Private first.
Public by choice.

Effective October 15, 2026. digger.fans is an independent fan project run by Vibe Frontier, LLC. Contact: support@digger.fans.

What we process

When you upload an original ticket email, the server processes its headers, authentication evidence, recipient, seller and booking details to decide whether it can support ticket-backed credit. Emails can contain personal information beyond those fields. Upload only your own relevant confirmations.

The private account record stores your chosen name, optional X handle, optional re-encoded avatar, verified recipient addresses, submission outcomes, normalized booking evidence and cumulative ticket count. Addresses and short-lived originals are encrypted at rest. Hash-based fingerprints help recognize duplicate evidence; they are not anonymous merely because they are hashed.

Originals do not stay by default

Processed originals are deleted after processing unless you explicitly consent to retain an unresolved original for review. Queued or interrupted originals expire within 24 hours. Consented pending-review originals expire within 7 days. Expiry is enforced at startup and by the regular cleanup sweep, which runs about every minute. At most three processing retries are allowed.

A pending issuer or unclear booking is not a certification. Review consent only permits bounded retention and review; it does not lower authentication requirements.

What can become public

Your account starts private. Only an explicit profile opt-in permits a public profile and leaderboard inclusion. The public record includes your chosen name, optional handle and its verified/manual state, optional avatar, ticket count, milestone, supporter mark and update date. It never includes your receipt, email address, booking reference, seat, theater or screening history.

Only public, active, non-test accounts with positive credit are listed. Private, suspended, deleted and zero-credit accounts are excluded. Going private removes public access. Images and screenshots others have already saved cannot be recalled.

Optional mailbox and X connections

Upload works without a connector. Configured Gmail or Microsoft connections request read-only mailbox permission that is broader than a single chosen message. We show a narrow candidate list and import only messages you explicitly select. There is no background mailbox sync. Short-lived mailbox tokens expire within 15 minutes; you may disconnect earlier in your profile.

Optional X linking uses X’s own sign-in and establishes the returned X user ID and current handle; the access token X issues is discarded unused. A typed handle is not verified. X linking does not post anything. If an optional picture service is configured, a verified X account’s public profile picture is fetched from the numeric X user ID alone (nothing else is sent), re-encoded and used as your avatar unless you upload your own; disconnecting X removes it.

Optional remote parsing

Cloud extraction is unavailable unless the operator has explicitly enabled it under the project’s privacy and cost gates. Where offered, sending a message to a remote parser requires a separate, unchecked-by-default consent. Local upload must not silently fall back to a cloud service. An extraction model cannot authenticate an email or grant credit by itself.

Proof sent by hand for the top 5

If you send other proof of purchase because your total would reach the top 5, an AI assistant (Anthropic’s model, used through the operator’s subscription) checks it first. It sees the images, resized and without photo metadata, and the screenings and note you typed, but not your name or account, and it only advises. The operator then decides. He opens your proof through a link on digger.fans that expires, and the proof is deleted from digger.fans at his decision, or after 30 days if nobody has decided. The assistant’s provider processes the images to answer; this project keeps no other copy.

Cookies, mail and operational records

A first-party session cookie normally lasts 30 days and keeps your local account connected. An account that never kept anything, with no verified address, receipt, theater request, public profile or payment, is deleted once no session can reach it and it is at least 30 days old. Email-verification and login links expire after 15 minutes and are single-use; opening a link does not consume it. Verification requires a confirmation button. Sign-in can restore an existing account or create a separate account for a new address; it never moves submitted receipts, merges accounts or certifies a booking. Expired challenges and local development mail are cleaned up within 24 hours. The local mail catcher, when enabled, exposes only the current session’s messages and is not a real email delivery service. Consuming local-catcher proof permanently marks the target account test-only and unpublishes it. It cannot establish genuine email ownership, public credit or operator access, and later SMTP proof does not remove that test marker.

Allowlisted export, share-action, copy-link and supporter-interest events are retained for up to 90 days; these record an action, not proof of a public post. Minimal security and operator audit records are retained for up to 365 days. Raw receipts, addresses and sensitive URLs must not be written to these logs.

Payments

Optional supporter checkout uses Stripe where configured. Stripe processes payment information under its own terms. We store account-bound payment state and minimal support/refund records, not full card numbers. The payment return page does not grant supporter status; verified payment events do. Billing records may need to be retained to meet legal and accounting obligations.

Delete or disconnect

Disconnect an optional provider from My file. Account deletion is an explicit action on that page: public access and account identifiers are erased first. Managed private files are removed too; if filesystem erasure is temporarily unavailable, a durable cleanup job retries and the confirmation page reports the pending state. Anti-replay tombstones remain while this project operates so deleted evidence cannot be credited again. Minimal billing and legal records may remain where required.

Backups are operator-managed, normally expiring after 14 days and never configured beyond 30 days under the project backup procedure. A deletion journal must be applied before a restored database becomes public. Copies already exported or shared by other people are outside the project’s control.

Your choices remain separate

Uploading is not public-profile consent. Proving a recipient is not marketing consent. Buying support is not extra ticket credit. A share button is not permission to post for you. Issuer-request email updates require a separate explicit opt-in, authorized SMTP delivery and an eligible SMTP-verified address. Status messages are not sent through the local catcher. You can stop email updates on the request page without losing in-app status access; queued delivery checks consent again. Contact the address above for access, correction, deletion or privacy questions.