Privacy Policy

1. Who this applies to

This policy explains how Pawn X Ventures (“Hitch”, “we”) handles personal information when you use Hitch (www.hitch.top and our short-link domains add.my, hit.my, with.my, gym.my, shape.my and fee.my), visit a Hitch link or bio page, or are the subject of a preview page. It is written to meet the EU and UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA) and other US state privacy laws. Extra information for some other countries is in section 16.

2. Who we are and how to reach us

Pawn X Ventures decides how the personal information described here is used (the “business” under the CCPA and the “controller” under the GDPR). For a Hitch customer's own links and visitors, the customer decides what their page says and which tracking pixels it uses.

Privacy questions and requests: our privacy request form, or email hello@hitch.top.

3. What we collect

• Account information: email address, name, password (stored only as a secure hash), and what you add to your workspace and team. Source: you.
• Sign-in information: if you sign in with Google or Apple, your name, email address, profile picture (if any) and an account ID from that provider — see “Google user data” below.
• Links and pages: short links, destination URLs, UTM tags, bio pages and the text and images on them. Source: you.
• Visit data: when someone opens a Hitch link we record a click: time, referring site, device type (phone/tablet/desktop) and country, worked out from the IP address. We don't store the IP address with the click. Our hosting providers keep short-lived technical logs (including IP address and browser) for security.
• Website usage: which pages of our website and app are opened and which buttons are pressed, the referring site and campaign tags, country, browser and device type. Never what you type, your link names or destinations, and never secret claim-link tokens. Source: your browser (section 11).
• Billing information: Stripe processes payments. We receive payment status, plan, invoice records and the card's brand and last four digits — never the full card number.
• Preview pages: a person's public name, username and similar public profile details that a Hitch customer uses to make a preview page for them — see section 6.
• Communications and requests: support emails, and a record of privacy requests (what was asked, when, and what we did).

We don't collect government ID numbers, precise location, health, biometric or financial-account information, and we don't knowingly collect information from children (section 12).

Google user data

When you choose “Continue with Google”, Hitch asks Google only for the basic sign-in scopes (openid, email, profile). From these we receive your name, email address, profile picture and Google account ID. We do not request access to your Gmail, Drive, Contacts, Calendar or any other Google data.

• How we use it: only to create and sign you in to your Hitch account, show your name and picture in the app, and send you account and billing emails.
• Sharing: we do not sell it, use it for advertising, or share it with anyone except the service providers that run Hitch (section 5), under confidentiality obligations.
• Storage and protection: it is stored in our authentication database, encrypted in transit (TLS) and at rest, and only accessible to Hitch staff who need it to support your account.
• Retention and deletion: it is kept while your account exists and removed when you delete your account (section 10). You can also revoke Hitch's access at any time at myaccount.google.com/permissions.

Hitch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use it

To run Hitch (redirect links, show bio pages, count clicks), keep it secure and stop abuse such as phishing and spam, take payments, send account, billing and trial emails, answer support and privacy requests, meet legal obligations (such as tax records), and improve the service. We don't use your information for advertising, and we don't make automated decisions about you that have legal or similar effects.

5. Who we share it with

• Service providers that run Hitch for us, under contracts that limit them to doing so: Supabase (database, sign-in and image storage — data stored in South Korea), Cloudflare (link redirects — worldwide), Vercel (website hosting and anonymous page-view counts — US and worldwide), PostHog (website usage analytics — EU), Stripe (payments — US) and Resend (email — US).
• Webhook receivers you set up: if you add a webhook, we send it event data for your links over HTTPS. What it does with that data is up to you.
• Advertising pixels you set up: if you add a Meta, TikTok or Google pixel to your links, your visitors' browsers send data straight to those companies under their own policies. That is your choice for your links; Hitch adds no pixels of its own.
• Legal reasons: when the law requires it, or to protect people from fraud, abuse or harm.
• A business transfer: if Hitch is sold or merged, under this policy's protections.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, and have not in the past 12 months.

6. Preview pages (for people who haven't signed up)

Some Hitch customers use our API to make a “preview” bio page for someone — for example a coach or creator they'd like to work with — and send them a link to claim it. If that someone is you:

• What's used: public details such as your name or username and public links. Our rules require customers to use template images, not your photos, unless you've agreed.
• Why: to show you what your page could look like, so you can choose to claim it.
• How long: an unclaimed preview is deleted automatically when its claim offer ends (7 days, or the end of a trial you started). Its details are wiped a day later, and its images within a week.
• Removing it: the “Is this you? Remove this page” link at the bottom of the page deletes it at once, with no account needed.
• Never again: removing a page, or asking through our privacy request form, puts your name and usernames on a do-not-contact list, and our system then refuses to make previews for you.

7. Your US state privacy rights

Residents of California and of other states with privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) have these rights. We give them to everyone, wherever you live:

• Know and access: what personal information we have about you, where it came from, why we use it and who we share it with, and a copy of it.
• Delete: have it deleted, except what we must keep by law (such as invoice records).
• Correct: have inaccurate information fixed.
• Opt out of sale, sharing and targeted advertising: we don't do any of these, so there is nothing to opt out of. We also honor Global Privacy Control (GPC) browser signals as an opt-out.
• Limit sensitive information: the only sensitive information we hold is your login, used only to sign you in.
• No discrimination: using these rights never changes your price or service.

How to ask: delete your account yourself in Settings → Account, or use our privacy request form, or email hello@hitch.top. We confirm requests within 10 business days and answer within 45 days (we may extend once by 45 days and will tell you why). To protect you, we check it's really you before sharing or deleting data — usually by email from the address on the account. You can use an authorized agent; we'll ask for your signed permission and may ask you to confirm your identity with us.

Appeals: if we turn down your request, reply to our answer with “appeal” and we'll review it within 45 days (60 in Colorado). If you're still not satisfied, you can contact your state attorney general.

Categories of personal information we collected in the past 12 months (CCPA categories): identifiers (name, email, account ID, IP address in short-lived logs); commercial information (plans and purchases); internet activity (link clicks, referring sites, device type); approximate location (country); and account login credentials (sensitive). Sources, purposes and recipients are in sections 3–6. We don't sell or share any of them.

8. Your rights in the EU and UK (GDPR)

If the GDPR or UK GDPR applies to you, you have the rights to access, correct and delete your data, to restrict or object to how we use it, to data portability, and to withdraw consent at any time where we rely on it. Ask the same way as in section 7; we answer within one month (we may extend this by two months for complex requests and will tell you why).

Our legal bases are: providing the service you signed up for (contract); security, abuse prevention, preview pages and measuring how our website is used (legitimate interests — you can object to these); and tax records (legal obligation). You can also complain to the data protection authority where you live or work — but please talk to us first, so we can try to fix it.

9. How long we keep it

• Account, links and pages: while your account exists; deleted when you delete it (section 10).
• Clicks: 400 days.
• Unclaimed preview pages: deleted when the offer ends (7 days, or the end of a started trial); details wiped a day later; unused images within a week.
• Webhook delivery records: 30 days. API rate-limit records: 24 hours.
• Privacy request records: 24 months, as US state laws require.
• Invoice records (held by Stripe): 7 years, as tax law requires.
• Backups: overwritten within 90 days.

10. Deleting your account

Go to Settings → Account → Delete account. It takes effect immediately: we cancel your subscriptions (without a refund for the current period), delete your workspaces with their links, bio pages and names, remove you from workspaces you share with others, and delete your sign-in. If you're the only owner of a workspace that has other members, you'll be asked to hand ownership to someone first. We email you a confirmation. Backups are overwritten within 90 days, and Stripe keeps invoice records as tax law requires. You can also ask us to do it through the privacy request form.

11. Cookies and tracking

Hitch uses only essential cookies, to keep you signed in. We don't use advertising or tracking cookies, and we don't follow you around other websites.

To learn which pages help people and where they get stuck, we measure how our website and app are used with Vercel Web Analytics (page views) and PostHog (pages opened and buttons pressed, hosted in the EU). Both run without cookies or anything stored on your device. PostHog tells one visit apart from another with a code it works out from your IP address and browser that changes every day, so it can't recognise you from one day to the next, and it isn't linked to your account. We also count completed purchases there under an internal workspace ID, without names or email addresses. Before anything is sent we remove secret claim-link tokens and web-address details other than campaign tags, and we never send what you type into forms. You can object at any time (section 8), and browser privacy settings or blockers that stop these tools don't affect how Hitch works.

Bio pages set no cookies of their own. If a Hitch customer adds advertising pixels to their links, those companies may set cookies under their own policies (section 5).

12. Children

Hitch is not for children under 13, and we don't knowingly collect their information. If you believe a child has given us personal information, contact us and we'll delete it. We don't sell or share the information of anyone under 16.

13. Security and where data is stored

Data is encrypted in transit (HTTPS) and at rest, access is limited to people who need it, and passwords are stored only as secure hashes. Our database is hosted in South Korea, links are served worldwide, and our other providers operate mainly in the US. Where data protection law requires it, transfers are covered by our providers' data processing agreements (including Standard Contractual Clauses).

14. Changes to this policy

We'll update the date at the top when this policy changes, and email account holders about material changes before they take effect.

15. Contact

Pawn X Ventures — privacy requests: our privacy request form; email: hello@hitch.top.

16. Company details and other countries

Pawn X Ventures is a business registered in Malaysia (registration number 202403086326 (NS0295100-P)). Postal address: 18, Jalan Austin Heights 5/28, 81100 Johor Bahru, Johor, Malaysia.

Malaysia. The Personal Data Protection Act 2010 (PDPA) also applies to how we handle personal data. It gives you the rights to access and correct your data, to withdraw consent, and to limit its use for direct marketing. We answer PDPA requests within 21 days.

Anywhere else. If your local law gives you other privacy rights, contact us and we'll honor them.