Privacy Policy

1. Who handles your information

Hritik, the operator of BuyMeTokens, is responsible for the information handled through this website. For a privacy question or request, use our Contact page.

2. Placement information

When you prepare a placement, its name, website link, and selected logo stay in your browser until submitted. Published placements are stored in our database and their logos in file storage, provided by Supabase. The name, logo, website link, and displayed contribution amount are public. Private order and contact information are not shown on the wall.

Permanent placements have no scheduled expiry. Their public information remains until removed at your request, following a refund, or under our Terms of Service. Do not submit information you are not authorized to share.

3. Visiting this website

Your browser sends technical information such as your IP address, requested URL, browser details, and request time to the server delivering the site. Hosting providers may process request and security logs to operate and protect that service.

The site requests fonts from Google Fonts, which receives the technical information needed to deliver them. See Google's Privacy Policy. We use a first-party visit cookie to estimate visits and active visitors. It lasts 30 minutes and contains a random identifier, not your name or email. The server keeps a keyed hash of this identifier and recent activity for up to one day; aggregate visit totals remain. Counts are approximate and may include automated traffic. We do not use advertising cookies.

4. Contact and admin access

The contact form collects your name, reply email, and message. Messages are stored privately in Supabase and can be read by the site administrator to answer questions and resolve issues. We do not display your message or email publicly. Sending a message does not subscribe you to marketing.

If you contact us on X, your messages and profile details are also handled under X's Privacy Policy. Do not send passwords, full card numbers, CVCs, or bank credentials.

Admin sign-in uses Supabase Auth and secure, HTTP-only session cookies. The public site does not disclose the administrator's sign-in email. See Supabase's Privacy Policy for information about our database, storage, and authentication provider.

5. Payment and order information

Where a purchase is processed through a payment provider, that provider handles billing and payment information under its own privacy policy. Order references, placement details, payment status, and contact information may be used to fulfill a purchase, provide support, and handle refunds. Private contact and payment details are not displayed on the wall.

BuyMeTokens does not store full card numbers or CVCs. We will identify the payment provider and update this policy when payment processing is connected.

6. Sharing, retention, and safeguards

We do not sell your personal information. Information may be handled by the providers needed to deliver the website or support channel, or disclosed where legally required. Providers may process information outside your country.

Published placement data follows the retention described above. We also use short-lived, keyed hashes of network addresses to limit spam and login abuse; these counters expire and are removed during routine requests. We do not store raw network addresses in those counters. Support correspondence is retained only as needed to handle the request, resolve disputes, or meet applicable legal obligations. Platform copies of messages are also subject to that platform's own retention rules.

We take reasonable steps to limit access and protect information, but no service can promise absolute security. Any changes to order retention or data handling will be reflected in this policy.

7. Your choices and requests

You can stop using the website, clear browser site data, or ask us about access, correction, or deletion of information you have provided to us. We may ask for limited information to verify that the request is yours. Some records may need to be retained where required by law. If you act for a business, make sure you are authorized to share its details.

The service is not directed at children. If you believe a child has provided personal information, please contact us so we can investigate.

8. Updates

We will update this page when data practices change, including when introducing payment processing or analytics, and change the date above. Contact us if you have a question about any update.