Legal
Privacy Policy
Who holds your data
SLCTD LLC, of Warwick, Rhode Island, USA, is responsible for the personal data described here. Questions go to ryanc8500@gmail.com.
What we store
Your account. Email address and password hash (held by Supabase Auth), username and its history, and optionally a display name, bio, timezone and avatar.
Security events. Every sign-in, failed sign-in, password change and two-factor event, with the IP address and user agent that made the request. This is what lets you spot someone else in your account, so it is written server-side and you can read it but not edit it, under Settings → Security.
Buying. Shipping addresses you save, the Workers you configure and what they asked for, your entries, and your orders — items, amounts, status and tracking. Cards are held by Stripe; we store only a reference to them plus the brand, last four digits and expiry so you can tell them apart.
Selling, if you sell here: your application, business details, storefront content, and the identifiers of your connected Stripe account. Identity and banking details for payouts are collected by Stripe directly and are not visible to us.
What a seller can see about you
This is worth stating precisely, because it is the question a marketplace usually answers vaguely.
A seller you have ordered from sees your name, shipping address and what you ordered — they have to, to post it. They see the entries placed in their own drops.
They do not see your payment details, your email password, your activity on other sellers’ drops, or anything about people who entered and did not win beyond aggregate counts. Those aggregate counts are withheld entirely below a threshold set by us, so that a seller cannot identify an individual from a small number. Your reputation as a buyer is not published, scored, or shown to anyone.
Payments
Payments are processed by Stripe, who act as a separate controller for the data they collect. Your card details go to Stripe and never reach our servers. When you are allocated units we ask Stripe to charge the card you saved, on the seller’s behalf. We keep the amounts, the Stripe identifiers and the outcome.
Passwords
We never see your password in readable form. When you choose one we check it against the Have I Been Pwned breach corpus using k-anonymity: only the first five characters of its SHA-1 hash leave the server, and the match is done locally. The password itself is never transmitted.
We email you about things that happen to your account and your orders — confirmation, password reset, drop results, shipping, security alerts. Order and security email is part of the service and cannot be switched off while you have an account. You can turn off the rest in Settings.
Cookies
We set a session cookie so you stay signed in, and Cloudflare Turnstile sets one to tell humans from bots on the sign-in and sign-up forms. There is no advertising or analytics tracking on this site and no third-party profiling cookie.
How long we keep it
Account data lasts as long as your account. Orders are financial records and are kept for as long as tax and accounting law requires, which is longer than your account may last — see below. Security events are kept so an intrusion is still visible after the fact.
Deleting your account
Settings → Account schedules deletion. There is a 30-day grace period, in which signing in cancels it. After that, your account, profile, username history, avatar, addresses, saved cards, Workers and notifications are removed.
Completed orders are not deleted, because both the seller and we are required to keep them. Instead the link between the order and you is severed and the stored address is reduced to its country, which is retained for tax reporting and identifies nobody on its own. The result is a financial record that no longer describes a person.
Your rights
You can export everything we hold about you as JSON, and delete your account, from Settings → Account, without asking us. You can also ask us to correct anything that is wrong. If you want any of this handled by a person, write to ryanc8500@gmail.com.
Who else processes it
Supabase (database, authentication and file storage), Vercel (hosting), Stripe (payments and seller payouts), Resend (email delivery), Cloudflare (Turnstile bot protection), and Google — only if you choose to sign in with it. Each is given what it needs to do its job and nothing else. We do not sell your data, and we do not share it for advertising.
Changes
If we change this materially we will say so on this page before the change takes effect.