Privacy policy

Last updated 13 September 2026

Sponsor.st is run by Nishant, a sole proprietor in India ("we"). We collect as little as we can: data we don't have can't leak. This page says what we keep, why, and for how long.

Visitors of sites that use our script

The script sets no cookies and doesn't fingerprint. It never reads forms, passwords, page text or the site's storage.
It sends anonymous counts: pageviews, which sponsor spots were seen, and clicks on them.
To count unique visitors, we make a one-way hash of a random salt, the site, the visitor's IP address and browser. The salt changes every day and is then gone, so the hash can't be traced back. Raw IP addresses are not stored with the counts.
Known bots and the owner's own visits aren't counted. The owner's browser is marked with a small local-storage flag when they open the editor.

Owners and sponsors (account holders)

Account: your name, email, a hashed password (never the password itself), two-factor settings, and your Google account id if you log in with Google.
Owners: your sites, slots, prices and settings, and your payment provider keys, which are encrypted.
Sponsors: your brands and creatives (text, images, links) and your bookings.
Share cards: when you get your first sponsor, and each month you earn, we make an image you can post. Its page is public to anyone with the link, shows your site's domain, and never a sponsor's name. Amounts stay hidden unless you choose to show them.
We use this to run the service, send the emails about your bookings and account, and prevent abuse. We don't sell it and don't use it for advertising.

Short-lived technical data

Rate limits use your IP address for a few minutes to an hour. Server logs, which include IP addresses, are kept briefly for security and debugging. Error reports go to Sentry without IP addresses or cookies.

Who helps us run it

OVH (servers, EU) and Cloudflare (content delivery and backups).
Resend (sending email) and Sentry (error reports).
Google (login with Google, and Web Risk checks on sponsor links).
Dodo Payments (billing for the Pro plan).
When a sponsor pays, the payment is made on the owner's own provider (such as Dodo), under that provider's privacy policy.

How long we keep it

Visitor hashes: one day.
Daily view and click totals: kept, since they hold no personal data.
Payment notifications from providers: one year, then only their id and time.
Uploaded images: deleted 90 days after the last booking that uses them ends.
Share cards: until you delete them or close your account.
Account data: until you close your account. Booking records stay, without your personal details.

Cookies

On sponsor.st we use only the cookies needed to keep you logged in and protect forms. No analytics or advertising cookies.

If you follow another owner's referral link, one more cookie remembers that link for 30 days, so they can earn a free month if you sign up. It holds only the link's site or handle, nothing about you.

Your rights

You can download a copy of your data and delete your account yourself, in Settings → Profile. For a correction, or anything else, email [email protected] from your account's address and we'll reply within 30 days. Closing an account follows the rules in the Terms.

Changes and contact

If this policy changes in a way that matters, we email account holders before it applies. Questions: [email protected].