CARDSNIPER
Privacy Policy
1. Controller and contact
Ciaran Weston (trading as CardSniper) is the data controller for the personal data described here. Contact us about privacy at westonciaran@gmail.com or 39 Tanhouse Lane, Wokingham, RG41 2RL.
2. What we collect
- Account data: your email address and a securely hashed version of your password (we never store your actual password).
- Subscription data: your Stripe customer and subscription identifiers and status. Your card details are handled entirely by Stripe — we never see or store them.
- Approximate location from your IP address: when you view the deal feed, your IP is sent to a geolocation provider so we can show prices in your local currency. We don't store your IP for this purpose beyond a short in-memory cache.
- Technical data: a single essential login cookie (see section 7) and standard server logs.
- Visit measurement: when a page is requested we record the page address (the route only — never anything you typed into a search or form), which site referred you if any, and a short one-way code that stands in for "the same browser". That code is produced by hashing your IP address and browser user-agent together with a secret that we regenerate every day, so it cannot be reversed to identify you, cannot be linked to you across days, and cannot be matched against any other website's records. We do not store your IP address or user-agent themselves for this purpose, and no cookie is set to do it. If you are signed in, the visit is also linked to your account id so we can measure how many subscribers use the feed.
3. Why we use it and our legal basis
- To provide your account and the service, and to take payment — performance of our contract with you.
- To secure the service and prevent misuse, and to show prices in your local currency — our legitimate interests in running the service well.
- To understand how the site is used — how many people visit, which pages they read, which sites send them here, and which deals they click through to eBay — so we can improve the service and see whether our advertising works. This is our legitimate interest in operating and improving a business. We have deliberately chosen the least intrusive way to do it: no cookies, no third-party analytics company, no advertising profiles, no cross-site tracking, and no stored IP addresses. Nothing here is used to make decisions about you individually, only to count totals.
- To meet legal, accounting and tax obligations — legal obligation.
4. Who we share it with (processors and third parties)
- Stripe — payment processing and subscription management.
- Render — hosting of the application and database.
- eBay — we query eBay's API for listings; we do not send them your personal data.
- ipwho.is — receives your IP address to return your approximate country for currency selection.
- open.er-api.com — provides exchange rates (no personal data sent).
Some of these providers are based outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards (such as the providers' standard contractual clauses or equivalent).
5. How long we keep it
We keep your account and subscription data for as long as you have an account, and for a limited period afterwards where needed for legal, tax, or dispute-resolution reasons. Delete your account at any time (section 6) and we'll remove your account data, subject to those limited retention needs.
Visit-measurement records (section 2) are deleted automatically after 180 days. In practice they stop being linkable to a particular browser much sooner than that — after a day, because the secret used to generate the visitor code is replaced daily.
6. Your rights
Under UK data protection law you have the right to access, correct, delete, restrict, or object to our use of your personal data, and to data portability. You can delete your account and its data yourself from your Account page, or email us at westonciaran@gmail.com to exercise any right. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to help first.
7. Cookies
We use one strictly-necessary cookie to keep you logged in. It contains a signed session identifier, not your personal details, and is required for the site to work — so under the applicable rules it doesn't need consent. We do not use advertising or third-party tracking cookies.
That is the only cookie on the site. Our visit measurement (section 2) is done entirely on our own server without setting or reading any cookie, without any third-party analytics script, and without storing your IP address — which is why you don't see a cookie banner here.
8. Children
CardSniper is not intended for anyone under 18 and we don't knowingly collect their data.
9. Changes
We'll update this policy as the service evolves and post the current version here.