Privacy policy

hoardboard saves links to things you are thinking about buying. This page says what data that involves, in plain words, because you should not need a lawyer to know what an app knows about you.

What we collect

• Your account: your email address and a one-way hash of your password — we cannot read the password itself. If you sign in with Google or X, we store which account vouched for you; X shares no email with us, so we ask you for one.
• What you save: your boards, links, notes, tags, prices and statuses. That is the product; it is yours, and it is fenced off from every other account at the database level.
• Pages you point us at: when you save a link, our server reads that page once to fill in the name, picture and price, and re-checks the price nightly. We keep a resized preview image, not the page.
• Your sessions: the browser type and IP address of each sign-in, shown to you under Settings so you can spot and end a session that is not yours. Idle sessions expire after 30 days.

What we do not do

• No advertising, no selling or sharing of your data, no data brokers.
• No analytics scripts, no trackers, no fingerprinting. The only cookie is the one that keeps you signed in.
• We do not read your boards. Access to production data is limited to keeping the service running.

Who helps us run it

Your data lives on servers in the United States: our own server (hosted with Hostinger, Boston), image previews in Cloudflare R2, and email — verification and password reset only — delivered through Resend. Each processes data solely to provide their service to us.

Retention and deletion

Export everything as JSON from Settings whenever you like. Deleting your account deletes your data immediately — boards, items, images, the lot — and encrypted backups age out entirely within 14 days. Server logs are kept briefly for keeping the service healthy.

Questions

Email privacy@hoardboard.app. If this policy changes in a way that matters, we will email you before it takes effect.