What we collect — and what we never collect
Two lists make it concrete:
Collected
- Content you submit: requests (title, price, category, reason, screenshots, product link) and written advice.
- Anonymous identity markers: an HttpOnly session cookie plus your public nickname and ID.
- Coarse network region: country and city recorded automatically with each vote, labelled “network location”.
- Basic operational counters: short-lived salted hash buckets for rate limiting and abuse protection, never used as a public identity.
Never collected
- Email, phone number or real name — there is no registration flow at all.
- GPS location, contacts, or your photo library (screenshots are used only when you upload them).
- Your binding ID in plaintext: the server stores only a one-way HMAC digest, and the plaintext is shown once.
- Payment data: the site has no checkout and no payment step anywhere.
What the AI can see
Once the site operator configures an AI provider, published submissions and written advice are sent to that provider for content safety review and advice summarization. Binding IDs, cookies, IP addresses and locations are never sent. The provider processes content under its own terms; before submitting, avoid putting ID numbers, home addresses or account details in your reason — fields a purchase approval never needs anyway.
The controls in your hands
- Export: download all of your data as a JSON file from the identity page.
- Hide location: one click hides your previously shared locations; future votes show none either.
- Delete identity: remove your identity and everything attached to it. The operation is irreversible.
- Revoke shares: friend invitation links can be revoked anytime; revoked links stop working for new visitors.
- Device management: review and remove every browser linked to your identity.
Cookies and local storage
The site uses exactly two kinds of local storage: an HttpOnly session cookie that carries your session (unreadable by scripts), and browser local storage that holds your unsent drafts — drafts never leave your device. There are no third-party analytics, ads or tracking scripts.
The life cycle of your data
Submitted content is published after AI review and stays until you delete it or delete your identity; session and rate-limit data expire automatically on short horizons; drafts live only on your device and never upload. When an identity is deleted, the corresponding public content goes with it. Nothing is kept “just in case” — retention follows purpose.
- Content: retained until you remove it or delete the identity.
- Sessions and rate buckets: short-lived by design.
- Drafts: device-only, never transmitted.
- Exports: generated on demand, not stored server-side.
The third parties involved, exhaustively
Infrastructure is provided by Cloudflare (hosting, D1/R2 storage, Turnstile human verification). AI review and summarization use the OpenAI-compatible provider configured by the site operator. Beyond those two, there are no data recipients: no analytics vendors, no ad networks, no social pixels, no embedded fonts from third-party CDNs.
- Cloudflare: transport, storage and bot defense.
- AI provider: sees submitted text and published advice only.
- No one else — the list above is the whole list.
What this site will never build
No advertising profile, no purchase-intent scoring, no data broker exports. BuyPass is a website about spending decisions, and its business model — such as it is — dies the moment user data becomes a product. That is a structural choice, not a policy that can quietly change: there is no tracking infrastructure to repurpose.
- No cross-site tracking of any kind.
- No sale or sharing of user data, ever.
- No dark patterns around deletion — the delete button is real.
Read this site like a privacy auditor
You do not have to take the privacy page on faith — open your browser’s network panel and watch. The complete set of external connections is short: this origin’s static assets, this origin’s API, a Cloudflare Turnstile challenge when you perform a write action, and the operator-configured AI provider receiving published text for safety review and summarization. That is the entire network footprint. No analytics beacons fire on page views; no ad exchanges receive bid requests; no third-party fonts or CDNs are contacted; no social pixels watch your scrolling. Auditors call this a small blast radius: fewer recipients means fewer policies to trust, fewer breach surfaces to worry about, and fewer surprises when a vendor changes its terms. The property is structural, not aspirational — the tracking code that would generate those requests simply does not exist in this codebase, which is the strongest form a privacy promise can take.
Frequently asked questions about BuyPass
Without an account, is my data still “mine”?
Yes. Anonymous identities have the same rights of export, correction and deletion; the export file includes your requests, votes, advice and bookmarks.
What if I lose my private binding ID?
There is unfortunately no recovery path — the server stores only an HMAC digest. Clearing browser data without a backup means this identity’s history cannot be restored on a new device.
Does deleting my identity remove everything instantly?
Deletion removes your identity and its content associations. Screenshots saved by other people and search-engine caches are outside the site’s control.
Can “IP location” reveal my home address?
No. It has two coarse levels only — country/region and city — is derived from the network exit, has nothing to do with delivery or registered addresses, and can be hidden anytime.
Does the site sell data to advertisers?
No. There is no ad system, no tracking scripts, no third-party analytics, and no data business to sell from.
Are friends-only requests really invisible to everyone?
They never appear in public listings, on-site search, global activity or search engines; only browsers holding a valid invitation link can open them, and the link can be revoked anytime.
Is an anonymous identity still personal data?
Yes. Even without a real name attached, it carries your activity record and therefore carries export and deletion rights.
Does reporting someone expose my information?
Your report is linked to your identity only for abuse checks; it is never shown to the reported party.
Will the AI provider train models on my content?
That depends on the configured provider’s terms — the site’s own stance is to send nothing identifiable; the provider’s policy governs the rest.
Where is the data stored?
In the site’s Cloudflare D1/R2 resources, in the region configured by the operator; the privacy page’s principles apply regardless of region.
This page is maintained by the BuyPass team and was last updated in September 2026.