Working draft: pending legal counsel review
This page is not yet legal advice and is not a binding agreement. It will be finalized before launch. Questions in the meantime: joel@lettuceplay.gg.
FN Analytica: Privacy Policy
Version: 1.0 Effective date: [SET TO PUBLICATION DATE]
1. Who we are
FN Analytica is operated by 4reel Pty Ltd (ACN 646 628 159, ABN 13 646 628 159), trading as Lettuceplay, based in New South Wales, Australia ("we", "us", "our"). FN Analytica is a market-intelligence and analytics service for Fortnite UEFN/Creative creators.
We voluntarily comply with the Australian Privacy Principles even where the small-business exemption might otherwise apply, because we handle creator and visitor personal information and operate internationally. This policy explains what personal information we collect, why, who we share it with, and your rights.
Privacy contact: joel@lettuceplay.gg (a postal address can be added if you prefer a PO box; a street address is not required for this policy).
2. What we collect
Account data: email address, display name/username, authentication provider (email/password, stored only as a salted hash, never in plain text, or Google / Discord OAuth identifiers), account role and plan.
Billing data: handled by Stripe. We store your subscription status, plan, and Stripe customer/subscription identifiers. We never see or store card numbers.
Content you upload: Fortnite Creator Portal analytics exports and island claim/verification data you submit. These describe your islands' audience in aggregate (plays, retention, regions); they are not profiles of individual players.
Beta signups: if you register interest via the `/beta` page, we collect the email address you provide and where you signed up from (e.g. a specific announcement link), with your consent, to invite you to the beta and send launch updates. No account is created from this alone. You can unsubscribe or ask us to delete the record at any time (see sections 7 and 9).
Usage data: pages viewed, features used, timestamps, and technical logs (IP address, browser type) for security, rate limiting, and product improvement.
Public creator information: we collect and process publicly observable Fortnite ecosystem data about islands and their creators, including for creators who have never registered with us. This is detailed in section 3A.
We do not knowingly collect personal information from children under 16. Use by 16-17 year olds requires parent/guardian consent, and account ownership and paid subscriptions require you to be 18 or over (see the Terms of Service).
3. Why we use it (purposes and legal bases)
| Purpose | Data | GDPR legal basis (where applicable) |
|---|---|---|
| Provide the Service (accounts, analytics, portal) | account, content, usage | Contract |
| Billing and subscription management | billing | Contract / legal obligation |
| Security, fraud and abuse prevention, rate limiting | usage, technical logs | Legitimate interests |
| Product improvement and aggregated statistics | usage, de-identified content | Legitimate interests |
| Service/relationship emails (verification, invites, receipts, alerts you enable, and the weekly report - sent to account holders, unsubscribe any time) | account | Contract / legitimate interests for the weekly report as part of the account relationship; disclosed at signup with a working unsubscribe |
| Marketing emails (product news, beta/launch announcements) | account or beta-signup email | Consent (express opt-in, with one-click unsubscribe) |
| Win cards and marketing showcase (see section 3B) | display/creator name, island name and code, the public metrics behind a detected breakout | Legitimate interests |
| Public ecosystem intelligence (Discover, Intelligence, Breakouts, Weekly Report) | public creator information (section 3A) | Legitimate interests |
| AI-drafted weekly commentary (see section 3C) | aggregate ecosystem statistics only (no personal or uploaded data) | Legitimate interests |
We do not disclose personal information to third parties for their own marketing. Our processors (section 4) handle data only on our instructions.
3A. Public creator information
FN Analytica's core product describes the public Fortnite Creative ecosystem, so we collect and process information that is already public, including about creators who have never registered.
- ·Sources: Epic Games' public APIs and publicly visible Discover surfaces; public third-party data sources (e.g. fortnite.gg); and, during our data infrastructure migration, a third-party data warehouse.
- ·What we collect: creator display name, island code, island name, public performance metrics (plays, players, retention where public, CCU), Discover/genre placements, and the associated dates.
- ·Why: to produce ecosystem trends, benchmarks, genre rankings and breakout signals - the information layer of the product.
- ·Your control (registered or not): any creator can ask us to access, correct, object to, or request removal of information associated with them, via the privacy contact in section 1. We honour requests consistent with APP 5 (information collected indirectly) and, where applicable, GDPR Article 14.
3B. Win cards
When the Service detects a significant improvement ("breakout") on an island you have verified as yours, we automatically generate a branded image (a "win card") showing your island's name and code, your creator name, and the public performance metrics behind the breakout. We keep a copy of each win card and may use it in our own marketing and social media as social proof of creator success. Win cards contain only information already publicly visible on the Service; they never include your private uploaded data. If you use the share feature, the card also appears on a public page on our site.
Takedown / opt-out: you can ask us to stop using a specific win card, or to opt out of win-card marketing entirely, at any time via the privacy contact in section 1; we will stop within a reasonable period and remove any public share page for it.
3C. AI processing
We use the Anthropic (Claude) API to draft the narrative commentary in our Weekly Report from aggregate ecosystem statistics only. This pipeline does not send your account details, your uploaded Creator Portal data, or any individual island's private data to any AI provider. The Daily Island Brief and all per-island analytics are generated by our own rule-based logic, not AI. Under Anthropic's commercial API terms, inputs are not used to train their models.
4. Who we share it with (processors)
Service providers that process data on our behalf, under their own safeguards and our instructions. Current processors and their primary processing locations:
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | United States (us-east-1) |
| Vercel | Application hosting | United States (iad1) |
| Google BigQuery | Data warehouse | United States |
| Stripe | Payments | United States / global |
| Resend | Transactional and report email | United States |
| Upstash | Rate limiting | United States (us-east-1) |
| Anthropic | AI-drafted weekly commentary (aggregate data only, section 3C) | United States |
| Google / Discord | OAuth sign-in, only if you choose them | United States / global |
Product analytics (PostHog) and error tracking (Sentry) are not currently active. We will update this list and, where required, obtain consent before enabling any new processor. We may disclose information if required by law, or in a business sale/restructure (with notice).
5. International transfers
We are based in Australia; our processors store data primarily in the United States. Where GDPR/UK GDPR applies, transfers rely on the providers' standard contractual clauses or adequacy mechanisms. We identify the destination country (the United States) as required by APP 8.
6. Retention
We keep personal information only as long as needed for the purpose it was collected, then delete or de-identify it. Indicative periods (to be verified against implementation, including backups):
| Category | Retention |
|---|---|
| Account and uploaded content | Life of the account, then deleted/de-identified within 90 days of deletion [OPS: confirm incl. backups] |
| Billing records | |
| Beta signups + consent records | Until the invite is sent, or 12 months if unused, whichever is sooner |
| Authentication and audit logs | 12 months |
| Email delivery logs | 12 months [OPS: confirm against Resend] |
| Support correspondence | 24 months |
| Public creator history | Retained as ecosystem history; subject to the removal right in 3A |
| Win cards and public share pages | Life of the account or until takedown (3B) |
| Cookie identifiers | Per section 9 |
| AI prompts/outputs | Aggregate only; not retained beyond report generation |
| Aggregated, de-identified statistics | May be retained indefinitely |
7. Your rights and how to complain
Everyone: access, correct, or delete your personal information; close your account; unsubscribe from optional emails; request removal of public information associated with you (section 3A). Contact the privacy address in section 1. We acknowledge requests promptly and respond within 30 days.
Complaints: if you are unhappy with how we handle your information, contact us first at the privacy address; we will investigate and respond in writing, normally within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC, oaic.gov.au), or, in the EU/UK, your local supervisory authority.
EU/UK (GDPR), where applicable: additionally portability, restriction, objection, and withdrawal of consent. California (CCPA), where applicable: know, delete, correct, and non-discrimination; we do not sell personal information.
8. Security
Row-level security on user data, encrypted transport (TLS), encryption at rest via our providers, server-side-only service credentials, scoped API access, and rate limiting. No system is perfectly secure. We notify affected individuals and regulators of eligible data breaches as required by the Notifiable Data Breaches scheme and, where applicable, GDPR.
9. Cookies
| Cookie | Provider | Purpose | Duration | Type | Account-linked | Consent |
|---|---|---|---|---|---|---|
| Session/auth cookies | FN Analytica (Supabase) | Keep you signed in | Session / rolling | Strictly necessary | Yes (when signed in) | Not required |
| `fna_aid` | FN Analytica | Anonymous visitor analytics | 1 year | Analytics (non-essential) | Linked to your account while signed in | Required in EU/UK |
| `fna_sid` | FN Analytica | Session-level analytics | 30-minute rolling | Analytics (non-essential) | Linked to your account while signed in | Required in EU/UK |
`fna_aid`/`fna_sid` hold a random identifier. A persistent pseudonymous identifier, combined with browsing activity, IP address, and (when signed in) your account, can constitute personal information, so we treat these cookies as processing personal data - they are not "anonymous" in the strict sense.
The analytics cookies are non-essential and remain disabled until consent is given. A cookie-consent banner is shown to every visitor (not geo-scoped to EU/UK specifically, so it never under-protects an EU/UK visitor the way an imperfect geo-IP match could) - `fna_aid`/`fna_sid` are only minted after Accept, and PostHog only captures after an explicit opt-in via its own built-in consent API. We will add any PostHog analytics cookies to this table before enabling them.
10. Changes
We will post updates here and give notice of material changes by email or in-app, with the version and effective date. Where a change relies on a new use of your personal information that requires consent, we will seek fresh consent rather than relying on continued use.
