Privacy Policy

1. Who is responsible

One Million Dollar Pixels is operated by the operator of onemilliondollarpixels.com, who is the controller of the personal data described here. Contact: support@onemilliondollarpixels.com.

2. What we collect, and why

Your e-mail address

Used to send you a sign-in code, your receipt, and messages about your block (review outcome, a resale sale, a change to these terms). It is the only identifier your account has. We do not send marketing e-mail unless you have asked for it.

Your block

The position and size of the rectangle you bought, the image you uploaded, the link and title you gave it, the price you paid, and when. The image, link and title are public by design — they are the product. Your e-mail address is never shown on the grid or to other users.

Payment reference

Stripe sends us a confirmation that a payment succeeded and an identifier for it. We never receive, see or store your card number, expiry or security code; those go to Stripe alone.

Resale listings

If you list a block for resale we store the listing, the asking price, and, when it sells, what is owed to you. We will ask you for payment details to send you your share; we hold those only for as long as it takes to pay you.

Request logs

Like every website, our hosting provider records the IP address, browser type and time of each request for security and debugging. We do not join these logs to your account.

3. Cookies

The site sets one cookie, and only after you sign in:

• mp_session — keeps you signed in for 30 days. It holds a random token and nothing else; our database stores only a one-way hash of that token, so the cookie value cannot be read back from our side. It is marked HttpOnly (page scripts cannot read it), SameSite=Lax, and Secure in production. It is deleted when you sign out.

There are no analytics cookies and no advertising cookies on this site. The only measurement script is Vercel Web Analytics, served from this site’s own domain: it counts page views without a cookie and without following you to other sites (see section 5). Your choice of block is held for you for 15 minutes during checkout server-side, not in a cookie. Stripe sets its own cookies on its checkout page under Stripe’s privacy policy.

4. Sign-in codes

Signing in sends a 6-digit code to your address. The code is stored hashed, expires after 10 minutes, and is discarded after 5 wrong attempts or one correct one. There is no password to leak.

5. Who else handles your data

We use a small number of providers to run the site. Each receives only what it needs for its job:

• Stripe — takes payment. Receives your card details, e-mail and the amount.
• JVZoo — the retailer for the products we sell through it: the Pixel Ad Playbook and the pixel ad credit. JVZoo takes that payment on its own checkout page, receives your card details, e-mail and the amount, sends you the receipt, and passes us your e-mail and order number so we can deliver. Its checkout is governed by JVZoo’s privacy policy.
• Resend — delivers our e-mail. Receives your address and the content of each message we send you.
• Vercel — hosts the site, stores uploaded images and runs Vercel Web Analytics. Receives request logs, your image file, and for each page view the page, the referring page and a coarse device type and country taken from the request. It sets no cookie; visitors are counted with a hash that resets every day and cannot be traced back to you.
• Supabase — hosts our database. Holds the account and block records described above.

These providers operate in the United States and elsewhere; by using the site you accept that your data may be processed there. We do not sell personal data, and we do not share it with anyone else except where the law requires us to.

6. How long we keep it

• Sign-in codes: until used, expired or burned — minutes, not days.
• Sessions: 30 days, or until you sign out.
• Blocks that lapsed before payment: the record is marked cancelled and kept briefly for reconciliation, then removed.
• Paid blocks and your account: for as long as the block is on the grid, and after that for as long as we must keep payment records for tax and accounting.

7. Your rights

You can ask us at any time to show you the data we hold about you, correct it, or delete it. If you are in the UK, the EU or another place with data-protection law, you also have the rights that law gives you, including the right to complain to your local regulator. Deleting your account removes your e-mail and sign-in records; a block you have paid for stays on the grid unless you ask us to take it down too, and the payment record itself is kept for as long as accounting rules require.

Write to support@onemilliondollarpixels.com from the address on your account. We will answer within 30 days.

8. Children

The site is for adults. We do not knowingly collect data from anyone under 18, and we will delete it if we learn that we have.

9. Changes

The date at the top of this page tells you when it last changed. If a change materially affects how we use data we already hold, we will tell you by e-mail first.

See also our terms of service and refund policy.