Privacy

1. Controller

The controller is Anyjoi GmbH, Köpenicker Str. 45, 12524 Berlin, Germany. You can reach us at contact@anyjoi.com.

2. Hosting and access data

Vercel hosts and delivers this website. When you open a page, technically necessary access data such as your IP address, requested URL, time, browser information and security signals may be processed to deliver and protect the service. The legal basis is our legitimate interest in a secure and reliable website under Article 6(1)(f) GDPR. Processing outside the EEA may occur subject to the provider's applicable safeguards.

3. Catalogue backend

Kaidomi retrieves title, brand, artist and event catalogue data server-side from the shared Kaidomi backend operated with Supabase. A normal anonymous visit does not create an app account or fan profile. If you choose Guest checkout, Supabase creates a temporary non-profile checkout identity. The website does not send your local Hype choices to this backend.

4. Images from source providers

Posters, artist images and product images may be loaded from the content delivery networks of their stated catalogue sources and shops. Those providers receive the connection data required to return the image, including your IP address. We load these images to provide the factual catalogue you requested, based on our legitimate interest under Article 6(1)(f) GDPR.

5. Accounts, Hype and commerce profile

Without an account, Hype choices remain in your browser's localStorage and are not sent to Kaidomi. If you sign in by email or Google, Supabase Authentication processes your email address or provider identifier and maintains the necessary session. Signed-in Hype choices are stored in sync_hype with your user ID, target key, change sequence, timestamp and a device identifier so they stay in sync with the Kaidomi app. Signed-in users may also save one delivery address with recipient name, street, city, postcode, country and receipt email so it stays available in the Kaidomi App and Web. If you choose Guest checkout, Supabase creates a temporary checkout identity and stores the name, German delivery address and receipt email you submit for pricing, payment, fulfilment and order documentation. Reusable payment methods appear only after the payment provider creates them during a real checkout. Kaidomi stores only the provider, method type, brand, last four digits, expiry, wallet type, billing country and default or reusable status for account display; it does not store card numbers, CVCs, wallet tokens or raw provider payloads. Google processes the OAuth hand-off under its own privacy terms. We process account, sync and commerce data to provide the service you request under Article 6(1)(b) GDPR.

Stripe processes the payment and technical data needed to offer payment methods, carry out the payment, prevent fraud and meet legal duties under its privacy notice. Fulfilment and delivery service providers receive only the details needed to fulfil and deliver the order.

6. Cosplay Tech Pack Studio

The Cosplay Tech Pack Studio is available to signed-in users. It processes the character and title you enter, body measurements, appearance details you choose to provide, skill level, budget, deadline, existing items, constraints and notes. An optional reference image is stored in private Supabase Storage. The bounded brief and reference are sent to Anthropic for the structured build plan and, after that succeeds, through Vercel AI Gateway to OpenAI for one private technical PNG. Those providers receive the prompt and image needed for generation, but not your Kaidomi email address or payment details. Kaidomi stores the input, generated plan and PNG, model, usage and cost receipts, and state timestamps under your account to provide the requested service under Article 6(1)(b) GDPR.

Only you can read the private intake, reference, generated plan and technical PNG. A commerce operator can read a completed pack only after you submit a made-for-you build-review request. The request records the server-calculated maximum labor estimate at EUR 30 per hour; it is not a payment or order. Your pack, reference and PNG remain until you delete them or your account is deleted, subject to legal obligations. Deleting a pack removes its private content but keeps a minimal allowance receipt with account ID, pack ID, allowance kind, UTC month and timestamp so deletion cannot reset a launch or monthly limit; account deletion removes that receipt. If plan generation fails, the optional reference is removed and any consumed single-build credit is restored. If PNG generation fails, the complete plan remains available and no additional generation credit is consumed.

7. Live analytics and page performance

Kaidomi's existing analytics stack starts on the first visit: typed Web journey events in Kaidomi's own database, PostHog and Google Analytics. Vercel Web Analytics and Vercel Speed Insights are disabled to avoid duplicate collection and cost. Typed receipts include page views, navigation, App Store-link clicks, Shop and event activity, bounded terms from the dedicated navigation, Discovery, Shop and event search fields, allowlisted campaign source, medium and campaign values, and the entry referrer domain when present. They never contain a full URL query or fragment. Each receipt contains a registered route, language, action time, random tab session ID and stable anonymous browser ID. When you are signed in, the browser asks Kaidomi for a short encrypted auth binding that contains no readable account ID or session token. The server attaches an internal account ID only if the current signed-in session proves that binding; the receipt database keeps only a one-way binding fingerprint so an exact retry cannot change the identity accepted first. The browser cannot choose or overwrite that account ID. A failed receipt can keep the opaque binding in its bounded local retry queue for up to seven days. The PostHog browser copy uses the same event ID; a delayed server copy is retained only as delivery fallback. PostHog also measures Web Vitals and sanitized network timings.

8. Cookies and browser storage

PostHog measures typed page and journey activity and can also record session replays, dead clicks, Web Vitals, sanitized network timings and canvas activity. It does not record console output or automatic exception text. Sentry separately receives scrubbed application error diagnostics when configured; request bodies, account fields, payment values, cookies and credentials are removed before an error can leave Kaidomi. Google Analytics receives Kaidomi's sanitized typed page, search, Shop and Event events. Its Enhanced Measurement may additionally collect scrolling, outbound links, video engagement and file downloads. Kaidomi's code does not send automatic page or history changes, automatic site-search or form events, arbitrary form values or raw query URLs to Google Analytics; those automatic categories also need to remain disabled in the provider settings. Kaidomi intentionally sends bounded terms from the dedicated navigation, Discovery, Shop and event search fields and allowlisted campaign source, medium and campaign values, but discards values that resemble an email address, credential, card number, IBAN, API key or high-entropy token. PostHog replay masks form inputs; password, payment and account fields are excluded from automatic interaction capture. Kaidomi's typed receipts exclude other form values, email addresses, passwords, payment data, auth tokens, cookies and arbitrary URL query or fragment data. When you are signed in, PostHog and Google Analytics are linked only to your internal account ID, never your email address or name, and that provider identity is reset or cleared when you sign out. These services may separately process the sanitized page location and domain-only referrer field, browser and device information, connection data such as your IP address, and use cookies, browser storage and device identifiers. Analytics is active by default. You can turn it off at any time under Your rights below. Turning it off stops new provider and first-party journey events and removes analytics identifiers and pending receipts from this device. It does not erase events already received; those follow the retention periods below. Guest Hype also uses localStorage. Supabase Authentication uses technically necessary browser storage and cookies when you sign in or start Guest checkout.

A Guest bag stores only opaque product references, quantities and timestamps in this browser. It is sent to Kaidomi only when the bag is resolved or checked out.

9. Retention

The random analytics session ID is stored in this tab's sessionStorage, survives page reloads and is renewed after 30 minutes without a journey event. Turning analytics off removes it. The stable anonymous browser ID stays on your device until you clear browser storage. Failed typed receipts remain in a bounded localStorage retry queue for at most seven days or until accepted; overflow or exhausted retries create a payload-free local diagnostic. First-party typed receipts become eligible for deletion after 90 days. Provider copies follow the deletion periods configured for each service. Guest Hype remains on your device until you remove it. Account and synced Hype data remain while your account is active or as otherwise necessary to provide the service and meet legal obligations; you may request deletion. A delivery address saved to a permanent account remains until you remove it. A temporary Guest checkout identity and its address are deleted by the daily cleanup once the identity is older than 30 days. Order, delivery/contact and payment-reference snapshots may remain only as needed to process, fulfil and document the order and meet legal obligations. Infrastructure, analytics and authentication providers retain data according to their applicable contractual, security and legal requirements.

A Guest bag remains in browser storage until you remove its items, clear browser storage or a confirmed order clears the exact purchased revision.

10. Your rights

Analytics is active by default. You can turn it off or back on at any time on this page; turning it off stops new collection and deletes analytics identifiers and queued receipts from your device. Subject to the GDPR, you may request access, rectification, erasure, restriction and data portability where applicable, and you may lodge a complaint with a data protection supervisory authority. Contact us at contact@anyjoi.com to exercise your rights or ask about this tracking.

11. Membership cancellation and withdrawal declarations

The permanent cancellation and withdrawal functions process the name, email address, provider choice, optional account or invoice reference, declaration kind, receipt time, account ID when signed in, and an immutable declaration fingerprint. This is necessary to identify, action and prove your declaration under Article 6(1)(b) and (c) GDPR. The underlying service-only record is visible only to authorized commerce operators. Telegram receives the name and a masked email so the operator is alerted immediately. Completed declaration records are deleted by the retention job six years after completion; unresolved declarations remain until they are handled.

Your analytics choice

Analytics is currently on for this device.