Privacy Policy

1. Who is responsible

Branda Stock Ltd, Hadvir 18, Hadera, Israel, is the controller of the personal data described here. For any privacy question or request, write to legal@claim-it.lol.

2. What we collect

Because you gave it to us. Your email address, when you sign in. Your display name, username, logo, tagline, website link and social handle, when you set them. Anything you write to us.

Because you used the Service. Which words you claimed, when, at what price, and the resulting public history. Words you watch. Notifications sent to you. Sign-in codes and sessions, stored only as one-way hashes.

Because a page was loaded. A per-browser identifier stored in a cookie and used only to stop one person refreshing a page from inflating a public view counter, plus standard server logs (IP address, user agent, time, path) kept for security and debugging.

From Google, if you use Google sign-in. Your email address, name and profile picture URL. We do not receive your Google password and we request no other access.

We never receive your payment details. Card, Apple Pay and Google Pay payments are handled by Dodo Payments. We receive a payment reference, an amount and a status - never your card number. Payments made in cryptocurrency before we moved to cards were handled by NOWPayments, and those records are kept for the period in section 7.

Because we advertise and measure the Service. If you arrive from an advertisement, a cookie on your device stores the ad’s click identifier (for example, X/Twitter’s twclid) and any campaign parameters in the link, for up to 90 days, so we can tell which ads led to a claim. Once you are signed in, the pages you view, the buttons you use and the stage you reach at checkout are logged against your account id (never your email address) in our product-analytics tool. Your browsing session may also be recorded as a video-style replay and included in anonymised click and scroll heatmaps, as described in the Cookies section below. None of this is used to make decisions about you individually; it is used in aggregate, to see what is and is not working on the Service.

3. What is public

These are visible to anyone, including search engines, and this is the point of the Service rather than an accident: your display name, username, profile page, logo, tagline, links, the words you currently hold, the words you have held, the prices paid, and the dates. Your email address is never shown publicly.

Word history is a permanent public record. If you would rather not appear in it, use a display name that is not your real name.

4. Why we are allowed to use it

• To perform our contract with you: creating your account, processing a takeover, showing your listing, telling you when you lose a word.
• Because we have a legitimate interest: keeping the Service secure, preventing abuse and fraud, counting views honestly, understanding aggregate usage, measuring whether our advertising works, and improving the site from how people actually use it (including through session recordings and heatmaps). We have considered your interests and use the least data that works; you can object at any time, see section 8.
• Because the law requires it: keeping tax and transaction records, and responding to lawful requests.
• Because you consented: any optional message you ask to receive. You can withdraw consent at any time.

5. Who else sees it

• Dodo Payments, our card payment processor and the merchant of record for card orders, for the payment itself and the tax it is required to charge on it.
• NOWPayments, our former cryptocurrency payment processor, which still holds the records of payments made through it.
• Hostinger, our hosting provider, which stores the servers and database.
• Our email provider, to deliver sign-in codes and notifications.
• Google, only if you choose Google sign-in.
• PostHog, our product-analytics provider, which receives the page views and product events described in section 2, tied to your account id rather than your email address.
• Microsoft (Clarity), which receives session recordings and click/scroll heatmaps of how the Service is used, as described in section 9.
• X Corp (X/Twitter Ads), if you arrived from an X advertisement, so we can report back which of our ads led to a claim. We send X the ad click identifier and the value of a completed purchase; we do not send X your email address.
• Advisers and authorities, where we are legally required or need to establish or defend a legal claim.

We do not sell personal data. We do not share it with any of the advertising or analytics providers above in exchange for money, and we do not let them use it for their own advertising to you.

6. Where it is stored

Our servers and database are hosted by Hostinger. PostHog and Microsoft Clarity process data on servers in the United States; Dodo Payments, NOWPayments and X Corp may also process data outside your country. Where personal data of individuals in the European Economic Area or the United Kingdom is transferred outside it, we rely on an adequacy decision or on standard contractual clauses with the provider.

7. How long we keep it

• Account data: while your account exists, then up to 90 days.
• Sign-in codes and links: 15 minutes, then invalid; rows are pruned periodically.
• Sessions: up to 60 days, or until you log out.
• Transaction records: seven years, because tax law requires it.
• Public word history: indefinitely, as a record of the word. Personal identifiers in it can be replaced with a pseudonym on request.
• Server logs: up to 30 days.
• Ad click and campaign data: up to 90 days in the attribution cookie described in section 9, or until reported to X Corp as a conversion, whichever comes first.
• Product-analytics events, session recordings and heatmaps: for as long as PostHog’s or Microsoft Clarity’s own retention settings keep them. We have not set a shorter period ourselves; ask us at legal@claim-it.lol if you want the current figure or want your data deleted from either tool sooner.

8. Your rights

Subject to the law that applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. You can also withdraw consent where we relied on it.

Write to legal@claim-it.lol. We answer within 30 days. We may need to confirm who you are first.

Deleting your account removes your profile and email address. It does not erase the transaction records tax law requires us to keep, and it does not rewrite the public history of a word; on request we replace your name there with a neutral pseudonym.

If you are in the EEA or the UK you may complain to your local data protection authority. In Israel you may contact the Privacy Protection Authority.

9. Cookies and other trackers

Cookies we set ourselves, that the Service needs to work:

• claimit_session keeps you signed in. Up to 60 days.
• claimit_viewer is a random value used to de-duplicate view counts. It is not linked to your account and identifies no one. Up to 400 days.
• claimit-theme remembers light or dark. Stored in your browser, never sent to us.

A cookie we set for advertising measurement: claimit_attr stores an ad click identifier (such as X/Twitter’s twclid) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term) read from the link you arrived on, plus the first page you landed on. It exists only if you followed a link carrying those parameters, lasts up to 90 days, and is used to tell us and X which advertisement led to a claim.

Third-party analytics and advertising trackers. The Service currently runs three third-party scripts. Each is disclosed here individually because it can set its own cookies or local storage that we do not control:

• X (Twitter) Ads pixel. Loads on every page to record page views and named actions (searching, viewing a word, starting checkout, being redirected to pay, completing a purchase) against your ad click identifier, so X can measure and optimise the campaigns that bring visitors here. We also report a confirmed purchase to X directly from our server, using the real amount you paid by card, never the Credits portion.
• PostHog (product analytics). Records the same named actions plus page views for our own use, tied to your account id once you are signed in, never to your email address. Session recording and automatic click-capture are switched off in our configuration of this tool.
• Microsoft Clarity (session recordings and heatmaps). Records how you move through and interact with pages - clicks, scrolling and, separately, screen recordings of the visit - so we can see where the design confuses people. Fields we consider sensitive on the checkout form (your display name, destination link, tagline and X/Twitter handle) are masked before Clarity ever receives them. We do not run Clarity on staff/admin sessions.

None of these three trackers, or the attribution cookie described above, loads or is set until you allow it. On your first visit a banner asks whether to enable them; if you decline, or simply never answer, the Service works exactly the same and no tracking script runs, and no attribution cookie is set. Your choice is stored in a single cookie (claimit_consent, kept for 180 days) whose only job is to remember the choice. You can change your mind at any time via the "Cookie choices" link in the footer, and if your browser sends a Global Privacy Control signal we treat that as a decline automatically. An ad blocker or tracking-protection feature will additionally stop these scripts from loading; nothing on the Service depends on them working.

10. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, write to legal@claim-it.lol and we will delete it.

11. Security

Traffic is encrypted in transit. Sessions and sign-in codes are stored only as hashes. Access to the production database is limited to the operator. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as the law requires.

12. Demo content

During launch the Service may display a clearly labelled launch preview: invented accounts, marked Demo, with generated pictures. They are not real people, contain no real personal data, and carry no real payment records. See the Terms for how they are separated from real activity.

13. Changes

If we change this policy we update the version and date at the top and, for material changes, email account holders before the change takes effect.