Privacy

Working draft. This document describes how ThankNest currently works. It has not been reviewed by a lawyer and must be checked against the law that applies to you, and against the terms of PayPal, your bank and MoMo, before this site is opened to the public.

What we collect

When you create an account: your name, email address and a hash of your password. We never store your password itself.

When you build a page: everything you type into it, any image you upload, and the payout details you enter.

When someone supports you: the amount and currency they chose, the payment method they picked, an optional name, message and email address they may supply, and a timestamp.

Automatically: a session cookie, security and error logs that include a hashed IP address and a request identifier, and per-day counts of page views and checkout opens.

What we do not collect

We do not ask for and must never receive your PayPal password, your banking credentials, a card number, a PIN or a one-time code. No ThankNest page will ever ask for these. We do not use third-party advertising or analytics trackers, and we do not build a visitor fingerprint.

How your payout details are handled

Bank account numbers are stored encrypted. Account holder names, PayPal.Me links and MoMo details are shown to supporters on your checkout page - that is their purpose - so treat them as public once your page is live.

Your login email is never published

The address you sign in with is not shown on your page. If you want a public contact address, there is a separate, optional field for it.

Cookies

We set a session cookie so you can stay signed in, and an optional "remember me" cookie if you ask for one. There are no advertising cookies.

How long we keep things

• Security and error logs: 90 days by default.
• Per-day analytics counts: about 13 months.
• Support records: kept while your account is open, so your history stays intact.
• CAPTCHA challenges, password reset and verification tokens: minutes to hours.

Your choices

From your privacy settings you can export your data, change what email you receive, and request account deletion. Deleting an account removes your pages and profile. We may keep a minimal record where we must - for example to handle an abuse report or meet a legal obligation - and we will tell you what that covers when you ask.

Contact

Use the contact page for any privacy question or request.