Privacy & purchases

Public checkout is not open yet. Seller details, terms of sale, digital delivery terms and a complete privacy notice will be published before sales begin.

Account access is provided through Supabase. The shop is preparing payments through Mollie; existing Stripe payment records remain supported. When checkout opens, the payment provider processes your payment details. We retain order references, amounts and verified payment status, not your card credentials. Purchased downloads are stored privately on Cloudflare and are available only to the verified account that owns an eligible paid order.

Instagram connections

Connecting Instagram is optional and separate from signing into your website account. Instagram handles the consent and credentials on its own website; we do not collect your Instagram password.

The optional personal read connection requests basic profile and media access and requires an Instagram Business or Creator account. A separate owner-authorised connection for @hardcore_is_religion requests basic, comment/mention and message permissions. These Meta permissions technically include write capabilities, but our activity integration only receives and checks supported information: it does not send messages, post comments or publish content.

For a personal connection, we store the Instagram account identifier, username, connection status, consent/check dates and connection history, attached to your verified website account. API access tokens are encrypted in private server storage on Cloudflare. Tokens are never shown in your profile, the public website, or the team dashboard. We renew valid access while your website connection remains active.

The team can see your connection status when managing promoters. Connecting an Instagram identity is not proof of a repost. A separate activity connection verifies ownership through a private, one-time account code that you send yourself to @hardcore_is_religion. The website stores only its hash, not the original DM text. Normal messages, reactions and private story-media URLs are not stored.

For activity tracking, we store your Instagram-scoped identifier, verified username, connection/check dates and supported promotion-event metadata linked to your website account. Only signed Meta notifications and provider reads can confirm activity. Supported public tagged campaign posts must reference one published original campaign in their caption. Ambiguous story mentions are recorded without claiming which campaign was shared. Recorded confirmations are historical evidence, not continuous proof that a post remains online. Social actions do not award HardCoins or HardXP; eligible confirmed referral purchases are handled separately.

You can disconnect website access under My account → Connections. This removes the stored personal access token; identity ownership and connection history are retained separately to prevent account reassignment and duplicate reward claims. To revoke the app's Meta authorisation as well, remove Hardcore=Religion-IG from Instagram → Apps and websites. To request access to or removal of your stored connection data, contact us at the address below.

You can stop activity tracking separately under My account → Connections → Disconnect activity account. This invalidates unused account codes and stops future matching for that connection. Existing ownership and activity history are retained separately; contact us below to request access to or removal of stored data.

The HIR organisation account also imports its API-accessible original posts, captions and artwork into the promoter carousel. This import alone does not identify people who reposted. Universal native-repost detection is not available, and public activity rollout remains subject to Meta setup, permissions and real testing.

Promoter links

Personal promoter links count aggregate opens per link and UTC day, without recording visitor identities, IP addresses, referrer URLs or tracking cookies. Repeated opens count again. Owner-only reports identify the promoter who shared the link, not individual visitors. Purchase attribution separately requires your referral choice.

Questions and data requests: info@hardcoreisreligion.com