Privacy Policy
Last updated 1 August 2026
Information We Collect
Your email address. If you sign in with Google, the name and profile image Google returns as well. There is no password — the service has no password field and never sees or stores one.
Each time a sign-in link is requested, an account is created, a sign-in completes, or a free trial is granted or refused, we record the event with your IP address and browser user-agent. This exists to detect abuse of the trial and the sign-in system — nothing else.
A normalized form of your email address, used for one purpose: enforcing one free trial per person, so aliases of the same inbox cannot claim repeat trials.
Subscription state only — plan, status and renewal date — mirrored from Stripe. Card details go directly to Stripe and never reach our servers.
How We Use Your Information
- To sign you in and keep you signed in.
- To determine whether your account has access — trial, subscription or neither.
- To bill you and to send billing-related email through Stripe.
- To enforce one free trial per person and to detect abuse of the sign-in system.
- To answer support email you send us.
We do not use your information to build a profile, target advertising, or track you across other sites. We do not sell your personal information, and we do not share it for advertising.
Third-Party Services
These are every outside service that handles your data, and what each one gets:
Cookies & Tracking
Three first-party cookies, all of them essential to the service working. No advertising cookies, no third-party cookies, no tracking pixels.
hr_session— keeps you signed in. 30 days, renewed as you use the site.hr_known— remembers that this browser has signed in before, so we can send you to the right screen. Carries no identity. 1 year.hr_theme— your light/dark preference. 1 year.
Data Security
- All traffic is served over HTTPS with strict transport security.
- A content security policy restricts what the browser is allowed to load and connect to.
- Sign-in links are stored only as one-way hashes, are single-use, and expire 15 minutes after they are issued.
- There is no password to steal — the database has no password column.
- Card details never touch our infrastructure; Stripe handles them end to end.
No system is perfectly secure. If you believe you have found a security issue, email info@hit-rates.com and we will take it seriously.
Data Retention
- Account data — kept for as long as your account exists, and removed when you delete it.
- Sign-in records, including IP addresses — automatically deleted after 90 days, whether or not your account still exists.
- Payment records — retained by Stripe under their own policy, as financial record-keeping generally requires.
Your Rights
You can, at any time:
- Delete your account yourself, immediately, from your account page. This cancels any active subscription and removes your account record, your trial history and your subscription record.
- Request a copy of the data held about you, or a correction to it, by emailing info@hit-rates.com.
Two things intentionally survive deletion, and you should know about both:
- Payment records held by Stripe. Stripe is the system of record for transactions.
- Sign-in records, detached from your account but still carrying the IP address and normalized email, until the 90-day window expires. This exists so that deleting an account cannot erase the record of abuse committed with it.
Children's Privacy
HitRates is intended for adults aged 21 and over. We do not knowingly collect information from anyone under 21. If you believe a minor has created an account, email us and we will remove it.
Changes to This Policy
If this policy changes materially, the date at the top of this page changes with it. Continuing to use the service after a change means you accept the updated policy.
Contact
Questions about this policy, or about the data held about you, go to info@hit-rates.com.