Privacy Policy
Last updated: January 14, 2026
Information We Collect
When you sign in with X OAuth, we receive your X handle, display name, avatar URL, and a stable user identifier. We never ask X for your email address, and we don't access your direct messages. Creators allow us to read their public profile and posts (to check the sponsored placements they agreed to) and to publish the sponsored post they approve, from their account, when they press Publish; we never post anything else. When you create a campaign as an advertiser, we store the email you pay with (to send your results link and reports), the campaign title, message, niche, follower range, creator count, amounts paid, and the campaign status (pending, live, expired). When you accept a post as a creator, we record the post's start time, end time, and the campaign it belongs to. We also collect basic usage data: anonymous page views (PostHog, without the address's query string) and a count of clicks on each ad's link. Clicks are only a public counter -- nobody is paid or ranked by them. Our network provider, Cloudflare, limits how often one IP address can click or send requests; we never store IP addresses. Payment data, including card numbers and billing addresses, is processed entirely by Dodo Payments and is never stored on our servers; we only store the Dodo payment identifier and the campaign status that results from the payment.
Location
To serve each campaign in the right place, we record an approximate location: the country only. When a creator signs in with X, we record the country their connection comes from (as reported by our network provider, Cloudflare, not GPS) and the location written on their X profile. We use it to offer creators campaigns meant for their country and to price campaigns by country. When an advertiser starts a checkout, we record the country of that checkout, to prevent fraud. We never store your IP address, city, region or coordinates, and you can ask us to delete your data as described in Your Rights below.
How We Use Information
We use your X profile data to display your avatar, handle, and display name on the leaderboard when you run a campaign, and on creator cards when you accept posts. We use campaign data to populate the live leaderboard and to compute aggregate statistics shown on the Stats page. We use usage data to show click counts and to debug errors in production. We do not use any of this data to build advertising profiles, to sell to third parties, or to train external models. Internally, our team uses anonymized, aggregated views of usage data to understand which features are working and where users get stuck. We retain campaign and post data indefinitely because the leaderboard is part of the public record of the marketplace, but we will delete your X profile data on request as described in the Your Rights section below.
Information Sharing
We do not sell your personal information to anyone, and we do not share your data with advertising networks, data brokers, or social platforms beyond X itself. We share the minimum necessary data with Dodo Payments to process transactions; specifically, we send the campaign bid amount and a unique reference, and Dodo handles all card data on its own secure checkout page. We share your X handle, display name, and avatar publicly on the leaderboard and creator cards because that visibility is the entire point of the marketplace: when you post a campaign, your identity is part of the public record. We may share aggregated, anonymized statistics with partners or in public marketing materials, but only in a form that cannot be reversed to identify you. We will disclose specific account data to law enforcement only when required to comply with a valid legal process, and we will tell you when we do unless the law forbids it. Apart from these cases, your data stays inside Hire My Space.
Data Security
We store all data in a single SQLite database file on a server we control, with access restricted to the small team that operates Hire My Space. Passwords are never stored because authentication is delegated to X OAuth, which means we never see or touch a password. Payment data is handled exclusively by Dodo Payments under their PCI-DSS compliance, so our servers never see raw card numbers or CVVs. We use HTTPS for all traffic, including API requests, OAuth callbacks, and payment webhooks, to prevent in-transit interception. We log errors with enough context to debug issues but strip sensitive fields such as handles and payment references before they reach the log buffer. We do regular access reviews and remove team access when someone leaves the project. Despite these measures, no system is perfectly secure, so we encourage you to use a unique X account for testing campaigns rather than your primary identity, and we will notify affected users promptly if we ever discover a breach.
Cookies
We set three strictly necessary first-party cookies and no tracking or advertising cookies: post_session keeps a creator signed in (7 days), oauth_state protects X sign-in (10 minutes, encrypted), and xmp_live shows you fresh data right after you pay (30 minutes at most). Your theme choice and PostHog's anonymous page-view id live in local storage, not cookies. Advertisers don't sign in: one results link, for all their campaigns, is emailed to the address that paid, valid for 24 hours, and nothing about them is kept in the browser. The Dodo Payments checkout and x.com set their own cookies under their own policies. The Cookie Policy page lists every item by name.
Uploaded Images
Banner and profile images uploaded for a campaign are deleted after 1 day if the checkout isn't paid. For a paid campaign they are kept while it runs and for 30 days after it ends, then deleted automatically.
Your Rights
You have the right to request a copy of all personal data we hold about you, including your X handle, display name, avatar URL, campaign history, and post history. You have the right to request that we delete your X profile data, which we will do within 30 days of verifying your identity. Campaign records and post records are part of the public marketplace history and will be retained in anonymized form so the leaderboard continues to make sense. You have the right to correct inaccurate profile data by signing in with X again, which will overwrite the cached handle, display name, and avatar. You have the right to object to processing of your data for analytics purposes, which we will honor by excluding your usage events from aggregate counts. You have the right to export all of your data in a machine-readable JSON format. To exercise any of these rights, send an email to the address listed in the Contact section below with the subject line "Data Request" and we will respond within 30 days.
Contact
If you have any questions about this Privacy Policy or want to exercise any of the rights described above, you can reach us by email at privacy@hiremyspace.com. We aim to respond to all privacy-related inquiries within 30 days, and we will acknowledge receipt of your email within 5 business days. If you believe we have mishandled your data, please tell us in your email so we can investigate and, where appropriate, notify other affected users. If you are a regulator or law enforcement officer with a legal process, please include the relevant case number and the specific data you are requesting. If you are a security researcher who has found a vulnerability, please do not file a public issue; email us privately so we can patch before disclosure. We do not currently have a dedicated Data Protection Officer because we are a small operation, but the founding team reviews every privacy inquiry directly. This contact section will be updated if our address or processes change.