Privacy Policy

Account information. If you create an account, we store your email address and an encrypted password. We never store your password in plain text. When you set a new password, we check it against Have I Been Pwned's public breach database to warn you if it's already known to be compromised — only a short, irreversible partial fingerprint of the password is ever sent for that check, never the password itself. If you turn on two-factor authentication, your authenticator app secret is stored securely by our authentication provider (Supabase), never by us directly.

Rewards activity. If you use the points/rewards program, we store the purchases you report, your points/XP balance and history, redemption requests, and Plinko game history.

Usage data. We keep basic, self-hosted pageview analytics — which pages get visited, roughly when, what site (if any) referred you, and a coarse device type. No third-party analytics tool or advertising pixel is used. We do not set a cookie for this and never store your IP address: a visit is grouped using a one-way, irreversible fingerprint of your IP, browser, and the current date, which changes every day and can't be traced back to you.

Support conversations. If you message us through the chat widget, we store your name, email, and the conversation.

Local browser storage. Some preferences (like dismissing the sign-up popup, or your last-used pass-probability calculator inputs) are saved only in your own browser's local storage — they are never sent to us.

• To operate your account and the points/rewards program (calculating balances, tiers, and eligibility).
• To manually confirm reported purchases and fulfill reward redemptions.
• To send account-related email (sign-up confirmation, password reset).
• To understand how the site is used and improve it (aggregate pageview analytics only, see above).

We do not sell your personal information.

Account and rewards data is stored with Supabase (Postgres), a third-party database provider. Access is restricted by row-level security so that, in normal operation, you can only read and write your own data. We'll update this section if the hosting or database provider ever changes.

We use the minimum cookies needed to keep you signed in (via Supabase Auth) and to render the site with your device correctly. We do not currently use advertising or tracking cookies. A short notice about this appears the first time you visit; you can revisit this policy any time for the full detail. We'll update this section, and the cookie notice's own wording, if analytics or advertising cookies are ever added.

• You can request a copy of the personal information we hold about you.
• You can request that we delete your account and associated personal information, subject to any records we're required to keep (e.g. for confirmed reward redemptions already fulfilled).
• You can unsubscribe from any non-essential email we send.

To exercise any of these, contact us at eliduplessis@proton.me.

This site is not directed at, and we do not knowingly collect information from, anyone under 18.

We may update this policy from time to time; the "last updated" date at the top will reflect the most recent change.

Questions about this policy: eliduplessis@proton.me.