What we keep, and why.

Your account. Your name, email address and a salted hash of your password (never the password itself). Optionally, a photo.

Your project. Everything you enter when you apply or edit: name, website, description, tags, highlights, links, logo, screenshot and showcase media.

Your payment-processor key. To prove you're at $0, you give us an API key for Stripe, Lemon Squeezy, Paddle, Polar or Gumroad. We store it encrypted (AES-256-GCM) and only ever use it to read: whether you've had sales, the amounts and dates, and the email of your first customer (to invite them to sign your record). We never create, change or refund anything. You can revoke the key from your processor at any time; your membership then can't be verified.

What you do here. Feedback, replies, updates, likes and support, and profile view counts.

Connection help. If you tell us what's stopping you from connecting a processor, we keep your reason and any details privately, with your account and project, for the people running the Club. We also keep your email preferences and a record of which emails we sent you.

Technical data. One cookie that keeps you signed in. Your IP address, briefly, to limit abuse (sign-in attempts, comment floods); those counters are deleted within a day. We don't use advertising or tracking cookies.

Member profiles are public: your project details, your founder name and photo, feedback and updates, support counts, and your membership status. When a sale ends a membership, the expulsion record (dates, the first sale amount, and the first customer's signature if they choose to sign) is public too.

Your email address, password and processor key are never public. Your first customer's email is never shown to anyone, you included.

Public project details (name, website, logo and description) may also be listed in the business directory of Verified Operator, our sister project, as an unclaimed business page. Revenue and processor data are never shared there.

We use a small number of providers to run the Club: Vercel (hosting and image storage), Supabase (database), and Resend (email). Your processor is contacted only with your key, only to read. We don't sell personal data to anyone.

Verified Operator (verifiedoperator.com) is run by the same team and shares our infrastructure. If you are expelled and choose to claim a Verified Operator profile, we pass your record to it at your request: your name, photo, email, project and first sale. Nothing is passed on unless you ask.

We send only what the Club needs to: a welcome email, password resets, the notice when a sale ends your membership, and the invitation to your first customer (only if you switch it on in your dashboard). We also tell you about new feedback, when support reaches 10, 20, 50 and 100, and remind you up to twice about an application still waiting for its key. Each of those can be switched off in email preferences. No newsletters or marketing.

You can edit your project and delete your comments and updates yourself. To delete your account, export your data, or remove your name and photo from a record, email club@thezerodollarclub.com. Expulsion records are part of the Club's history, so on deletion we anonymise them rather than remove them, unless the law requires otherwise.

If this changes in a way that matters, we'll update this page and, for significant changes, tell members by email.