Brotato Cave

Privacy

This is an operational draft for Brotato Cave, published by Sinderweave Labs LLC. It describes current and launch-planned handling. It is not a finished lawyer-reviewed policy.

Who this is for

Brotato Cave is for adults 18 and older. Members provide their own date of birth. The server uses that date, with a timezone identifier captured from the device at confirmation, to check age eligibility before community features open. The timezone identifier is used only to decide the calendar day for the 18+ check. It is not GPS, a home address, location tracking, or a public profile field. This is not government identity verification, background screening, or Certified Potato verification. Exact date of birth is not shown on profiles or to other members. Child birthdays are not stored. Child records are optional first names and current-age snapshots only. Account deletion removes the member date of birth and age timezone with the profile.

Account and authentication

We store the account email, Better Auth user and account records, and session records. Credential accounts store a password hash, not the password in plain text. Google and X sign-in use the platform authentication broker. Session rows may include IP address and user agent when Better Auth records them. Verification rows may hold email or similar one-time values when issued.

Profile and parenting information

We store display name, bio, city, region, country code, hangout intentions, interests, gaming platforms, visibility settings, and optional dad / expecting flags. Location is city and region only. We do not collect GPS, a home address, or a street address. The age-eligibility timezone is a calendar timezone identifier, not a location history.

Optional child records may include a first name and a current age, age range, or stage. Hidden parenting visibility shows no child details on the public card. Generalized shows a broad parenting summary. Current ages / Specific can publish a child’s first name and current age. Child information is therefore not always hidden. We do not store child last names, photos, schools, or dates of birth.

Profile photos are optional. A member can keep up to six. One photo is primary and is the picture shown on Bros, Patch, Talk, and the profile card. The image file is stored in object storage. The database keeps the photo reference, order, and which photo is primary. It does not store the image bytes. Members with no photo are shown as initials. Removing the primary photo uses the next photo. Removing every photo returns to initials.

Social features

• Discovery passes, Spud Salutes, connections, and blocks.
• Private Messages after an accepted Salute. Those messages are private to the conversation.
• Couch posts and replies, including identified Hot Potato posts under the member’s profile.
• Burrow posts, which appear as Anonymous Spud to ordinary community members. Authorized safety staff may review reported Burrow content. The Burrow is not absolutely anonymous.
• Patch events the member creates or joins.

Hot Potato is identified. It is not an anonymous room.

The Root

Private Root check-ins store mood, optional note, stress, and energy. They are not shown on the profile, not used for discovery, and are not therapy, medical care, crisis intervention, or emergency services.

The Stash and Brotato+

We store card ownership, sealed and earned packs, Embers, worn and owned profile frames, founder assignment, and entitlement rows for products such as Brotato+. Brotato+ subscriptions and paid Stash packs and frames are planned for the commercial Android launch and will use the approved purchasing system available in the distributed application, including Google Play purchase identifiers and purchase tokens once billing is connected. Purchases are unavailable in this preview. We do not currently process payments in this preview.

Moderation and safety

We store reports, moderator notes, notices, restrictions, appeals, rate-limit events, and a moderation audit trail. Screening and Certified Potato are not active. A future screening provider may store status and event records; that is not happening in this preview. Hashed eligibility-denial values may exist without an account pointer.

Service providers

This application uses Better Auth for authentication, Postgres (Neon when a production database is configured, otherwise a local preview database), and Vercel for hosting when deployed. Google and X identity is brokered through the platform auth service. We do not sell member information.

Account deletion and retention

Signed-in members can permanently delete their account from Me. See the account deletion page. Deletion removes authentication, profile, child information, Root check-ins, private Messages sent by the member, Stash ownership, entitlements, and related personal rows. Couch posts remain readable with the author shown as Deleted Member. Anonymized reports, moderation audit rows, and moderator notes may be kept so the safety team can review abuse, appeals, and repeat harm. Those rows no longer contain the deleted member’s email, display name, date of birth, child information, or reversible account id. They use a shared tombstone label instead. No production calendar retention period is defined in this application; remaining safety rows stay until a later professional legal review sets one.

Security limitations

We use standard session cookies, password hashing for credential accounts, and server-side authorization. No system is perfectly secure. Do not send information you cannot afford to have stored.

Contact

Support: support@sinderweavelabs.com. Sinderweave Labs LLC.