as the license lasts, which is permanently.
Download records: the file, the time, your IP address and browser	To enforce the daily fair-use ceiling and to investigate license abuse. Kept 12 months, then the IP and browser are cleared.
Orders and shipping addresses	To make and send a print, and to keep the tax and accounting record the law requires. Order records are kept 7 years for that reason.
Searches you run	The words, the filters and how many results came back, so we know what the library is missing. Attached to your account only if you are signed in.
What you ask Spearhead Scout	Your messages and its replies, so a conversation can carry on where it left off. Kept with your account.
Your Instagram connection and scheduled posts	Only if you connect an account to Spearhead Social: the account name, a posting key (stored encrypted), and the posts, captions and times you schedule.
Marketing consent	The date you agreed to be emailed, and the date you opted out. We keep both, because being able to prove consent is the point of asking for it.
Contributor details	Your display name, bio and payout account identifier. Bank details and taxpayer information go to Stripe, not to us. We hold only an account reference.

We do not collect anything about your race, health, politics, religion, precise location or biometrics, and we have no use for it.

2. Cookies and measurement

One cookie is strictly necessary: the session that keeps you signed in. It cannot be switched off without breaking sign-in, and it carries no advertising identifier.

Nothing that could identify you across sites loads unless you say yes. The banner offers Accept all, Only necessary (one click, and just as prominent), and Manage choices, which has a switch for each kind: Necessary (always on, it keeps the site working), Analytics (helps us see how the site is used) and Marketing (lets us and our partners show you more relevant content and ads). Nothing but the necessary loads before you choose. Your choice is remembered in your own browser, in a cookie called sh_consent, for a year, and you can change it at any time from Your privacy choices at the foot of every page. If your browser sends a Global Privacy Control signal, Marketing stays off whatever is pressed.

With Analytics on, the Google tag measures how the site is used. With Marketing on (Accept all turns on both), the Meta Pixel and Google's ad measurement load as well. They set their own cookies and tell Meta and Google which of our pages you viewed, and when you add something to your cart, start checkout, create an account, join or complete an order, what it was and its value, so we can see which ads bring people here and show our ads to people likely to want them. Meta and Google handle that under their own privacy policies.

Our server also tells Meta about the same visits and purchases directly (Meta calls this the Conversions API), only with Marketing on, so the count holds up when a browser blocks the tag. With each event it sends your IP address, your browser's name, Meta's own cookie ids, and, if you are signed in, your email address and our account number for you in a scrambled, one-way form (a SHA-256 hash) that Meta can match to an account it already knows but cannot read back. Your name, address and payment details are never sent. If you later switch Marketing off, nothing more is sent, the tags stop loading and the cookies they set on this site are cleared.

What runs without consent is deliberately anonymous: which page, how long, no identifier, nothing shared with anyone. It is how we learn which neighborhoods people look for without tracking who looked.

3. Who else sees it

Only these, only for these reasons, and none of them may use it for their own marketing, except the two advertising tags you choose to accept (section 2).

Who	What they get
Stripe	Your name, email and payment details, directly. Card numbers never touch our servers. For contributors, Stripe also collects bank and taxpayer details for payouts and issues tax forms. Stripe is the payment processor and, for payouts, an independent controller of the details you give it.
Prodigi	The print you ordered and the name and address it ships to. Nothing else, not your account, not your other orders.
Resend	Your email address and the message, so receipts, reset links and notices arrive.
Anthropic	The AI model behind Spearhead Scout. It receives what you ask Spearhead Scout, the sentence you give Spearhead Social, and the details a caption is written from. For contributors, it also receives an uploaded photograph or frames of a clip, to suggest a title and tags. Anthropic processes this for us and does not use it to train its models.
Meta (Instagram)	Only if you connect Instagram: the posts and captions you schedule, sent when each is due, and the view and like counts Instagram reports back.
Meta and Google (advertising)	Only with Analytics or Marketing on (the Meta Pixel, the Conversions API and ad measurement only with Marketing): the pages you view here, and when you add to your cart, check out, sign up, join or complete an order, what it was and its value, through the Meta Pixel and the Google tag. Our server sends Meta the same events with your IP address, browser and, when signed in, your email and account number hashed. They use it under their own policies to measure and target ads.
Amazon Web Services	Hosting for the media library. Files, not personal data.
DigitalOcean	The server this site runs on, in the United States.
GoHighLevel	Where our customer records are synchronized, when that is switched on: your name, email, your membership, what you have bought, and whether you asked for our emails.

We do not sell personal information, for money or anything else. We do share it for advertising, and only if you say yes. With Marketing on, the Meta Pixel, Meta's Conversions API and the Google tag let Meta and Google see which of our pages you visit and what you add to your cart, sign up for or buy here, with its value, and use that to measure our ads and to show them to you and to people like you on their own sites and apps. The California Consumer Privacy Act calls that sharing personal information for cross-context behavioral advertising. What is shared: identifiers (your IP address, your browser, Meta's and Google's cookie ids, and, if you are signed in, your email address and our account number for you, both hashed), your activity on this site, and what you bought.

Your choice, and how to change it. Nothing is shared unless you press Accept all or switch Marketing on. You can stop it at any time from Your privacy choices at the foot of every page: switch Marketing off, or choose Only necessary, and nothing more is shared, the tags stop loading and the cookies they set on this site are cleared. A browser that sends a Global Privacy Control signal is treated as having switched Marketing off. We do not knowingly share the personal information of anyone under 16, and we do not use or share sensitive personal information for advertising.

4. Your rights

Wherever you are, you can ask us to:

• Tell you what we hold about you, and where it came from.
• Correct it: most of it you can correct yourself on your account page.
• Delete it. You can do this yourself: Account, Delete account on the website, or the same in the app. You can also ask us. We keep only what we are required to: order and tax records for seven years, and the record of a license for as long as that license is valid, because it is the proof of what you are entitled to use. Both are kept without your name on them.
• Send you a copy in a portable form.
• Stop emailing you. Every marketing email has an unsubscribe link, and it works immediately. Receipts, reset links and renewal notices are not marketing and continue. They are part of the service you bought.

Ask at info@spearheadmedia.com. We answer within 45 days, and we will not treat you differently for asking. California residents may also authorize an agent to ask on their behalf.

5. Keeping it safe, and for how long

Everything is served over HTTPS. Passwords are hashed. Payment details never reach our servers. Reset links are stored hashed, expire in an hour and work once. Admin access is restricted to named staff accounts.

No system is perfect and we will not pretend otherwise. If a breach affects your personal information we will tell you, and within the time the law requires.

We keep account data while your account exists. When you delete your account it closes at once: you are signed out everywhere and your membership stops renewing. It is erased 7 days later. Signing in during those 7 days cancels the deletion, in case it was a mistake. The exceptions are the accounting and license records described above.

Our backups are copies of the whole database, kept so the service can be restored after a failure. An erased account can remain in them until they roll off: daily backups are kept for 30 days and one backup a month for 12 months. They are held privately and used only to restore the service, never to bring an erased account back.

6. Children, transfers and changes

This is not a service for children. It is sold to businesses and professionals, and we do not knowingly collect anything from anyone under 16. If we learn that we have, we delete it.

Everything is stored in the United States. If you use the site from outside it, your data is transferred here, and by using the site you agree to that.

If the business is sold, customer records may transfer with it. You would be told before that happened and the buyer would be bound by this policy until it changed.

Changes. We will post them here with a new date, and tell you by email if they are material.

Contact. Spearhead Media LLC, San Diego, California. info@spearheadmedia.com.