WHO TO FOLLOW LIVE · UPDATED 7 SEPTEMBER 2026

Privacy & your data

Who to Follow Live is part of Fancy Little Software. This policy covers the website and its companion Apple apps. For questions or requests about access, correction, removal or your choices, use our contact form. It works without an account and stores requests in our review queue; it does not send an automatic email.

You can also email hello@fancylittlecompany.com. Include Who to Follow Live in the subject. Email is processed by our business mailbox provider and may be retained with the request history.

Accounts and information you provide

Signing in with ChatGPT, Google, Apple, Twitch or Kick provides an account identifier, display name and email when the provider shares one. We use these to create and secure your account and connect sign-in methods you choose. We do not receive or store your provider password. Connected sign-in methods do not give us permission to follow other accounts on your behalf.

We store your chosen display name, profile photo or avatar, bio, interests, social links, account type, publication and mature-content choices, and creation/update dates. We also store your followed creators and channels, collections and their memberships, hidden-creator preferences, saved searches, research projects, candidate snapshots, private notes, tags, decision statuses and subscription access records. These support your requested features and account administration. Public listing is optional; choosing a private profile hides it from other visitors, but does not prevent the service from processing account data.

Device-only app saves and hidden creators remain local until you choose to import them. You review the selection before it is sent. We keep minimal account import receipts containing the creator URL, whether it was saved or hidden, and the acknowledgement time so a retry cannot duplicate or restore an item you later remove. Receipts remain until account deletion. Your device copy is kept until you clear it in app settings. Collections and hidden preferences are private account data.

A published creator listing makes your submitted name, photo, bio, interests and social links visible to visitors and search engines. Other people may copy it. Unpublishing removes the listing from this service; copies and search-engine caches may remain elsewhere.

Research and shared shortlists

Research is private to your account. You can explicitly create an unlisted read-only shortlist link that expires after 30 days, or revoke it sooner. Anyone with that link can view the selected creator information. Notes and decision statuses are excluded unless you choose to include them; project descriptions and tags are never included. Recipients can copy information before a link is revoked.

We count the unique creator identifiers you export in each billing month to enforce your allowance. Research CSV exports contain the fields you select and exclude copied biographies, images and platform audience data. Personal account-data downloads remain free. Unsaved browser research and collection-name drafts are kept in this tab’s session storage for recovery, removed after saving, and cleared on explicit sign-out. Cancelling a collection edit also removes its draft.

Public creator information

The directory uses public profile names, handles, biographies, images, social links and source references from platform sources, Wikipedia/Wikimedia and published creator directories. Live feeds use available public stream titles, categories, languages, images, viewer counts and observation times. Twitch and Kick channels seen live with a visible audience get a public channel page summarising what we observed: when they were last live, how many broadcasts we saw and their largest and typical audience. We do not label a profile live unless a recent source check supports it. Creator information can be incomplete or outdated; request a correction or removal.

Our servers request information from Twitch, Kick, TikTok, Euler Stream, Instagram/Meta for authorized accounts, BIGO LIVE, LiveMe and independent Owncast hosts. Supabase stores the TikTok checker roster and recent results. These background checks send creator identifiers to the relevant provider; they do not send your account profile or watchlist. Platform availability and authorization determine coverage.

Contact and support

The contact form collects your email and message so we can investigate and respond. Signed-in requests are linked to your account. Other requests use an email-derived digest for submission limits, and still store your actual contact email. Historical campaign enquiries also contain the details submitted at that time; the custom research service is no longer offered. Do not send passwords, payment-card details or sensitive identity documents.

Hosting, security and regional discovery

The website runs on OpenAI Sites with Cloudflare hosting and D1 account storage. Hosting and authentication providers process network requests, which can include IP addresses, browser information, requested URLs, timestamps and security or error information. Those infrastructure records are separate from our application analytics. Do not put sensitive information in search terms or URLs.

We may suggest a discovery region using the network’s approximate country signal or your browser locale. We do not request GPS location. Your chosen region is saved in your browser and may be included in page URLs and saved searches. It helps rank stream languages; it is not verification of a creator’s country. Select Worldwide to stop regional ranking.

Optional analytics and embedded players

Optional analytics stay off until you allow them. They count public page views, outbound stream clicks, saves, signups, research actions, comparisons and checkout creation, using an event type, platform, date and random event receipt. We do not attach account IDs, email, search text, form contents or payment details to these events. Browser Do Not Track and Global Privacy Control signals keep this optional analytics off. We do not run session replay or record form contents.

Embedded Twitch, Kick and independent players stay blocked until you allow embedded media in Privacy preferences. Once allowed, visible previews may play muted. Players connect directly to the streaming provider, which receives your IP address and browser information and may use its own cookies or identifiers. Remote profile and preview images also send ordinary image requests to their hosts when displayed. Opening an external link takes you to that provider’s service and privacy practices.

Rejecting or withdrawing optional choices stops new optional analytics and unmounts embedded players, including picture-in-picture. We cannot erase third-party cookies from another domain or reverse information already sent. Use your browser settings to clear those cookies. See Cookies & storage for preference duration and controls.

Purchases and advertising

When PayPal checkout is enabled, choosing to subscribe takes you to PayPal, which processes your payment details. We send the selected plan and an opaque checkout reference to link the subscription to your account. We keep that reference, the agreed price and currency, provider subscription and payment identifiers, verification events and access dates. These billing associations remain for reconciliation and billing support after account deletion; there is no automatic deletion schedule for them. The pricing page does not load a PayPal advertising or payment SDK. PayPal controls data collected on its own checkout pages.

New Lemon Squeezy checkout is disabled. For any existing purchase billed by Lemon Squeezy, that provider handles payment, tax, invoices and refunds as merchant of record. The original purchase includes an internal account identifier used to connect payment to access. We retain provider subscription and product identifiers, an account link, status, entitlement dates, renewal state, test/live flag, and processing receipts; we do not store card numbers. Payment receipt hashes are used to prevent counting a payment twice. See refunds and cancellation.

Website AdSense serving is disabled pending approval and configuration. This version does not load AdSense advertising scripts. Enabling advertising requires an appropriate advertising consent configuration; the current player/analytics preference is not an advertising consent.

Paid tools keep only what they need. Creator stores the featured link you choose. Agency keeps a list of the channels you exported each month so repeats are not counted twice. A Spotlight request keeps the channel, the amount, PayPal’s order and payment references and the review outcome. If you turn on go-live alerts, we store the push address your browser issues for that device until you turn alerts off or the browser withdraws it, and a short log of alerts sent in the last seven days. Deleting your account removes the featured link, the Agency export list, the push addresses and the alert log. Spotlight payment records are kept with the other billing records described below.

Guides can contain affiliate links, each marked as one. Following a link takes you to that company’s site, which may record the referral under its own privacy policy. We do not send it any information about your account, and no affiliate script loads on our pages.

Apple apps

Guest watchlists, hidden creators and native language/region choices are stored in device preferences. Native region choices rank reported stream languages; they do not establish creator locations or use device GPS. Signed-in saved creators and research synchronize with the same server account used on the website. Native sign-in uses a seven-day session stored in the device Keychain. Cached research, unsaved note drafts and interrupted project-creation requests (request ID and project name) are encrypted with a device-held key and cleared on sign-out. Project-creation recovery records are also cleared after the creator is successfully added. A public creator selection awaiting sign-in is kept only in memory and is separate from private project data. Downloaded files you save or share outside the app remain under your control. Native embedded-player consent is optional, expires after 180 days and can be withdrawn in Settings or the player. Opening an allowed player uses a temporary web browsing session, but the stream provider still receives the requests. Provider data already sent cannot be recalled by closing the player.

The iPhone app includes Google AdMob and User Messaging Platform software. In the release source accompanying this policy, live ad serving and consent-SDK initialization are disabled. Test builds may initialize the consent SDK and request Google test ads. Earlier installed builds may request consent information even while live ads are disabled.

When enabled, Google’s consent and ad software can process approximate location from IP, device identifiers, consent choices, ad interactions, crash and performance information for advertising, measurement and fraud prevention. Non-personalized ads can still process data. The app requests non-personalized ads; denying Apple tracking permission does not block the directory. Where available, manage ad choices through Settings → Advertising privacy. Advertising must remain disabled until its consent and release checks are complete.

When Apple purchases are enabled, Apple processes the purchase and sends signed transaction information. Our server verifies it with Apple using a random account association token. We store subscription status and transaction associations to provide access and restore purchases. A short-lived sign-in nonce and a daily IP-derived digest limit repeated Apple sign-in requests; the application does not store the raw IP for this control.

Retention and deletion

• Account profiles, photos, connections, saved creators, research projects, annotations, share links, export usage and saved searches remain until you remove them or delete your account. Account deletion also removes linked support requests and historical briefs from the active application database.
• Social sign-in sessions expire after seven days; unused sign-in states expire after ten minutes. Native handoff codes expire after two minutes; Apple sign-in nonces expire after five minutes. Expired database rows are cleaned during subsequent sign-in activity, not on an exact deletion timer.
• Optional event receipts older than 30 days and daily totals older than 365 days are pruned when metrics are recorded. Payment receipt hashes are excluded from that receipt cleanup. Public broadcast observations older than 30 days and feed health older than seven days are pruned during new ingestion, with batch limits where applicable. Channel summaries are kept while a channel keeps appearing; a channel seen on a single broadcast and not again is removed after 60 days.
• Anonymous contact requests, subscription associations and billing processing records have no automatic deletion schedule in the current application. Ask through the contact form about removal; payment providers may retain their own records for their obligations. Deleting your account does not cancel a subscription or erase payment-provider records.
• Hosting logs, backups, provider records and device backups have separate retention controls. The account-delete function does not purge those systems.

You can download your account data, edit your details, unpublish or delete your account. The download includes account-linked application records; it does not include browser preferences, anonymous contact requests or another provider’s records. Use the contact form for requests not covered by these tools. We may need to verify control of the account or information before disclosing or changing it.

Processing across countries

OpenAI, Cloudflare, Supabase, authentication, streaming and payment providers may process information in countries other than yours. This service does not promise local-only storage. Their role and processing depend on which features you use. Optional player loading can be refused without losing access to the directory.

Adults and policy changes

This service is intended for adults aged 18 and over. If you believe it holds information about a child, report it through Contact. We update this policy when behavior changes and ask for new optional choices when a material consent change makes previous choices unsuitable.