HermesLinesPrivacy Policy
[LAWYER REVIEW: effective date and version]1. Who is responsible
What the site does today
- Contact: [NOT SET: support / privacy contact — set SUPPORT_EMAIL]
2. Information we collect
What the site does today
- Account: email address; password stored only as a bcrypt hash (older SHA-256 hashes are upgraded at the next login); account creation time; last login time; the plan label shown in the header.
- Subscription: Stripe customer and subscription IDs, the plan and price, status, billing-period dates and whether it is set to cancel; a log of plan changes and payment events; IDs of processed Stripe events.
- Password resets: a one-time token, stored with its expiry (1 hour) and when it was used.
- Abuse limits: the IP address and account email of recent log-in, sign-up and password-reset attempts, held in the server's memory (not the database) for up to an hour to limit password guessing and email flooding; cleared when the server restarts.
- Not collected by HermesLines: card numbers and payment details (entered on Stripe's pages), name, address, phone number, date of birth, location.
3. Cookies and similar technology
What the site does today
- One session cookie, signed by the server, holding the logged-in account's email address and a security (CSRF) token. It is HttpOnly and SameSite=Lax, and HTTPS-only in production.
- The site code includes no analytics, advertising or tracking scripts.
- Pages load fonts from Google Fonts, so visitors' browsers contact Google's servers (which receive the visitor's IP address).
4. How the information is used
What the site does today
- To run the account and log in, decide which picks an account can see, process subscriptions through Stripe, and send password reset emails.
- The only email the site sends is the password reset email. There is no marketing email in the code.
- People listed as administrators can see account emails, plans, sign-up and last-login times in an admin page.
5. Who information is shared with
What the site does today
- Stripe — payments, invoices and the billing portal (receives email and payment details).
- SendGrid — delivers password reset emails, when configured (receives the email address).
- Google Fonts — font delivery (receives visitor IP addresses).
- Hosting provider — [NOT YET DETERMINED: production host]
- The NHL ratings service (operated as part of HermesLines) receives an internal account number, not the email address.
- The code does not sell or share personal information with advertisers.
6. How long information is kept
What the site does today
- There is currently no automatic deletion: accounts, subscription records, event logs and used/expired reset tokens stay in the database until removed manually.
Proposed wording from an earlier draft (commit afb0d76) — NOT IN EFFECT, for lawyer review only
“We keep your account information while your account is open, and billing records as long as tax law requires. To see, correct or delete your information, email [contact email].”
7. Your choices and rights
What the site does today
- Users can update payment details and the billing email Stripe uses (Account → Manage subscription), and reset their password. The HermesLines login email cannot be changed from the site.
- There is no self-serve way to download or delete an account; requests would be handled by contacting support.
8. Security
What the site does today
- Passwords are hashed with bcrypt; payment details are handled by Stripe; the session cookie is signed and, in production, sent only over HTTPS.
9. Children
[LAWYER REVIEW: minimum age, and handling of information from users under it]Proposed wording from an earlier draft (commit afb0d76) — NOT IN EFFECT, for lawyer review only
“HermesLines is for people 21 and older. We don't knowingly collect information from anyone younger.”
10. Changes to this policy
[LAWYER REVIEW: how changes are made and notified]Proposed wording from an earlier draft (commit afb0d76) — NOT IN EFFECT, for lawyer review only
“If we change this policy, the date at the top changes and we'll email members about material changes.”