Privacy Policy

Information we collect

• Account information, including your name, email address, profile image, email-verification status, and the stable identifier supplied by your sign-in provider.
• Authentication and security records needed to protect accounts, enforce rate limits, investigate failures, and record account-linking or session events. Security logs do not contain passwords or OAuth tokens.
• First-party usage information such as pages viewed, referrer, language, timezone, active-time totals, searches, product interactions, and attribution parameters.
• Approximate country, region, or city information derived by our service when available. We do not request precise device location.
• Preferences and short-lived delivery data stored in cookies, local storage, or session storage, including session, language, currency, recently viewed items, and pending first-party analytics events.

Google sign-in

Google is used only as an identity provider. Hivestar requests the standard OpenID Connect identity scopes needed to receive your Google account identifier, name, profile image, email address, and email-verification status. We do not request access to Gmail, Google Drive, contacts, calendars, or other Google product data.

Hivestar uses this information to create or locate your account, authenticate you, prevent account takeover, and display your account profile. Provider access tokens, refresh tokens, and ID tokens are removed before account records are persisted and are not used to call Google APIs on your behalf.

How we use information

• Provide sign-in, account, storefront, search, favorites, referral, and customer-facing features.
• Secure the service, prevent abuse, diagnose failures, and maintain auditable authentication operations.
• Measure first-party storefront performance and improve navigation, recommendations, content, and product presentation.
• Send transactional messages such as email-verification links. We do not use Google account data for advertising or sell it.

Storage and service providers

We use service providers for database hosting, content delivery, object storage, network protection, and transactional email. They process information only to provide those services under their own security and privacy obligations. Information may be processed in countries other than your own.

Authentication sessions use secure, HTTP-only cookies over HTTPS. Hivestar applies access controls, encryption where appropriate, rate limiting, and audit logging, but no online service can guarantee absolute security.

Retention

Account information is kept while your account is active and as needed for security, dispute resolution, and legal obligations. Raw first-party behavior records are scheduled for deletion after 25 months. Private facts associated with an inactive anonymous visitor are erased after 13 months, while a non-identifying record may remain for integrity and aggregate reporting.

Browser-side analytics delivery records are short-lived and are removed after successful delivery, credential changes, or expiry. Some security and audit records may be retained longer when reasonably necessary to protect the service or meet legal requirements.

Your choices and requests

You may sign out, clear browser storage, or stop using Google sign-in at any time. You may also ask to access, correct, or delete your Hivestar account and associated personal information. We may need to verify your identity before completing a request and may retain limited records when required for fraud prevention, security, or law.

Children and changes

Hivestar is not directed to children under 13, and we do not knowingly collect their personal information. We may update this policy when our service or legal obligations change. The updated date above identifies the current version.