Privacy Policy

Draft for review · Version 2026-11-01 · Prepared November 1, 2026. Publish an effective date when this release is ready for approved member registration.

This Policy explains how Gio Celenza MGMT, operating through Omniant, handles information in Figtree features that link to this Policy. Omniant is a division rather than a separate incorporated entity. “We,” “us,” and “our” mean Gio Celenza MGMT operating through that division. Figtree is a standalone product; this Policy does not automatically extend permissions granted to OMNII or replace a separate management-records policy.

1. Information we handle now

• Account details: your name, email address, internal account identifier, verification status, registration time, and, for email/password enrollment, the Terms/Privacy version and eligibility confirmation. Google sign-in does not require a separate Figtree Terms checkbox; we do not record it as an affirmative Terms or age confirmation.
• Authentication: salted, derived password values if you choose email/password login; Google account identifiers and basic identity information if you choose Google; hashed session tokens, session creation/expiry, and short-lived verification or password-reset records. We do not store your Google password.
• Operational requests: hosting and security providers may process IP addresses, browser request details, timestamps, and error information. The application uses keyed hashes of network information for short-lived abuse-control counters rather than creating a browsing-history profile.
• Support information: the message, email address, and any information you choose to provide when contacting us. Do not send passwords or unnecessary sensitive identifiers.
• Browser state: essential authentication cookies, short-lived sign-in state, and temporary interface state. The dashboard does not include a sample viewer or imported creator records.

Private-beta access: the configured owner Admin maintains email addresses, optional reference names, and Approved, Pending, or Removed status in a restricted database. The Admin can see basic account metadata needed to administer access and a recent access-change history. These records are not sent to ordinary members or visitors. Approval is checked for account APIs. Removing access blocks subsequent access and invalidates that person’s sessions and verification/reset links; it does not automatically delete their account records. Admin status does not grant access to unrelated private records or future connected-platform information.

2. Why we use it

We use information to create and verify accounts, authenticate users, maintain sessions, deliver requested verification/reset emails, prevent abuse, resolve support requests, provide available controls, and meet applicable legal obligations. We do not sell personal information, display behavioral advertising, or use connected Google user data to train generalized AI models. This build includes no AI assistant or automated analysis of private social accounts.

Where data-protection law requires a legal basis, the basis depends on the feature and jurisdiction: providing services you request, your consent for optional connections, legitimate interests in proportionate security and support, and compliance with applicable legal obligations. You may contact us about the basis and rights applicable to your circumstances.

3. Google sign-in

Optional Google sign-in requests basic identity scopes: your Google account identifier, name/profile information, and email address/verification information. It does not request Gmail, Google Drive, Calendar, YouTube Analytics, or permission to post on your behalf. The identity response is used to authenticate the Figtree account. The server verifies Google’s signed identity response during the short-lived token exchange. It does not retain that exchange as a social-account connection.

Your Google password stays with Google. See the Google Privacy Policy and manage app access through Google Account connections. Removing Google authorization does not itself delete an independent Figtree account; use Figtree’s deletion controls or contact us.

Figtree’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Administrative status alone is not authorization to inspect Google user data.

4. Planned social analytics

Instagram, TikTok, and YouTube connections are planned, not active in this build. No social analytics tokens or real social statistics are collected by the current dashboard. When a connection is introduced, the authorization notice and updated Policy will identify the requested scopes, supported information, retention periods, refresh behavior, recipients, and disconnection/deletion controls before you enable it.

Expected categories may include an authorized account’s identity, follower/subscriber counts, public-content metadata, and available performance metrics. Actual availability depends on platform eligibility, API approval, and the permissions you choose. We will not ask you to provide your social-platform passwords directly to Figtree.

Future YouTube API features will also link to the YouTube Terms of Service, Google’s Privacy Policy, and Google’s revocation controls. Applicable provider requirements for deleting authorized data after revocation will apply. Those features must not be enabled until the corresponding controls and notices are implemented.

5. Managers, organizations, and OMNII

These sharing features are not active yet. Figtree does not currently send your information to OMNII, import OMNII records, or give a manager analytics access because you use the same organization’s services. A planned connection will require explicit, scoped authorization and a way to revoke it.

The intended design is for approved managers to see permitted creator summaries in OMNII, while more detailed analytics remain in Figtree. It will not authorize access to OMNII messages, journals, email, private documents, or unrelated data. Creator ownership and the source platform’s restrictions continue to apply.

6. The future Chrome extension

The extension is deferred until after the website. This build does not install an extension or collect browser-tab contents, browsing history, or extension telemetry. Before an extension is released, its permission request, store disclosures, and this Policy will explain its actual behavior. The intended purpose is a quick authorized summary and a link to the full Figtree dashboard.

7. Who can receive information

• Cloudflare: website/Worker hosting, D1 account records, security infrastructure, and operational processing where configured.
• Google: optional Google identity authorization and Google Fonts requests made by the page. Font delivery can involve your IP address and request information. Google applies its own policies to those services.
• The configured transactional-email provider: recipient address and the verification or reset email needed for your request. This package supports Resend when configured; Resend’s Privacy Policy describes its own processing. Email/password registration should not be enabled without a working sender.
• Authorized operational personnel: limited information necessary for support, security, account administration, or a legal obligation. This is not unrestricted permission to browse future connected-platform data.
• Other recipients where legally necessary: to comply with valid legal process, protect lawful rights and safety, or investigate abuse, subject to applicable platform-data restrictions.

There is no payment processor in this release. External links take you to services with their own terms and privacy practices. We do not represent their activities as controlled entirely by Figtree.

8. Cookies and local information

An essential HttpOnly session cookie keeps you signed in for up to seven days unless you sign out, delete your account, or access is revoked sooner. A short-lived OAuth state cookie helps protect Google sign-in. Verification and reset tokens are temporary credentials; do not share their links. Pages and API responses handling private account information are configured not to be publicly cached.

The current website does not use advertising cookies or third-party behavioral analytics. Google Fonts and Google sign-in can make third-party network requests. Your browser may retain normal page/cache information under its own settings. Clearing cookies can sign you out.

9. Retention and deletion

Active account profile and eligibility/acceptance records are retained while needed to provide the account. Sessions expire after up to seven days; OAuth state expires after ten minutes, verification/reset tokens after one hour, and abuse-control buckets after their short time window. Scheduled cleanup removes expired records when enabled; expiration is checked before a record can authorize access even if cleanup has not yet run.

Access-change audit records identify the acting Admin, target email, action, and time. Scheduled cleanup removes audit records older than 90 days. Approval entries, including Removed entries, can remain after account deletion to manage access and prevent an old approval from restoring access. Contact us to request correction, deletion, or a copy of these access records; any necessary retained restriction will be limited to its access-control purpose.

The export control returns your available profile and account metadata without password-derived values, session secrets, or private security credentials. Account deletion removes your active Figtree account and associated session/verification records. It does not delete a Google, social-platform, or OMNII account. There are no social-analytics archives in this build.

Limited provider logs, technical backups, support correspondence, or records required for a specific legal/security purpose may be handled separately. They should be retained only as needed for that purpose; this is not permission to retain everything indefinitely. We do not promise that every provider backup or log disappears instantly.

10. Security and processing locations

The implementation uses encrypted web connections, server-side authentication, salted password derivation, hashed session tokens, expiry checks, and same-origin checks for account changes. No system can guarantee complete security. Figtree is not represented as end-to-end encrypted or as holding a certification it has not obtained.

Cloud and email providers may process information in countries other than your own. We do not promise storage in one specific country. Applicable legal requirements and provider arrangements govern relevant processing.

11. Your choices and rights

Approved members can choose an available sign-in method, sign out, export supported account information, and use supported account-deletion controls. You may also contact us to request access, correction, deletion, a copy, or other rights available under applicable law. We will verify a request as reasonably necessary without asking for your password and respond within applicable legal time limits.

Depending on where you live, you may have rights to object, restrict processing, withdraw consent, or complain to the relevant supervisory authority. Removing a permission can make its related feature unavailable; it does not automatically undo processing already lawfully completed.

12. Minors

Figtree is not intended for children under 13, and email/password enrollment includes an age/eligibility confirmation rather than a full birth date. Google sign-in does not collect a separate Figtree age confirmation. Users must meet any higher local minimum age and have parent/guardian involvement where required. If you believe an ineligible child supplied information, contact us so we can investigate, restrict access, and delete information where required. A management relationship does not remove protections provided by law.

13. Changes and contact

Updates will display a revised version and date. Material changes will receive an appropriate notice, and permission will be obtained where required before introducing a materially different purpose or a new optional integration.

Omniant — a division of Gio Celenza MGMT
Figtree privacy, deletion, and support requests: management@giocelenzamgmt.com
Website: figtree.giocelenzamgmt.com