Privacy Policy.

1. Who we are

Smile To Win Fridays is a weekly sneaker giveaway platform, with a companion shop, run by SmilezKickz ("we", "us"). This policy explains what we collect when you use the website, the app, or the shop — and, separately, what we collect if you simply comment on our Instagram posts — why, and what control you have over it.

2. What we collect

• Account info — email address and password (handled by our authentication provider, Supabase; we never see your raw password).
• Profile info — handle/username, bio, gender, date of birth, city and country, sneaker brand and style preferences, Instagram handle if you add one.
• Photos — your entry selfie (face + shoe) and any extra profile photos you upload, stored via Supabase Storage and Cloudinary (our image hosting provider, which also generates resized thumbnails). Photos are checked for a visible face and shoe using on-device detection before upload; we don't run facial recognition or identify you from the photo.
• Activity — votes cast and received, battles played, messages sent between members, referrals, challenge completions, and points/wins earned.
• Orders & payments — if you buy something from the shop, we store your email, shipping address, and what you ordered so we can fulfil it. Your card details go straight to our payment processor, Stripe, on Stripe's own secure checkout page — we never see or store your full card number.
• Model programme applications — if you apply in-app, we collect your phone number, age, home address, country, Instagram handle, shoe size, links you provide, and whether you agree to be featured. If you apply via the external Google Form linked from that page instead, Google collects and stores that submission directly — see Google's own privacy policy for that path.
• Push notification token — a device identifier used only to deliver the notifications you've opted into. It isn't a location and can't be used to track you.
• Location — only if you tap "Use my location" during sign-up, which asks your device for a one-time position to suggest a city and country. We don't track location in the background.
• Technical data — standard hosting/analytics data (IP address, device/browser type, pages visited) via Vercel Analytics.

3. Why we collect it

• To run the core product — profiles, voting, the weekly leaderboard, and picking Friday's winner.
• To verify entries meet the contest rules (a visible face and shoe, taken live).
• To let members message each other, subject to your "who can message me" setting and any blocks you've placed.
• To take, process, and ship shop orders, and send you order/shipping confirmations.
• To review model programme applications.
• To send you the notifications you've opted into (streak reminders, the weekly draw, votes and rank updates, new messages, news & drops) — see your Notifications settings.
• To keep the community safe — reviewing reports, acting on blocks, and enforcing our Terms.

4. Who we share it with

We don't sell your data. It's shared only with the infrastructure that runs the app and shop, or as part of using a public community platform:

• Supabase — authentication, database, and photo storage.
• Cloudinary — image hosting and processing for photos and product images.
• Stripe — payment processing for shop orders. Stripe collects your card, billing, and shipping details directly on its own checkout page.
• Firebase (Google) — delivers push notifications to your device.
• Resend — sends transactional emails (order confirmations, win notifications, etc.); these emails include a read receipt so we know they were delivered and opened.
• Meta / Instagram — if you comment on our Instagram posts. See Section 7, which applies even if you don't have an account here.
• Vercel — hosting and analytics.
• Other members — your handle, photos, bio, city, and public stats are visible to other members as part of using the app (that's the point of a public leaderboard and voting community). Your email, address, and payment details are never shown to other members.

5. Cookies

We use a small number of functional cookies — to keep you signed in (via Supabase), to remember that you're using the native app rather than a browser, and to track an in-progress guest shopping cart before checkout. We don't use advertising or cross-site tracking cookies.

6. Messaging, blocking & reporting

Messages between members are stored so conversations work, and so we can investigate reports of abuse. Blocking someone stops them messaging you and hides you from each other in Browse. Reports you file are visible to our moderation team along with their status.

7. If you interact with us on Instagram

If you comment on one of our Instagram posts using certain keywords (for example, asking about the model programme), an automated system may reply to your comment publicly and send you a direct message on Instagram with more information. This applies even if you've never created a smiletowinfridays.com account — commenting is enough to trigger it. We store only your Instagram account ID and which post you commented on, so we don't message you twice for the same post; we don't store the text of your comment or any other Instagram profile data. Instagram itself (run by Meta) separately governs your data under its own privacy policy.

8. Data retention & deletion

Deleting your account (available in Edit Profile) removes or anonymizes your personal profile fields — handle, name, bio, photos, city, country, Instagram handle, and date of birth — and disables your login immediately.

We don't erase everything outright, because doing so would corrupt other members' vote history and leaderboard integrity, or break records we're legally required to keep. Specifically: votes, battles, and points history are retained in anonymized form; order and payment records are retained as required for tax, accounting, and fraud-prevention purposes; and messages you sent may remain visible to the other participant in that conversation. Contact us if you'd like to discuss further erasure of specific data and we'll do what we reasonably and legally can.

9. Your rights

You can edit most of your profile information directly in Edit Profile, and delete your account as described in Section 8. To request a full data export, or ask questions about anything we hold on you, contact us using the details below.

10. Age requirement

You must be at least 16 years old to create an account. We ask for your date of birth at sign-up specifically to enforce this.

11. Marketing

We only send marketing messages (new drops, offers, announcements) if you've opted in via the "News & drops" toggle in Notifications. You can turn this off at any time, and it's off by default for new accounts.

12. International transfers

Our service providers (Supabase, Cloudinary, Stripe, Firebase, Resend, Vercel) may process and store data outside your own country, including in the United States. By using the app, shop, or Instagram automation, you understand your information may be transferred there.

13. Security

We use industry-standard measures — encrypted connections and database access controls — to protect your data. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

14. Changes to this policy

We may update this policy as the app, shop, or Instagram automation change. We'll update the "Last updated" date above, and for material changes we'll let you know via the app or by email.

15. Contact

For privacy questions, data requests, or anything else, contact us at support@smilezkickz.live or through the Help & contact page in the app.