FORK Privacy Policy

Overview

FORK is a creator marketplace for AI prompts, available at forkitover.ai. On FORK, you buy credits in bulk and spend them to unlock prompts published by creators. Creators earn a share of each unlock and additional "fork" royalties when others build on their work. This Privacy Policy explains what information we collect when you use FORK, why we collect it, who we share it with, and the choices and rights you have.

This Policy applies to the FORK marketplace, the FORK Enterprise experience, and any related pages, accounts, and services we provide (together, the "Service"). It does not cover the practices of third parties we don't control, such as the payment processor or external sites you may link to from a prompt.

In this Policy, "FORK," "we," "us," and "our" refer to FORK ([Legal Entity Name — to be confirmed]), the operator of the Service. "You" means anyone who visits, buys credits, unlocks prompts, or publishes content on FORK.

Last updated: June 3, 2026.

Information We Collect

We collect information in three ways: information you give us directly, information we collect automatically as you use the Service, and information we receive from the service providers that help us run FORK. The specific categories are below.

Account information. When you create an account, we collect your email address and the credentials or sign-in details needed to authenticate you. We may also collect a password (stored only in a securely hashed form) or rely on a passwordless sign-in link sent to your email.

Profile and creator information. If you set up a profile or publish as a creator, we collect your public handle, display name, and any bio, links, avatar, or other details you choose to add. For creators, we also collect the information needed to enable payouts (see "Payments" below).

Content you submit. We collect the prompts, titles, descriptions, previews, tags, sample outputs, and other material you publish or upload, along with the content fingerprint and originality-check signals we generate for that content. We also collect prompts and content you unlock, save, or interact with.

Usage and activity data. As you use FORK, we record activity such as the prompts you view, unlock, publish, or fork; your credit purchases and balance; your earnings and payout history; searches you run; and similar interactions that let the marketplace function and let creators see how their work performs.

Payment information. Purchases of credits and creator payouts are handled by our payment processor, Stripe. When you buy credits, your card or payment details are submitted directly to Stripe. We do not collect or store your full card number. We receive limited information from Stripe to confirm and reconcile transactions — for example, a transaction identifier, the amount, the result, the card brand, and the last four digits.

Device, log, and technical data. Our hosting and infrastructure providers automatically log technical information such as your IP address, browser type, device and operating system, referring pages, timestamps, and error or performance data. We use this to operate, secure, and troubleshoot the Service.

Cookies and local storage. We and our providers use cookies and browser local storage to keep you signed in, remember preferences (such as your theme and which product surface you're in), and measure usage. See "Cookies and Local Storage" below and our Cookie Policy for details.

Support and other communications. When you contact support@forkitover.ai or otherwise communicate with us, we keep your messages and any information you include so we can help you and keep a record of the request.

How We Use Your Information

We use the information we collect to run FORK, keep it safe, and improve it. Specifically, we use it to:

• Provide the Service — create and authenticate your account, show the marketplace, let you buy credits, unlock prompts, publish content, and fork others' work.
• Process transactions — sell credits, apply credit spends to unlocks, calculate creator earnings (70% of each unlock plus fork royalties), and run weekly creator payouts of earnings (US$10 / 100-credit minimum) through Stripe Connect.
• Protect creators and their IP — run the originality check that blocks near-duplicate prompts, generate and compare content fingerprints, and keep locked previews from revealing the full prompt before purchase.
• Maintain trust and safety — detect and prevent fraud, abuse, spam, scraping, and violations of our terms, and moderate content and resolve disputes.
• Communicate with you — send account, transaction, payout, security, and support messages, and (where permitted) product updates you can opt out of.
• Improve and measure — understand how the Service is used, analyze performance, fix bugs, and develop new features.
• Comply with law — meet our legal, tax, accounting, and regulatory obligations and enforce our agreements.

We do not sell your personal information for money, and we do not use the content of your support communications for advertising.

Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

• Performance of a contract — to provide the Service you sign up for, process your credit purchases and unlocks, run the creator program, and deliver payouts.
• Legitimate interests — to secure the Service, prevent fraud and abuse, protect creator IP through originality and fingerprinting checks, measure and improve the Service, and run our business, balanced against your rights and freedoms.
• Consent — for non-essential cookies and analytics where required, and for optional marketing messages. You can withdraw consent at any time without affecting processing already carried out.
• Legal obligation — to meet tax, accounting, anti-fraud, and other legal requirements.

Where we rely on legitimate interests, you can ask us for more detail about that assessment by contacting support@forkitover.ai.

How We Share Your Information

We share personal information only as described here. We do not sell your personal information.

Service providers. We rely on a small set of vendors who process data on our behalf, under contracts that limit them to providing their service to us:

• Payments — Stripe processes credit purchases and creator payouts (Stripe Connect). Your card details go directly to Stripe; we receive only limited confirmation data.
• Hosting and infrastructure — our application is hosted on a cloud platform (such as Vercel) and our data is stored in a managed PostgreSQL database. These providers process and store the data needed to run the Service.
• Email delivery — an email provider sends sign-in links, transaction and payout notices, and support replies.
• Analytics — an analytics provider helps us understand usage and improve the Service (see the Cookie Policy).

Other creators and the public. Your public handle, profile, and the content you choose to publish are visible to other users and may appear publicly on forkitover.ai. Aggregate or de-identified performance data may be shown to creators about their own content.

Business transfers. If FORK is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a successor policy.

Legal and safety. We may disclose information when we reasonably believe it is required to comply with law, respond to lawful requests, enforce our terms, or protect the rights, property, or safety of FORK, our users, or the public.

With your direction. We share information when you ask us to or otherwise direct us to.

Cookies and Local Storage

We use cookies and browser local storage to keep you signed in, remember your preferences (such as light/dark theme and product surface), secure the Service, and measure how it is used. Some of these are essential to making FORK work; others are optional and used for analytics.

You can control cookies through your browser settings and, where offered, through on-site controls. Blocking essential cookies may stop parts of the Service from working.

For a fuller description of the specific cookies and storage we use and how to manage them, please see our Cookie Policy.

Data Retention

We keep personal information for as long as it is needed for the purposes described in this Policy, and then delete or de-identify it.

In practice, that means we keep account and profile data while your account is active; we keep transaction, credit, earnings, and payout records for as long as required for accounting, tax, and audit purposes; and we keep published content for as long as it remains on the marketplace.

Content fingerprints and originality signals may be retained after content is removed so that the originality check can keep protecting creators against duplicates over time.

When information is no longer needed, we delete it or keep it only in an aggregated or de-identified form that can no longer be linked to you.

Security

We use technical and organizational measures designed to protect your information, including encryption in transit, hashing of credentials, access controls, and reliance on reputable infrastructure and payment providers. Payment card data is handled by Stripe, a PCI-DSS compliant processor; we never store full card numbers.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account or data has been compromised, please contact us right away at support@forkitover.ai.

Your Privacy Rights

Depending on where you live, you may have rights over your personal information. We honor the rights below for all users where we can, and we provide the specific rights required by your local law.

For individuals in the EEA/UK (GDPR), you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data in certain circumstances.
• Restriction — ask us to limit how we use your data.
• Portability — receive certain data in a portable format or have it sent to another provider.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent, withdraw it at any time.
• Complain — lodge a complaint with your local data protection authority.

For residents of California (CCPA/CPRA) and similar U.S. state laws, you have the right to:

• Know and access — request the categories and specific pieces of personal information we have collected, used, disclosed, and shared.
• Delete — request deletion of personal information we collected from you, subject to legal exceptions.
• Correct — request correction of inaccurate personal information.
• Opt out — opt out of any "sale" or "sharing" of personal information and of targeted advertising. We do not sell your personal information for money.
• Limit sensitive data — limit the use of sensitive personal information to what is necessary to provide the Service.
• Non-discrimination — exercise these rights without being denied service or charged a different price.

How to exercise your rights. Email support@forkitover.ai with your request, or use any privacy controls we make available in your account. We will verify your identity before acting on a request and respond within the time required by applicable law. You may use an authorized agent to submit a request where the law allows; we may ask for proof of authorization. We will not discriminate against you for exercising your rights.

Children's Privacy

FORK is intended for adults and is not directed to children. You must be at least 16 years old (or 13 where permitted by local law) to use the Service, and you must be old enough to form a binding contract and use payment services where required.

We do not knowingly collect personal information from children under these ages. If you believe a child has provided us with personal information, contact support@forkitover.ai and we will take steps to delete it.

International Data Transfers

FORK is operated from the United States, and our service providers may process and store data in the United States and other countries. If you access the Service from outside the U.S., your information will be transferred to and processed in countries whose data protection laws may differ from those where you live.

Where we transfer personal data out of the EEA, the UK, or other regions that restrict transfers, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism. You can contact us for more information about these safeguards.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, give you additional notice (for example, by email or an in-product notice).

Your continued use of FORK after an update takes effect means you accept the revised Policy. If you don't agree with a change, you should stop using the Service and may close your account.

Contact Us and How to Make a Privacy Request

If you have questions about this Policy or want to exercise a privacy right, contact us at support@forkitover.ai. Please include enough detail for us to understand and verify your request.

You can also reach us by mail at: FORK ([Legal Entity Name — to be confirmed]), [Registered mailing address — to be confirmed].

For data protection matters, you may contact our privacy contact / data protection officer at [Privacy/DPO contact — to be confirmed]. If we are required to designate an EU or UK representative, their details are: [EU/UK representative — to be confirmed].

Governing Law

This Privacy Policy and any dispute relating to it are governed by [Governing law — to be set by counsel, e.g., the State of ___, USA], without regard to its conflict-of-laws rules, except where mandatory local data protection law gives you additional rights.

Note for review: This document is a draft prepared for review and finalization by FORK's legal counsel. Bracketed items — including the legal entity name, registered address, privacy contact, any required representatives, and the governing law — should be confirmed or completed by counsel before publication.