Privacy Policy

What we collect

Email address — only if you give us one, by joining the list or creating an account. We use it to send the deal alerts and digests you asked for, and nothing else.

Account data — if you sign in, we store your account identifier, your watchlist, and your alert preferences so the product works across devices.

Usage data — pages viewed, searches run, and features used, so we can tell which parts of the product are worth keeping. This includes standard technical data your browser sends, such as IP address and user agent.

We do not ask for, and have no use for, payment card numbers, physical addresses, or government identifiers. If subscriptions are enabled, card details go directly to Stripe and never touch our servers.

Cookies and tracking

We use analytics cookies to understand product usage, and affiliate tracking cookies so that retailers can credit us when a purchase follows a link from our site. Affiliate cookies are set by the retailer or its network, not by us, and are governed by their policies.

We do not run advertising networks, we do not build advertising profiles, and we do not sell or rent personal information to anyone.

Services we share data with

We use a small number of third-party processors, each for a stated purpose: Vercel (hosting), Supabase (database and authentication), Google Analytics and PostHog (product analytics — PostHog receives your account email as a person property when you are signed in, so usage can be tied to one account), Sentry (error monitoring), Resend or an SMTP provider (sending email), and Stripe (payments, if enabled).

For affiliate attribution we use the eBay Partner Network, Amazon Associates, and impact.com, which runs our Fanatics partnership. These receive click and impression data associated with our links.

If you paste a Discord webhook URL to receive drop alerts, we store it in order to send you those alerts, and we send nothing else to it.

Your choices

Email — every message we send carries a one-click unsubscribe link, and unsubscribing is immediate and permanent unless you re-subscribe.

Access and deletion — email aaron@surgecouncil.com and we will tell you what we hold about you, or delete it. We do not require an account to make that request.

Tracking — browser-level "Do Not Track" and cookie controls, and ad-blocking extensions, all work normally on this site; nothing here depends on tracking being enabled.

California residents

Wildcard is operated from California. Under the CCPA/CPRA you have the right to know what personal information we collect and why, to request a copy of it, to request deletion, and to correct inaccurate information — and not to be discriminated against for exercising any of them.

We do not sell or share personal information as those terms are defined by the CCPA, and we never have. To exercise any right, email aaron@surgecouncil.com — we will verify the request against the email address on file and respond within the statutory window. You may use an authorized agent.

Retention

We keep email addresses for as long as you are subscribed, plus a suppression record afterwards so that an unsubscribe is honored permanently. Account and watchlist data is kept until you ask us to delete it. Analytics data is retained under each provider’s standard retention period.

Children

Wildcard is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us data, write to us and we will remove it.

Changes

We will update this page when our practices change, and revise the date at the top. Questions go to aaron@surgecouncil.com.