Privacy
HaulPlay is run on our own server. There is no ad network, no tracking pixel and no third-party script on any page unless we say so below. This page lists what we store, because that list is short enough to print.
Your account
An account holds your email address, username, display name, an avatar if you upload one, and your password as a scrypt hash; the password itself is never stored and cannot be read back from the hash. Everything else under your account is what you made: finds, boards, comments, likes, follows and notifications.
Cookies and your browser’s storage
One cookie: sid, set when you log in. It is httpOnly, expires after 30 days, and holds a random token; the server keeps only a SHA-256 of it, so a copy of our database cannot be used to sign in as you. Logging out deletes both ends. We set no other cookie and no third party sets one here.
What you collect without an account stays in your browser’s own storage: your haul (its finds, who each one is for and the budgets), up to three finds to compare, the finds you marked Not interested, the last sixty finds you opened (Recently viewed, on You), your last eight searches, whether the guide on the left is narrowed, and whether you closed the welcome note. To show your haul, your comparison or the finds you opened with today’s prices, the page sends our server the finds’ numbers and nothing else. A haul you share is a link that carries its finds, the people and the budgets in its address: whoever opens it sees them, and our server sees them when they do. Clearing this site’s data in your browser removes all of it.
Clicks on product links
When you open a product we count one click against that find, for that day, for the country the CDN reports. That is three columns: find, date, country code; no IP address, no account id, no time of day. It is what tells us which finds are worth posting more of. A second press on the same find the same day isn’t counted, and your IP address is how we tell that it is a second one (see below).
Each press also sends the site’s owner a message on Telegram, so we see presses as they happen: the product, its price, the store, the page you pressed it on or the site you came from, the country, whether it was a second press, and phone, tablet or computer with its system and browser. The message carries the time it was sent, as every Telegram message does, and Telegram keeps it as it keeps any other. No IP address and no account is in it.
The click takes you to Amazon with our Associates tag on the link. From that point Amazon’s privacy notice applies, including the cookie that credits us a commission if you buy something. We never learn what you bought: Amazon reports sales to us by product and day, in one total.
IP addresses
Your address is used to count login attempts, signups, uploads, reports, searches that found nothing, reads of a haul or a comparison and clicks through to a store against a limit, and for nothing else. The counter is a row holding the address, a number and an expiry a few minutes to a day out; expired rows are deleted every night. There is no access log in the application; the web server’s log, which records the address with each request, is deleted after 30 days.
Photos you upload
Every upload is re-encoded to WebP before it is stored, which drops the EXIF block with it: camera, timestamps and GPS coordinates never reach the disk. We keep the re-encoded image, its dimensions and a SHA-256 of the bytes, which is what stops the same photo being posted twice.
Logs and searches
A server error stores its message, the path it happened on and the stack trace, so it can be fixed; these are deleted after 30 days, and a daily summary of them reaches the owner on Telegram. A search that returned nothing stores the phrase and how often it was typed (not who typed it, not when), and is deleted after 90 days of nobody repeating it. It is the only way we hear what the site doesn’t stock.
We mail you about comments on your finds, new followers, review decisions, and a weekly digest of what you missed. All of it is off in one switch in settings, and every one of those mails carries an unsubscribe link plus the one-click header your mail app’s own unsubscribe button uses. Password reset and email confirmation are not marketing and are always sent. Mail leaves through our own SMTP provider; we run no mailing list anywhere else.
Without an account you can sign up for the weekly email of new finds. For that we keep the address, when you confirmed it and when you left; nothing is sent until you press the button in the first email, and every weekly email links to a page that stops it in one press.
Getting your data out, or deleting it
Settings has a button that downloads everything your account holds as a JSON file, and another that deletes the account. Deletion is immediate and takes your finds, boards, comments, likes, follows, notifications and uploaded files with it. What survives is the click counts, because they were never attached to you in the first place.
Analytics
Umami, running on our own server, so what it records goes to no other company. For each page you open: its address (a search you typed included) and title, the page you came from, your browser, operating system, device type, screen size and language, and where your IP address places you: the country, sometimes the region and city. The IP address itself is not stored, and there is no cookie. Visits are told apart by a code made from your IP address, your browser and a key that changes every month, so no one can follow a person from one month to the next or from this site to another. We keep these records for 24 months, long enough to compare a season with the same one a year before.
Questions
Write to hello@haulplay.com. If you are in the EU or UK you can ask for a copy, a correction or an erasure of your data and we answer within 30 days; the two buttons in settings do the first and the last of those immediately.