Privacy Policy

1.1 Information You Provide

• Account Information: Email address, password (hashed), display name, and profile preferences when you create an account
• Billing Information: Payment method details are collected and processed by Stripe; we only store a reference ID and subscription status
• Trade Journal Entries: Notes, tags, and trade data you voluntarily enter into your trading journal
• Support Communications: Information you provide when contacting our support team
• Survey Responses: Feedback you provide through surveys or feedback forms

1.2 Information Collected Automatically

• Usage Data: Features accessed, time spent, interactions, and navigation patterns within the platform
• Device Information: Browser type, operating system, device type, and screen resolution
• Log Data: IP address, access times, pages viewed, and referring URLs
• Cookies: Session cookies for authentication and preference cookies for user settings

1.3 Information We Do NOT Collect

• Brokerage account credentials or login information
• Real trading account balances or positions (unless you manually enter them)
• Social Security numbers or government IDs
• Precise geolocation data

We use collected information to:

• Provide the Service: Authenticate users, deliver features, and personalize your experience
• Process Payments: Manage subscriptions, billing, and payment processing through Stripe
• Improve the Platform: Analyze usage patterns to enhance features and fix issues
• Communicate: Send service updates, security alerts, and (with consent) marketing communications
• Provide Support: Respond to inquiries and troubleshoot problems
• Ensure Security: Detect and prevent fraud, abuse, and unauthorized access
• Comply with Law: Meet legal obligations and respond to lawful requests

We use Supabase for authentication and user management. Supabase provides:

• Secure password hashing (bcrypt)
• Email verification for new accounts
• Password reset functionality
• Session management with JWT tokens
• Optional social authentication (Google, GitHub)

Your password is never stored in plain text. We implement industry-standard security measures including HTTPS encryption, secure session handling, and regular security audits.

For more information, see Supabase's Privacy Policy.

All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. When you subscribe:

• Your payment card details are sent directly to Stripe—we never see or store them
• We receive and store only a Stripe Customer ID and subscription status
• Stripe handles all payment security, fraud detection, and compliance
• Billing history is available through your Stripe customer portal

We do not have access to your full credit card number, CVV, or bank account details. For more information, see Stripe's Privacy Policy.

We use privacy-focused analytics to understand how users interact with our platform:

• Analytics Provider: We use privacy-respecting analytics that do not track individual users across websites
• No Third-Party Trackers: We do not use Facebook Pixel, Google Analytics, or other cross-site tracking tools
• Aggregate Data Only: Analytics data is aggregated and anonymized; we cannot identify individual users from analytics
• No Ad Networks: We do not serve advertisements or share data with advertising networks

Cookies We Use

We do not sell your personal information. We may share information only in these limited circumstances:

• Service Providers: With trusted partners who help us operate the platform (Supabase for auth, Stripe for payments, hosting providers)
• Legal Requirements: When required by law, subpoena, or legal process
• Protection of Rights: To protect our rights, privacy, safety, or property, or that of our users or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you would be notified)
• With Consent: When you explicitly authorize us to share specific information

We require all service providers to maintain confidentiality and use your data only for the purposes we specify.

• Data Location: Your data is stored on servers in the United States, operated by our infrastructure providers
• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Employee access to user data is limited and logged
• Regular Backups: Data is backed up regularly with encrypted, secure backups
• Security Testing: We conduct regular security assessments and vulnerability testing

While we implement robust security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the best of our ability.

We retain your data according to these guidelines:

• Account Data: Retained while your account is active and for 30 days after deletion request
• Journal Entries: Retained while your account is active; deleted with your account
• Usage Analytics: Aggregated data retained indefinitely; individual session data deleted after 90 days
• Support Records: Retained for 2 years for quality and training purposes
• Billing Records: Retained as required by tax and accounting regulations (typically 7 years)

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Export: Download your data in a portable format
• Restriction: Request limitation of processing
• Objection: Object to certain types of processing
• Withdraw Consent: Withdraw previously given consent

How to Exercise Your Rights

• Account Settings: Update profile information, preferences, and communication settings
• Data Export: Download your journal entries and account data from Settings → Data
• Account Deletion: Delete your account from Settings → Account → Delete Account
• Contact Us: Email privacy@hitthebid.com for other requests

We will respond to valid requests within 30 days. We may need to verify your identity before processing requests.

HitTheBid is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from your country.

For EU/EEA Users (GDPR)

We process your data based on: (a) your consent, (b) performance of our contract with you, (c) compliance with legal obligations, or (d) our legitimate interests (improving the Service, preventing fraud). You have the right to lodge a complaint with your local data protection authority.

For California Residents (CCPA)

You have the right to know what personal information we collect, request deletion, and opt out of the "sale" of personal information (which we do not do). We do not discriminate against users who exercise their privacy rights.

HitTheBid is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete it promptly. If you believe a child has provided us information, please contact us at privacy@hitthebid.com.

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a new effective date
• Sending an email notification for significant changes
• Displaying a prominent notice in the application

We encourage you to review this policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information.