Privacy Policy
Last updated 3 August 2026
Information We Collect
Your email address. If you sign in with Google, the name and profile image Google returns as well. If you choose to set a password (it is always optional), we store it only as a salted, memory-hard hash — the password itself is never stored, logged or recoverable by anyone, including us.
Each time a sign-in link is requested, an account is created, a sign-in completes, or a free trial is granted or refused, we record the event with your IP address and browser user-agent. This exists to detect abuse of the trial and the sign-in system — nothing else.
A normalized form of your email address, used for one purpose: enforcing one free trial per person, so aliases of the same inbox cannot claim repeat trials.
Subscription state only — plan, status and renewal date — mirrored from Stripe. Card details go directly to Stripe and never reach our servers.
Which pages and sport boards are viewed. While you are signed in, a view is linked to your account so we can see which features members actually use; on the public pages (the landing and pricing pages) views are counted with no identity at all. These records carry no IP address, are visible only to the site operator, and are deleted after 90 days. Separately, anonymous click and scroll patterns go to our analytics tool — see section 3.
How We Use Your Information
- To sign you in and keep you signed in.
- To determine whether your account has access — trial, subscription or neither.
- To bill you and to send billing-related email through Stripe.
- To enforce one free trial per person and to detect abuse of the sign-in system.
- To understand how the product is used — which sports, boards and buttons get used, both anonymously in aggregate and, for feature usage, per account.
- To answer support email you send us.
We do not use your information to target advertising or to track you across other sites. We do not sell your personal information, and we do not share it for advertising.
Third-Party Services
These are every outside service that handles your data, and what each one gets:
Cookies & Tracking
Three first-party cookies, all of them essential to the service working. No advertising cookies, no third-party cookies, no tracking pixels.
hr_session— keeps you signed in. 30 days, renewed as you use the site.hr_known— remembers that this browser has signed in before, so we can send you to the right screen. Carries no identity. 1 year.hr_theme— your light/dark preference. 1 year.
The analytics tool stores a random anonymous identifier in your browser's localStorage (not a cookie). It carries no account identity, is never joined to your account, and is removed by clearing your browser's site data. Form fields are never captured — nothing you type leaves the page.
Data Security
- All traffic is served over HTTPS with strict transport security.
- A content security policy restricts what the browser is allowed to load and connect to.
- Sign-in links are stored only as one-way hashes, are single-use, and expire 15 minutes after they are issued.
- An optional password is stored only as a salted, memory-hard hash that cannot be reversed. New passwords are checked against known data-breach lists before being accepted, and repeated wrong guesses lock the account temporarily.
- Password reset links are single-use and expire in 15 minutes, and completing one signs the account out everywhere else.
- Card details never touch our infrastructure; Stripe handles them end to end.
No system is perfectly secure. If you believe you have found a security issue, email info@hit-rates.com and we will take it seriously.
Data Retention
- Account data — kept for as long as your account exists, and removed when you delete it.
- Sign-in records, including IP addresses — automatically deleted after 90 days, whether or not your account still exists.
- Page-view records — automatically deleted after 90 days. They never carry an IP address.
- Payment records — retained by Stripe under their own policy, as financial record-keeping generally requires.
Your Rights
You can, at any time:
- Ask us to delete your account by emailing info@hit-rates.com from the address on the account. Deletion removes your account record, your trial history and your subscription record, and cancels any active subscription. We action these by hand so that a request can be checked and your billing settled first.
- Cancel your subscription yourself, immediately, from your account page. Cancelling stops the next renewal and keeps your access to the end of the period you have already paid for — you do not need to contact us to stop billing.
- Request a copy of the data held about you, or a correction to it, at the same address.
Two things intentionally survive deletion, and you should know about both:
- Payment records held by Stripe. Stripe is the system of record for transactions.
- Sign-in records, detached from your account but still carrying the IP address and normalized email, until the 90-day window expires. This exists so that deleting an account cannot erase the record of abuse committed with it.
Page-view records also survive deletion briefly, but detached from your account with nothing identifying on them — they become anonymous counts until the 90-day window removes them.
Children's Privacy
HitRates is intended for adults aged 21 and over. We do not knowingly collect information from anyone under 21. If you believe a minor has created an account, email us and we will remove it.
Changes to This Policy
If this policy changes materially, the date at the top of this page changes with it. Continuing to use the service after a change means you accept the updated policy.
Contact
Questions about this policy, or about the data held about you, go to info@hit-rates.com.