Privacy Policy

This Privacy Policy describes how Chimera Studio Inc("Chimera Studio," "we," "us," or "our") handles personal information when you use our products and services — including the Chimera platform at chimerastudio.app, The Drop House at drophouse.chimerastudio.app, our mobile applications, and any related emails or features we operate (together, the "Service").

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

Chimera Studio builds tools for creators and the fans who back them. Creators use Chimera to publish drops, collections, and other content to a community of fans. Fans use Chimera to follow creators, claim drops, and take part in experiences like The Drop House — a venue polling experience where fans vote on which artists they want to see next. Different products collect different information, as described below.

Account information. When you sign up — as a creator, a fan, or an administrator — we collect the email address you give us and use one-time email codes to verify it. We do not require a password to create or use a Chimera fan account. If you choose to add profile details (display name, image, social links), those become part of your account.

Content you create or upload. If you are a creator, the drops, collections, images, videos, audio, captions, tags, and other content you publish through the Service are collected and stored so we can deliver the Service to your fans.

Fan activity. When you follow a creator, claim a drop, vote in The Drop House, tap Share, or otherwise interact with the Service, we record that activity together with the timestamp. For The Drop House specifically: votes are stored with an opaque random device identifier (not your email) so we can thread repeat visits, attribute referral links, and prevent abuse.

Information collected automatically. When you visit the Service, we record:

• A small number of random device identifiers stored in your browser's local storage. These are opaque random values — not derived from anything personal — used to remember settings, thread your activity across pages, and recognise repeat visits without an account.
• A salted, one-way hash of your IP address — never the raw IP — for abuse-prevention and rate-limiting.
• Your browser's user-agent string, so we can debug device-specific issues.
• Activity logs (pages or features you used, timestamps, request metadata) generated as a normal part of operating the Service.

Payment information. If you make a purchase or receive a payout, our payment processor (Stripe) collects and stores your card or bank details directly. We do not see or store full card numbers; we only receive a token, the transaction amount, and the result.

Communications you send us. If you email us or fill out a contact form, we keep the message and your contact details so we can respond and improve the Service.

What we do not collect. We do not track your precise location, your contacts, or your browsing activity on other websites. We do not load third-party advertising cookies or cross-site trackers.

• To operate and deliver the Service — show you content, let you publish, record votes, send the emails you ask for.
• To verify your email address via one-time codes.
• To send transactional emails (verification, drop claim confirmations, weekly Drop House results) and, with your consent, occasional product updates.
• To detect and prevent abuse, fraud, and spam — including rate-limiting via salted IP hashes and device identifiers.
• To attribute referrals when a friend joins a drop or votes after using your share link.
• To produce aggregated reports on participation that we share with creators and venue partners. These reports do not identify individual users.
• To improve the Service, develop new features, and understand how it is used.
• To comply with legal obligations and to protect our rights and the rights of others.

We do not sell your personal information. We share it only in these limited cases:

Service providers (subprocessors). We use the following companies to operate the Service. Each is bound by contract to use your data only to perform the service we have asked them to:

• Supabase Inc — database and authentication infrastructure
• Resend Inc — transactional and opt-in email delivery
• Vercel Inc — application hosting and edge delivery
• Cloudflare Inc — content delivery and object storage for images and files
• Mux Inc — video upload, encoding, and streaming
• Stripe Inc — payment processing

Creators and partners. Information you publish through the Service (your profile, your drops, your collections) is visible to the audience you publish to. We share aggregated, de-identified analytics with creators about how their fans engage with their drops, and with venue partners (such as The Drop House) about poll participation. Individual email addresses are not shared.

Legal and safety. We may disclose information when required by valid legal process, to enforce our Terms, to protect against fraud or abuse, or to defend our rights, property, or safety (or that of our users or the public).

Business transfers. If Chimera Studio is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. Any successor will be bound by this policy until it is updated.

We use your browser's storage to hold a small number of functional values — for example, a random device identifier that lets us recognise repeat visits without requiring an account, and a counter that powers UI like a "welcome back" greeting. We do not use these values to track you across other websites, and we do not sell them. Clearing your browser's site data removes them and the next visit starts fresh.

• Account and profile data — kept while your account is active. You can ask us to delete it at any time (see "Your rights" below).
• Content you publish — kept while your account is active or until you remove it. We may retain backup copies for a short period after deletion.
• Activity and vote records — kept for reporting and historical purposes. Votes are stored with an opaque device identifier, not your email or name.
• One-time email codes — expire within minutes and are deleted shortly after use.
• Logs and abuse-prevention data — kept for a limited period sufficient to investigate incidents.

We encrypt traffic in transit (HTTPS), enforce row-level security in our database, hash IP addresses before storing them, store one-time email codes as one-way hashes, and follow generally accepted practices to protect your data. No method of transmission or storage is perfectly secure, however, and we cannot guarantee absolute security.

Everyone. You can ask us to access, correct, or delete the personal information we hold about you at any time by emailing privacy@chimerastudio.app. You can opt out of marketing emails by using the unsubscribe link in any such message. Transactional emails (verification codes, security notices) are required to operate the Service.

U.S. state residents.If you live in California, Virginia, Colorado, Connecticut, Utah, or another U.S. state with comprehensive privacy legislation, you have additional rights — including the right to know what we collect, to request deletion, to correct inaccurate information, to opt out of any "sale" or "sharing" of personal information (we do not sell or share for cross-context advertising), and to receive a copy of your data in a portable format. To exercise any of these rights, contact us at the email above. We will not discriminate against you for doing so. You may also designate an authorised agent to act on your behalf.

Residents of the European Economic Area, UK, or Switzerland. If GDPR or UK GDPR applies to your use of the Service, you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. The legal bases on which we rely are: your consent (for marketing emails), our legitimate interests in operating and securing the Service (for activity and abuse-prevention data), and our contractual obligations to you (for verification and core Service functionality). You also have the right to lodge a complaint with your local data protection authority.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us at privacy@chimerastudio.app and we will delete it.

Chimera Studio operates in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

We may update this policy from time to time. When we do, we will update the effective date at the top of the page. For material changes we will provide more prominent notice, such as an email or a banner on the Service.

Questions, requests, or concerns about this policy or how we handle your information? Email us at privacy@chimerastudio.app.

Chimera Studio Inc
1166 Cleveland Ave
Columbus, OH 43201