Privacy notice

Effective November 2, 2026. This notice describes Pay the Box. Contact: hello@paythebox.lol.

Public information

Your chosen nickname, message, selected flag, eligible X handle, payment amount and tile creation time appear publicly. Do not submit sensitive personal information. Your email and billing details are not published. The certificate link contains an unguessable order reference; keep it private if you do not want others to view your certificate.

Payment and delivery

Stripe processes card payments and collects checkout email and billing information. We do not receive card numbers or security codes. We retain payment references, amounts, refund status, settlement transaction amounts and fees to deliver purchases, prevent duplicates and reconcile payments. A hash of your normalized email helps group repeat purchases. If you opt into alerts, we also store your email encrypted for delivery; otherwise it is not stored in readable or encrypted form in our wall database. Stripe retains its own transaction records.

Safety and optional alerts

Submitted public text and an optional X handle are checked by automatic rules and Cloudflare Workers AI. We do not send your checkout email to this safety model. Resend receives your email address and message content only when sending alerts you opted into. Unsubscribe at any time using an email’s link or by contacting support.

Site analytics and cookies

First-party visitor and short-lived session cookies help count page views, tier selections, checkout starts, confirmed payments and share-button clicks, and attribute traffic sources. We record coarse country, device category, referring host and campaign markers. We do not sell analytics data or use advertising pixels. Basic analytics are optional: your first visit presents an Allow analytics / Decline choice; you can change it using the footer link. Checkout and administration may use necessary cookies independently. IP-derived hashes are used temporarily to limit abuse; raw IP addresses are not stored in our application database.

Providers and retention

The site and database run on Cloudflare. Fonts may be fetched from Google Fonts, which receives normal network request information. Stripe and Resend process data under their own notices. Providers may process data internationally. Public tiles remain for at least 12 months unless you request removal or a refund or abuse requires removal. Operational purchase records are retained as needed for delivery, refunds, accounting and legal obligations. Optional alert email data is removed when no longer needed; unsubscribe preferences may be retained to prevent further messages.

Your choices

You can request access, correction or removal of your tile, personal data or optional alert subscription by emailing support. We may ask for proof that you control the order email address. Required payment/accounting records and fraud-prevention information may need to be retained. Your local statutory privacy and consumer rights remain available.