What we store, and what we deliberately do not

There are no accounts

No sign-up, no password, no profile, no login. You can read every page on this site — the board, the Hall of Fame, the stats — without giving us anything at all. There is no cookie banner because there is nothing to consent to: we set no analytics cookie and no advertising cookie, on any page.

What we ask for when you contribute

• Your email address, so the payment processor can send you a receipt.
• A nickname, optional, if you want a name on the board instead of a fallback.
• Which fandom and how much, which are the whole point and are public by design.
• Confirmation that you are 16 or older and that you accept the terms.

Your card details go straight to Polar. They never reach our servers, so we cannot store them.

What we store about you, precisely

Against each contribution, our database holds:

• A salted hash of your email address, not the address. The address is normalised, combined with a secret value only our server knows, and put through SHA-256. What is stored is the resulting fingerprint.
• Your nickname as you typed it, plus whether it has been approved for public display. An unapproved nickname is never rendered anywhere public.
• A two-letter country code, taken from the billing address the payment processor returns. Not from an IP lookup. Nothing more precise than the country.
• The amounts, in cents: what you were charged, what counted towards the score, anything refunded, and the processor's fee.
• Identifiers from the payment processor for the order, the checkout and the customer record, so a specific payment can be found again and refunded.
• The timestamp, which decides which week your contribution belongs to.

Why a hash instead of the address

The hash does three jobs: it enforces the rolling limit of $50 per 24 hours, it counts distinct contributors without counting the same person twice, and it decides who is among the first 100 givers to a fandom. All three need to recognise a returning person. None of them needs to know who that person is.

Being straight about the limits of that: a hash is not anonymity. Anyone holding our secret value and a guess at your address could confirm a match, and we recompute the hash from an address you give us when you write to support. What it does mean is that we do not hold a list of fan email addresses that can be leaked, subpoenaed, sold or emailed by a future owner of this site. We treat the hash as personal data anyway, because pretending otherwise would be a word game.

The audit log, which does contain your email

We would rather tell you this than have you find it. Every payment event our payment processor sends is stored verbatim, exactly as received, as an audit log — that is how the public counter can be proved to match reality, and how a duplicate delivery is stopped from counting your money twice.

Those raw payloads include the email address the processor holds for you. They are reachable only with our server credentials, are never published, never rendered on any page, and are never used to send you anything. Nothing on this site emails you; your receipt comes from Polar. [TO BE CONFIRMED: retention period after which raw payment payloads are deleted or redacted]

What is public, and what never is

Public: the amount, the fandom, the country, the time, whether the money was seed, a Founder position, and an approved nickname.

Never public: your email address, the hash of it, any payment or customer identifier, your IP address, your full billing address, and any nickname that has not been approved. The endpoints the pages read from cannot return those fields at all, which is a structural guarantee rather than a promise to be careful.

Cents are not shown on public totals either — they are floored to whole dollars, so an individual amount cannot be picked out of a total by its trailing digits.

Which other companies your browser talks to

Being specific, because “we respect your privacy” means nothing:

• No analytics. No Google Analytics, no Plausible, no Meta pixel, no TikTok pixel, no session recording, no heatmaps. We do not know which pages you visited.
• No font CDN. The typeface is served from this domain. No request goes to Google Fonts or anywhere similar, which is a deliberate choice: a font request would hand your IP address to another company on every page load.
• No advertising, no trackers, no social embeds loading scripts from other domains.
• Vercel serves this site, so their servers see your IP address and which pages you request, in the ordinary way any web host does.
• Supabase hosts our database and pushes the live updates you see on the board. Your browser holds an open connection to them while you watch the board, so they see your IP address too.
• Polar sees everything you type into their checkout, because that is where the payment happens. Their privacy policy covers it, and they are the merchant of record for the transaction.

That is the complete list. If it changes, this page changes in the same commit.

How to have something removed

There is no self-service delete button, and we are not going to pretend there is one. The real process is a person reading an email:

1. Write to [TO BE CONFIRMED: contact email] from the email address you paid with, or tell us that address and the approximate time of the payment. We recompute the hash to find your rows — we cannot search for you any other way.
2. We can remove your nickname and your country from a contribution, and we can refund the payment if it is still within the window or if the circumstances warrant it.
3. We can delete the raw payment payloads that contain your email address, on request, once they are no longer needed to defend a dispute.
4. We cannot remove the amount from a total that has already been published for a closed week. The frozen record is what makes the scoreboard trustworthy, and by then the amount is not attached to anything identifying you. Ask us and we will explain exactly what remains, which will be a hash, a country and a number.

We answer within a few days, by a human. [TO BE CONFIRMED: data controller identity and the supervisory authority a complaint can be made to]

People under 16

This site is for people 16 and over and we do not knowingly take money from anyone younger. If you are a parent or guardian and your child paid, write to us: we refund it and remove the nickname, whatever the refund window says.

Changes to this page

If the software starts doing something different, this page is updated to match it. It is meant to describe the system as built, not as imagined, so a difference between this page and the software is a bug — tell us and we will fix one or the other.