Privacy
Steal The Pin is responsible for personal data collected through thepin.lol. There are no accounts on this site, and we collect as little as the product can function on.
What we collect
What you publish
Your message and your optional link. This is public by design: it is displayed on the homepage, published from the @stealthepin account, and kept permanently in the public history after your placement ends. Do not put anything in it you would not want to remain public indefinitely.
Payment information
Payments are handled by Whop. Card details never reach this site. We store the amount, currency, status, the provider’s own identifiers, and — where the provider passes it on — the email address associated with your payment, which we use for receipts, refunds and support.
Technical data
- Rate limiting. Your IP address is used to limit abusive request rates. It is hashed with a server-side secret before it is stored, so our database holds no IP addresses — only opaque values that cannot be reversed into one. These are deleted after roughly a day.
- Funnel counts. Anonymous event names such as “someone opened the purchase form”, with a random identifier generated in your browser for the current tab session. It is not linked to you, survives no longer than the tab, and lets us count steps rather than people.
- Viewer count. While the page is open, a random identifier is stored so the site can show how many people are watching. It contains nothing about you and expires within minutes of you leaving.
- Visitor counts. We use Vercel Web Analytics to see how many people visit and which pages they land on. It sets no cookies and stores nothing on your device: a visit is identified by a hash of the request, which is discarded after 24 hours, and it is not tied to your IP address. It cannot follow you to any other site. We exclude the receipt page from it entirely, so the link to your receipt is never sent anywhere.
- One cookie. A randomly generated token that protects the purchase form against cross-site request forgery. No advertising cookies, no third-party trackers, no consent banner, because there is nothing to consent to.
Our hosting provider also keeps standard server logs, which include IP addresses, for a short period for security and diagnostics.
Why we are allowed to
To perform the contract you enter when you buy a placement; to comply with tax and accounting obligations; and for our legitimate interests in keeping the site secure, preventing abuse, and understanding whether it works at all. Where you are in a jurisdiction that requires a lawful basis to be stated, those are ours.
Who else sees it
- Whop — payment processing. They are the controller of your payment data and their own privacy policy applies to it.
- X — receives your message and link, because publishing them is what you bought.
- Vercel (hosting and visitor analytics) and Neon (database) — process data on our behalf under their own terms.
- An automated moderation service, where one is configured, receives submitted text to check it against the Rules before it is published.
We do not sell personal data, and we do not share it for advertising. We may disclose it where the law requires it.
Where it goes
Our providers operate in the United States, so data is processed there. If you are in the UK or EU, transfers rely on the safeguards those providers put in place, such as standard contractual clauses.
How long we keep it
- Published content and purchase history: permanently, as the public record the product is built around.
- Payment records: as long as tax and accounting rules require, typically several years.
- Rate-limit values: about a day.
- Viewer-count entries: minutes.
- Funnel events: no longer than needed to understand the funnel.
Your rights
Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, restrict or object to its processing, receive a copy of it, or complain to your data protection authority.
One honest limit: published content is public and permanent. Once your message has appeared on the site and been posted to X, we cannot make it as though it never existed — it may be cached, screenshotted or reposted by people we do not control. We will remove it from the site and delete the post from our account on request, and we can replace the history entry with a takedown notice, but we cannot retrieve it from the rest of the internet.
To exercise any of this, email info@thepin.lol.
Children
This site is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a child has used it, tell us and we will remove what we hold.
Changes
If this notice changes, the date at the top changes with it. Material changes will be announced on the site.