Privacy Policy

honored.ltd (the "register") is operated by an individual operator based in the EU. This page describes what personal information the register collects, why, and how to reach us about it. Where this policy refers to "we" or "the operator," it means the operator of honored.ltd — a generic reference, kept deliberately unspecific pending a named legal entity.

What we collect

• Account information. Your email address, and if you sign in with Google, the identity Google shares with us (name, email, avatar). Handled by Supabase Auth.
• Evidence you submit. Receipts, purchase confirmations, or forwarded emails you upload to support a report — these may contain your name, order details, or payment information as they appear in the original document. Stored in Supabase Storage.
• Anti-abuse signals. Your IP address is hashed before storage — we never store a raw IP. We also record coarse network information (ASN) and a Cloudflare Turnstile verification token to distinguish real submissions from automated abuse.
• AI-assisted extraction text. If you use the optional invoice-scan feature, the text extracted from your upload (redacted of obvious personal identifiers on your device before it's sent) is passed to DeepSeek's API to prefill a form. Your raw file is never sent to DeepSeek.

How we use it

To operate your account and the public register (publishing verified reports, showing your reporting history), to verify submissions are genuine, to prevent spam and abuse, and to send you transactional email you've opted into (such as expiry reminders or breakage alerts for products you're watching) — you can turn these off from your account settings at any time.

Who else processes it

We rely on a small number of infrastructure providers to run the register:

• Supabase — database, authentication, and file storage.
• Cloudflare — hosting, content delivery, and bot/abuse protection (Turnstile).
• Resend — delivery of transactional email.
• DeepSeek — AI text extraction for the optional invoice-scan feature, described above.

Cookies and tracking

We do not use analytics or advertising cookies of any kind. The only cookie in play is the session cookie Supabase Auth sets to keep you signed in — it is not used for tracking.

How long we keep it

Verified reports and their evidence are kept indefinitely as part of the public historical register — the register's value depends on being a durable, trustworthy record over time. If you'd like your personal account data reviewed, corrected, or erased, email us (see below); we handle these requests manually on a case-by-case basis, since automated self-service deletion isn't built yet.

Your rights

You can ask us what personal data we hold about you, ask us to correct it, or ask us to erase it, by emailing privacy@honored.ltd. Note that erasing evidence tied to a public, verified report may affect that report's standing on the register — we'll explain the impact before acting on any erasure request.

Governing law

This policy is governed by the laws of the operator's country of establishment (EU). The specific jurisdiction referenced here is a placeholder pending legal review and will be updated once finalized.

Changes to this policy

We may update this page as the register changes. The "last updated" date at the top always reflects the most recent revision.

Contact

Questions about this policy: privacy@honored.ltd.