Privacy Policy

What we collect

• Account: your email address, and a display name if you set one.
• Shop & activity data: your store profile, buy rules, the cards in your binder, and your sell orders.
• Billing: subscriptions are processed by Stripe. We receive your plan status — we never see or store your full card number.
• Technical: IP address and basic request data, used for security, rate limiting, and error monitoring.

How we use it

To provide and secure the service — signing you in, generating quotes, processing sell orders, handling billing, responding to support, and improving the product. We do not sell your personal data, and we don't use it for third-party advertising.

Who we share it with

We use trusted service providers to run HitList, each handling only what they need:

• Supabase — database, authentication, and hosting.
• Vercel — application hosting.
• Stripe — subscription payments.
• Resend — transactional email (sign-in links, order updates).
• Sentry — error monitoring.
• Card-data providers (Scrydex, Groq, and an AI gateway) — they receive card names, numbers, or photos to identify and price cards, not your personal information.

Keeping shops separate

HitList is multi-tenant with strict row-level isolation: a shop can only see its own customers and data, and a customer can only see their own binder and orders. A shop never sees another shop's data.

Cookies

We use essential cookies to keep you signed in. We don't use advertising or cross-site tracking cookies.

Retention, access & deletion

We keep your data while your account is active. You can request a copy of your data or ask us to delete your account and associated data by emailing support@hitlists.io.

Security & changes

Data is encrypted in transit and protected by row-level security. No system is perfectly secure, but we work to protect your data. We may update this policy; we'll change the date above when we do.

Contact

Privacy questions? Email support@hitlists.io.