Privacy Policy
Last updated: January 14, 2026
Information We Collect
When you sign in with X OAuth, we receive your X handle, display name, avatar URL, and a stable user identifier. We do not request access to your direct messages, your followers list, your posts, or your email address beyond what X exposes through its standard OAuth profile scope. When you create a campaign as an advertiser, we store the campaign title, message body, niche, follower range, creator count, bid amount in cents, and the campaign status (pending, live, expired). When you accept a post as a creator, we record the post's start time, end time, and the campaign it belongs to. We also collect basic usage data such as page views, click events on leaderboard rows, and outbound clicks on pinned posts, so we can build aggregate analytics and pay creators accurately. Payment data, including card numbers and billing addresses, is processed entirely by Dodo Payments and is never stored on our servers; we only store the Dodo payment identifier and the campaign status that results from the payment.
How We Use Information
We use your X profile data to display your avatar, handle, and display name on the leaderboard when you run a campaign, and on creator cards when you accept posts. We use campaign data to populate the live leaderboard, to compute aggregate statistics shown in the stats bar, and to record activity feed entries that document when campaigns launch and when bids are raised. We use usage data to detect abuse (such as repeated invalid payment attempts or unusual click patterns), to compute aggregate click-through rates, and to debug errors in production. We do not use any of this data to build advertising profiles, to sell to third parties, or to train external models. Internally, our team uses anonymized, aggregated views of usage data to understand which features are working and where users get stuck. We retain campaign and post data indefinitely because the leaderboard and activity feed are part of the public record of the marketplace, but we will delete your X profile data on request as described in the Your Rights section below.
Information Sharing
We do not sell your personal information to anyone, and we do not share your data with advertising networks, data brokers, or social platforms beyond X itself. We share the minimum necessary data with Dodo Payments to process transactions; specifically, we send the campaign bid amount and a unique reference, and Dodo handles all card data on its own secure checkout page. We share your X handle, display name, and avatar publicly on the leaderboard and creator cards because that visibility is the entire point of the marketplace: when you post a campaign, your identity is part of the public record. We may share aggregated, anonymized statistics with partners or in public marketing materials, but only in a form that cannot be reversed to identify you. We will disclose specific account data to law enforcement only when required to comply with a valid legal process, and we will publish a transparency note in the activity feed whenever we do so. Apart from these cases, your data stays inside Hire My Space.
Data Security
We store all data in a single SQLite database file on a server we control, with access restricted to the small team that operates Hire My Space. Passwords are never stored because authentication is delegated to X OAuth, which means we never see or touch a password. Payment data is handled exclusively by Dodo Payments under their PCI-DSS compliance, so our servers never see raw card numbers or CVVs. We use HTTPS for all traffic, including API requests, OAuth callbacks, and payment webhooks, to prevent in-transit interception. We log errors with enough context to debug issues but strip sensitive fields such as handles and payment references before they reach the log buffer. We do regular access reviews and remove team access when someone leaves the project. Despite these measures, no system is perfectly secure, so we encourage you to use a unique X account for testing campaigns rather than your primary identity, and we will notify affected users promptly if we ever discover a breach.
Cookies
Hire My Space itself does not set any tracking cookies. The only persistence we use on the client is your theme preference (light or dark), which is stored in localStorage under the key configured by next-themes, not as a cookie. This means the theme toggle works without setting any cookie at all, and clearing your browser storage will reset the theme to the system default. If we add analytics in the future, we will do so with opt-in cookies that you must explicitly accept before they are loaded. We do not use third-party advertising cookies, retargeting pixels, or social embeds that drop cookies on first visit. The Dodo Payments checkout page is on a separate domain and may set its own session cookies as part of payment processing, but those cookies are governed by Dodo's privacy policy and never reach our servers. For full details on local storage and theme persistence, see our separate Cookie Policy page.
Your Rights
You have the right to request a copy of all personal data we hold about you, including your X handle, display name, avatar URL, campaign history, and post history. You have the right to request that we delete your X profile data, which we will do within 30 days of verifying your identity. Campaign records and post records are part of the public marketplace history and will be retained in anonymized form so the leaderboard continues to make sense. You have the right to correct inaccurate profile data by signing in with X again, which will overwrite the cached handle, display name, and avatar. You have the right to object to processing of your data for analytics purposes, which we will honor by excluding your usage events from aggregate counts. You have the right to export all of your data in a machine-readable JSON format. To exercise any of these rights, send an email to the address listed in the Contact section below with the subject line "Data Request" and we will respond within 30 days.
Contact
If you have any questions about this Privacy Policy or want to exercise any of the rights described above, you can reach us by email at privacy@hiremyspace.com. We aim to respond to all privacy-related inquiries within 30 days, and we will acknowledge receipt of your email within 5 business days. If you believe we have mishandled your data, please tell us in your email so we can investigate and, where appropriate, notify other affected users. If you are a regulator or law enforcement officer with a legal process, please include the relevant case number and the specific data you are requesting. If you are a security researcher who has found a vulnerability, please do not file a public issue; email us privately so we can patch before disclosure. We do not currently have a dedicated Data Protection Officer because we are a small operation, but the founding team reviews every privacy inquiry directly. This contact section will be updated if our address or processes change.