Privacy Policy
Last updated August 16, 2026
awfunding is the crowdfunding and pledge-management platform operated by Arcane Wonders LLC at pledges.arcanewonders.com. This policy covers the platform only — the Arcane Wonders website and store have their own policy.
The short version: we collect what a pledge needs and nothing more, we never sell your information, we have no advertising or tracking, and we never see your card number.
What we collect, and why
When you create an account
Your email address, and a password if you set one (stored only as a bcrypt hash — we cannot read it). Optionally a display name, profile picture and time zone. We need these to sign you in and to show you as a backer to the publishers you support.
When you back a campaign
What you pledged and to which campaign, the reward tier and add-ons you chose, and the amounts. In the pledge manager we also collect your shipping address, and answers to any questions the publisher asks (for example a language or a T-shirt size).
When you pay
Card details are entered directly into Stripe and never reach our servers. We store only what Stripe returns to us: a payment token, the card brand, its last four digits and expiry, and the outcome of each charge. See Payments below.
When you message a publisher
The messages you write and who they were sent to. These are visible to you and to the publisher of the campaign you wrote about.
When you follow a campaign
Which campaigns you follow, so we can email you when they launch or are about to end.
Automatically
Standard server logs (IP address, browser, pages requested) kept briefly for security and debugging by our hosting providers. We do not run analytics, advertising, or tracking of any kind on the platform itself. See Cookies below.
How the information is used
- To run your account and keep you signed in.
- To take pledges, process payments, and get rewards shipped to you.
- To send you transactional email: receipts, failed-payment notices, pledge-manager deadlines, shipping confirmations, and replies to messages you sent.
- To send campaign updates and launch reminders — each one is a setting you control in notification settings.
- To prevent fraud and abuse, and to meet our tax and accounting obligations.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles.
Who else sees it
The publisher whose campaign you back
Backing a campaign means the publisher receives what they need to fulfil it: your name, email address, shipping address, pledge contents, and your answers to their questions. They become an independent controller of that information and handle it under their own privacy policy. Following a campaign, or messaging a publisher without pledging, shares far less — only what that interaction requires.
Service providers
| Provider | What they handle |
|---|---|
| Stripe | Payments and card data. We never receive card numbers. |
| Render | Hosting and the database where your account lives. |
| Cloudflare R2 | Images and video uploaded to the platform. |
| Resend | Sending the emails described above. |
Each acts on our instructions under a data-processing agreement. We may also disclose information where the law requires it, or to protect our rights or someone's safety.
Payments
Card details are captured by Stripe's own hosted fields inside your browser and sent straight to Stripe. Card numbers, security codes and full magnetic-stripe data never touch awfunding servers, logs or backups, which is what allows us to keep the smallest possible PCI-DSS footprint (SAQ A). Saved cards are Stripe tokens that only work for the publisher you saved them with; you can remove them under payment methods.
Cookies
awfunding sets one cookie of its own: the session cookie that keeps you signed in. It is strictly necessary, contains no tracking identifier, and is removed when you sign out. A second first-party cookie records your answer to the analytics question below, so we don't ask again. We run no advertising or social-media cookies of our own.
Campaign analytics
A publisher may connect their own Google Analytics or Meta pixel to their campaign, to measure the advertising they run for it. Where they have:
- You are asked before anything loads. Decline and no script runs and no analytics cookie is set — declining is a real decline, not a reduced amount of tracking.
- Those tags run only on that campaign's own pages. They never load on the rest of the platform, on another publisher's campaign, or in the pledge manager.
- If you accept, Google and Meta receive page views and three conversion events — viewing the campaign, starting checkout, and completing a pledge with its amount — under their own privacy policies and the publisher's.
- Your choice is stored in one first-party cookie for six months, and you can change it any time in privacy settings.
How long we keep it
- Account information — until you delete your account.
- Pledges, payments and orders — seven years after the transaction, to satisfy tax and accounting requirements. If you delete your account these records stay, but your name, address and contact details are stripped out of them.
- Messages, addresses, follows and saved cards — until you delete them, or delete your account.
- Server logs — a short rolling window held by our hosting providers.
Your rights
You can exercise all of these yourself, immediately, from your account:
- Access and portability — download everything we hold about you as JSON from privacy settings.
- Correction — edit your profile, email, addresses and preferences in settings.
- Erasure — delete your account from privacy settings. We'll tell you if something is outstanding (an unshipped order, a live pledge) that has to resolve first.
- Objection and restriction — turn off non-transactional email in notification settings, or write to us for anything else.
If you are in the EEA or UK, we process your information to perform our contract with you (running your pledge), to meet legal obligations (tax records), and for our legitimate interests in operating and securing the platform. You may lodge a complaint with your local data-protection authority.
If you are a California resident, you have the rights to know, delete, correct, and to opt out of sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of, and we will never discriminate against you for exercising a privacy right.
Children
awfunding is not intended for anyone under 16. We do not knowingly collect information from children; if you believe a child has created an account, contact us and we will remove it.
International transfers
We operate from the United States, and our providers store data in the United States. If you pledge from outside it, your information is transferred there under the standard contractual clauses in our agreements with those providers.
Security
Traffic is encrypted in transit, passwords are hashed with bcrypt, sign-in tokens are stored hashed and expire, and sessions can be revoked server-side. Access to production systems is limited to people who need it. No system is perfect: if a breach ever affects your information, we will notify you and the relevant authorities as the law requires.
Changes
We will update the date at the top when this policy changes, and tell backers by email if a change materially affects them.
Contact
Arcane Wonders LLC
customerservice@arcanewonders.com