Privacy policy

thecoreboys.com is an unofficial site about CORE. It is not operated by, endorsed by, or affiliated with CORE or any of its members. "We" / "us" in this policy refers to the maintainers of this site. This policy explains what data the site collects, why we collect it, and what you can do about it.

The short version

• We don't require an account to view the site.
• We use Google Analytics — only after you accept the cookie banner.
• We embed third-party content (Twitch, YouTube, etc.) which sets its own cookies on its own surfaces.
• We don't sell personal data.
• We don't identify site visitors or audience members by face. Any face-presence pilot is limited to separately consenting adults in controlled, authorized footage.
• We respond to deletion / access requests at privacy@thecoreboys.com.

What we collect

Server logs

Our hosting provider (Vercel) records standard request logs: IP address, user-agent, request path, timestamp, response status, and a Vercel-issued request ID. These logs are retained for up to 30 days for security and operations.

Analytics

After you accept analytics cookies, we load Google Analytics 4 (property G-BG4VPN3LGG). GA4 stores anonymous usage signals (page views, navigation paths, approximate region from IP, device family) and sets first-party cookies (_ga, _ga_*). We use this data only to understand which pages people read and where the site's rough edges are.

Until you accept the banner, no GA scripts load. If you previously accepted and want to opt out, clear our cookies for this site or use the "Cookie settings" link in the footer.

Embedded third-party services

thecoreboys.com embeds content from third-party services. Each service may set its own cookies and collect its own data:

• Twitch — live status + clip embeds
• YouTube / Google — video embeds + analytics
• TikTok — embedded posts
• Instagram / Meta — photos, reels, and connected-account media
• X / Twitter — link-only by default; official DNT embeds load only after a per-post choice or the separate "Always load X posts" localStorage preference

We have no control over these services' data practices. Their privacy policies govern the data they collect from you.

X is not contacted by our post component before that distinct embed choice. Global Privacy Control and Data Saver keep X posts click-to-load.

Fan accounts

If you create a CORE account we store your email, a bcrypt password hash, display name, and consent timestamp. Sessions live in an HttpOnly cookie.

Connected platforms (Twitch, YouTube, X, TikTok, Instagram)

Connecting a platform is optional. We store an encrypted access and refresh token, the handle you connected, the scopes you granted, and inferred loyalty facts (follows, subscriptions, likes we are allowed to read). We do not receive Twitch watch time, VOD history, or YouTube watch history — those APIs are closed to third parties, and we do not scrape them. Disconnecting a platform deletes its tokens and inferred stats. Your CORE account remains. You can export a JSON copy of your data from /account at any time. Tokens are never included in that export.

Instagram connections are limited to the profile and media access you approve for an eligible professional account. TikTok connections are limited to approved profile and public-video scopes. We do not use either connection to post or comment as you. See our data deletion instructions to disconnect a platform or request full account deletion.

On-site presence

If you are signed in we may record that you opened the chat hub or played a video on this site. That is site presence, not Twitch or YouTube hours watched, and we label it that way.

Consent-only face-presence pilot

If we activate face-presence tagging for participating creators, it is a closed-set pilot for specifically enrolled adults—not facial recognition of site visitors, fans, crowds, or the public. Before creating a numerical face template, we provide a separate notice, identify the specific purpose and retention period, confirm that the person is at least 18, and obtain that person's express written or electronic permission. Appearing in a stream, having a public profile, or posting a photograph is not consent.

Purpose choices are recorded separately for template creation, controlled live matching, authorized archive matching, public name tags, and profile/social links. Automatic matching is limited to a controlled source or segment where every person who may be visible has consented. Uncontrolled or IRL footage uses staff-created manual labels instead of biometric matching. Suggested matches require staff review before publication, and an unknown face is not forced to the nearest enrolled identity.

Protected pilot data may include subject-approved enrollment images, numerical face templates, consent records, authorized source and time ranges, review evidence, and an audit log. Public viewers receive only a reviewed name/profile/time-range tag—not templates, reference images, raw similarity scores, or private evidence. We do not sell, lease, trade, or use face templates for advertising, authentication, moderation punishment, law enforcement, eligibility, or sensitive trait inference.

Our proposed operating defaults delete unknown face data immediately, enrollment uploads within 24 hours after quality review, review evidence within 7 days, and non-image diagnostic logs within 30 days. Active templates require renewal after no more than 12 months. A participating person may revoke a purpose or request correction/deletion at privacy@thecoreboys.com; matching and new public tags for that purpose are disabled promptly and covered biometric data enters the verified deletion process.

Forms

If you email us (e.g. press, booking, legal), we keep that correspondence for as long as needed to respond to it and for a reasonable record-keeping period afterward.

What we don't do

• We don't sell or rent personal data.
• We don't profile visitors for advertising.
• We don't track you across sites we don't own.
• We don't use dark-pattern consent flows. The banner has "Accept" and "Decline" buttons of equal weight.

Your rights

Depending on where you live, you may have rights to access, correct, or delete personal data we hold about you, and to object to certain processing. Email privacy@thecoreboys.com with your request and we'll respond within 30 days.

International transfers

Our hosting (Vercel) and analytics (Google) operate infrastructure globally. By using the site, you consent to data being processed in jurisdictions that may have different privacy laws than your own.

Children

thecoreboys.com is not directed at children under 13. We don't knowingly collect personal information from children. If you believe a child has provided us with information, email privacy@thecoreboys.com and we'll delete it.

The face-presence pilot does not enroll or recognize anyone under 18. If a minor or an unconsented person may enter a source, automatic face matching must remain off for that source or segment.

Changes

We'll update this policy when our data practices change. The effective date above is always current. Material changes will be announced on the home page.

Contact

privacy@thecoreboys.com