Privacy Policy

1. Who this Policy covers

This Policy explains the information Supermarket processes to provide accounts, scoped operating-system capabilities, proof records, and rights transfers. Each independently operated asset and its owner remain responsible for their own customer, commerce, and privacy obligations.

Supermarket is for adults. We do not knowingly collect information from anyone under 18.

2. Information you give us

• Account: your name, email address and the time you accepted the Terms. Your password is stored only as a salted PBKDF2 hash. Your recovery code is stored only as a hash.
• Two-factor sign-in (optional): your authenticator secret, stored encrypted, and your backup codes, stored only as hashes.
• Your assets: names, descriptions, logos you upload, settings, limits, consents you confirm, and the operating specifications you approve.
• Secrets you give an asset (optional): for example an API key for a model or a store. They are encrypted and used only by that asset's runtime. Supermarket never shows them back to you.
• Messages: what you send through Help & contact or support.

3. Information created when you use Supermarket

• Sessions: a hashed session token, a hashed browser identifier, and when the session was created, last used and expires. We do not store your IP address with a session.
• Security: hashed keys made from your email address and from your IP address, used to limit sign-in attempts and abuse.
• Asset records: runs, decisions, costs, results, trade and transaction references, the wallet addresses you connect, and proof records.
• Markets and transfers: what you install, list or transfer, and the records of those rights.
• Research and settlement evidence: for buyer-validation research, keyed digests and the minimum structured evidence needed to evaluate demand; raw identifiers are excluded when a digest is sufficient. External settlement references and provider status are kept only when an owner attaches an asset-scoped evidence connector. Supermarket does not store complete card details.

4. Identity verification and email

Identity (optional). If you choose to verify your identity, Stripe Identity checks your document and a selfie. Supermarket stores the country you declare, Stripe's session reference, the result status, your consent and the times. Supermarket does not store your document images, your date of birth or the name on the document.

Email. Verification codes are sent through our email provider, Resend. The code itself is not stored in our database.

5. Public help and contact

When you contact Supermarket without signing in, we store the email address, subject and message you submit, together with a receipt, request status and timestamps. Security controls also use IP-derived rate-limit keys. The company support operator can review these records to receive, route and review your request. The contact email is unverified and is not linked to an account.

Public requests are retained in support history. The current service does not automatically delete them or publish a fixed deletion schedule. You can submit a privacy request through Help & contact; any identity check and eligible data action are reviewed separately. A receipt or Closed status does not confirm account recovery, closure or data deletion. Do not include passwords, security codes, keys, payment details or identity documents in a contact message.

6. Google sign-in for research verification

Supermarket uses Google sign-in to verify that a research respondent controls an organization account, prevent duplicate responses, and evaluate evidence for the published research offer. This does not create a Supermarket account, prove purchasing authority, or establish a payment. This flow requests basic sign-in information, not access to Gmail, Drive, Calendar, contacts, or other Google content.

Information received. When you continue with Google, Supermarket receives an ID token and checks its signature and validity. The verifier reads your email address, email-verification status, Google account identifier, and organization's hosted domain. Google may also include your name and profile-photo URL in the token; the research verifier does not use those profile fields.

Information stored. Your email address and hosted domain become separate identifiers using a secret-keyed hash (HMAC). The research record stores these identifiers with your selected answers, role, volume band, tested price, unrelated-party declaration, offer version, verification status, timestamps, and evidence references. These records are pseudonymous, not anonymous: their identifiers can be matched to other eligible evidence. The research and pre-payment evidence records do not store the raw Google token, your email address or domain, Google account identifier, name, or photo.

Optional pre-payment verification. A validation link may identify an asset and an unpaid Stripe payment reference. After recording your answer, that flow reuses your token in page memory to confirm the same respondent and checks the existing payment reference with Stripe. It stores the same hashed identifiers, the asset and research references, the Stripe reference, and proof timestamps and digests. It does not send your Google token or raw identity claims to Stripe or an asset runtime, and it does not start or collect a payment. The retry flow keeps the token only in the page component's memory; it does not write it to local or session storage.

Validity and retention. A research response expires for evidence use after 180 days. A pre-payment record is valid for at most 24 hours. These are validity limits, not deletion schedules. Both kinds of records are kept in an append-only proof history; the current service does not automatically delete them when they expire or provide a self-service control to erase them.

Your choices. You can read an offer without Google sign-in, decline to submit, or use its ordinary research link without a pre-payment reference. You can also review or remove the sign-in connection through your Google Account; see Google's connection settings guidance. Removing that connection does not delete records already submitted to Supermarket. The Google sign-in service is also subject to Google's Privacy Policy.

7. Cookies and browser storage

Supermarket uses only its own cookies, all marked HttpOnly so that page scripts cannot read them. We use no advertising cookies, no analytics trackers and no third-party pixels.

Your browser also keeps a few things on your own device: preferences such as hidden amounts and your watchlist, steps you have not finished yet, and references to transactions you sent from your wallet so a page can recover after a reload. They stay in your browser and you can clear them at any time.

8. How we use information

We use information to authenticate users, isolate account and asset data, enforce scoped runtime policy, meter resources, verify evidence, recover execution, support rights transfers, prevent abuse, maintain security, and improve the service. Supermarket does not use this information to become the asset's seller or operate its customer business, and we do not use it for advertising.

9. Who we share it with

We do not sell personal information. Information may be shared with infrastructure, model, verification and hosting providers only as needed for owner-authorized platform capabilities. Today these are:

• Vercel (application hosting), Cloudflare (asset runtimes) and Neon (database).
• Resend (email codes) and Stripe (identity checks, and billing when it is turned on).
• Google, only for research sign-in.
• The venues and networks you connect, such as Hyperliquid, Polymarket, Base or Arbitrum. They receive what an action needs, such as a wallet address or an order.
• The model providers you connect to an asset, such as OpenAI or Anthropic. They receive what that asset sends them, under your own account with them.

When you authorize an asset runtime, Supermarket sends that runtime only its approved scoped credentials and inputs. The asset and its owner remain responsible for customer transactions, delivery, support, and refunds. We may disclose information when legally required or necessary to protect users and the service.

10. Where information is processed

Supermarket runs mainly in Singapore, with some requests handled in other regions of our providers, including Japan, Ireland, Sweden, India and Hong Kong. Asset runtimes run on Cloudflare's global network. Your information may therefore be processed outside the country where you live.

11. Storage and security

Supermarket uses durable platform storage, salted password hashing, hashed session tokens, HttpOnly cookies, encryption for secrets, access controls, and rate limits. No system is perfectly secure, so protect your password and recovery code, turn on two-factor sign-in, and disconnect credentials you no longer use.

Our hosting providers may keep standard technical logs, such as request times and IP addresses, to run and protect their services.

12. How long we keep it

• Account and asset records are kept while your account is open, and afterwards as long as needed to preserve financial and proof ledgers, resolve disputes and meet legal obligations.
• Payment, proof and transfer history is append-only. It is not deleted automatically.
• Expired sessions are deleted. Sign-in attempt records are cleared after a successful sign-in.
• Support and contact requests stay in support history.
• Public research responses expire for evidence use after 180 days; expiration does not automatically delete the append-only record.

13. Your choices

You can update your profile and password in Settings, disconnect external services, pause assets, and download account records. The download lists its included fields and excludes credentials, free-form content, identity documents, independent asset customer data and external records. For records outside this scope, use Support. Essential authentication cookies are required for signed-in use.

Depending on where you live, you may have the right to access, correct, delete or move your information, or to object to some uses. Send any request through Help & contact. Some records cannot be deleted because they form payment and proof history; we will tell you which.

14. Changes to this Policy

Material updates will be presented through Supermarket. The date at the top shows the current version.

15. Contact

Account holders can request account closure or data deletion for review or submit privacy questions through Help & contact. You can submit a privacy question without signing in. Public contact email is unverified, and sending a request does not verify identity, recover an account, close an account, or delete data. A saved request or a Closed status does not confirm that the requested action was completed.