Privacy policy
SpotMelts is operated by Epistemic Cognition Inc. This policy explains what SpotMelts collects, how it is used, and the choices you have. We do not sell your personal information.
1. Information we collect
- Account details: your email address, membership status, and the date your current billing period ends.
- Billing records: Stripe customer, subscription, and checkout identifiers. Card and bank details are entered with Stripe and never reach SpotMelts.
- Sign-in records: one-time sign-in links (stored only as a scrambled value and valid for 15 minutes), sign-in sessions, and, if you add a passkey, its public key and a device label such as "Mac · Safari".
- Your watchlist: the listings you save, stored with your account.
- How you found us: the page or link you joined from, kept with your account.
- Usage counts: daily totals of page openings, seller-listing clicks by company and archived product record, and membership steps. These are aggregate counts, not records of individual people. We note whether a visit came from search, social media, another site, or an unknown source, without keeping the referring address.
2. How we use it
To create and secure your account, send sign-in links, provide member access, process and support your membership, answer support requests, prevent abuse, and understand which pages are useful.
3. Cookies and browser storage
- spotmelts_session keeps you signed in: for the browser session, or for up to a year if you choose to stay signed in.
- sm_csrf protects forms from being submitted by other sites. It lasts 7 days.
- sm_webauthn connects a passkey sign-in to your browser for 5 minutes.
- The lot calculator saves its pieces in your browser only. They are not sent to SpotMelts.
SpotMelts does not use advertising or third-party tracking cookies.
4. Who processes data for us
- Stripe processes payments and subscriptions.
- An email delivery provider sends sign-in links.
- Amazon Web Services hosts the service and its database.
We may also disclose information when the law requires it or to protect the service and its members.
5. Security and IP addresses
IP addresses are used briefly, in memory, to limit repeated sign-in and sign-up attempts. Our hosting infrastructure may keep standard server logs for security and troubleshooting.
6. How long we keep it
- Sign-in links expire after 15 minutes. Sessions end when they expire or when you sign out.
- Account, membership, and billing records are kept while you have an account and as needed for legal, tax, and fraud-prevention purposes.
- Account data backups are kept for a limited period and then replaced.
7. Your choices
You can remove watchlist items at any time and delete passkeys from your account page. To ask for a copy of your information, a correction, or deletion of your account, email support@spotmelts.com. Some records may be kept where the law requires it.
8. Children
SpotMelts is not intended for children and does not knowingly collect information from them.
9. Changes and contact
We will update the effective date above when this policy changes. Questions: support@spotmelts.com.