Privacy policy.

What we collect

Account data: email address, salted password hash, email-verification status, signup IP address, account creation time, and last login time. We never store passwords in plain text and never store card numbers.

Session data: a random session token stored as a hash, expiry time, IP address, and browser user-agent, so a session can be validated and abuse can be limited.

Billing data: Paddle customer ID, subscription ID, plan, status, renewal date, amount, and currency. Payment details are handled by Paddle, not by this site.

Email delivery data: messages we send you (verification, password reset, welcome) and their delivery status at our email provider.

Why we use it

To create and secure your account; to verify your email and prevent trial abuse; to run the trial and subscription; to send service and billing messages; to diagnose failures and enforce rate limits; and to comply with legal obligations. We do not sell personal data, run advertising, or use third-party analytics or tracking pixels.

Cookies

We set two first-party cookies: a session cookie that keeps you signed in (HttpOnly, SameSite=Lax) and a CSRF cookie used to protect forms (HttpOnly, SameSite=Lax). Both are required for the service. There are no advertising or analytics cookies. Paddle's checkout may set its own cookies on Paddle's domain under Paddle's privacy policy.

Processors and transfers

We share the minimum necessary data with: Paddle (payments, tax, invoicing, customer portal), Resend or a comparable email provider (transactional email), and our hosting provider (servers, logs, backups). These providers may process data outside your country. Where required, transfers rely on appropriate safeguards offered by the provider.

Retention

Account and billing records are kept while the account is open and for as long as needed for tax, accounting, and dispute purposes afterward. Expired sessions and used email tokens are deleted on a rolling basis. Webhook event records are kept for 90 days. Backups are rotated.

Your choices

You can request access, correction, export, or deletion of your personal data, and object to processing, by writing to client@dislocationmonitor.com. Deleting an account does not cancel a subscription; cancel it first in the billing portal. We may need to verify your identity before acting. You may also complain to your local data-protection authority.

Security

Passwords use salted scrypt hashes; session and verification tokens are stored hashed; traffic is served over HTTPS; forms are protected with CSRF tokens and origin checks; login, signup, and email endpoints are rate-limited. No system is perfectly secure, so use a unique password.

Children

The service is intended for professional and individual research use by adults. It is not directed to children under 16, and we do not knowingly collect their data.

Changes and contact

The data controller is Xiankai Yin, Beijing, China.

We may update this policy as the service changes; the date above shows the current version. Material changes will be announced by email or on the site. Contact: client@dislocationmonitor.com.