Privacy Policy

Effective: 2026-06-15 · Last updated: 2026-10-22

We’re a small product written in good faith. This policy reflects what the site actually does today — including optional accounts and a paid subscription. When our data practices change, we’ll update this page and note it in the “Last updated” line above.

1. Who we are

“The Wall” (referred to here as “we,” “us,” or “the site”) is a market and world-intelligence dashboard operated by its founder. We also operate Happy Hudding (happyhudding.com), a foreclosure, tax-sale, and HUD-home deal-intelligence site built on the same platform — this policy covers both sites. A formal operating entity is being established; this page will name it once it is formed. Reach us at hello@happyhudding.com.

2. What we collect

We keep data collection deliberately small. Depending on whether you use the free dashboard anonymously or create an account, this is everything we touch:

Account details. If you create an account, we store your email address and a password. Passwords are salted and hashed (PBKDF2-HMAC-SHA256) before storage — we never keep them in plain text. We also record account timestamps (created, last login).
Launch-list email. If you join the Happy Hudding launch list, we store that email address, where on the site you signed up, and when. We use it to confirm the sign-up and to tell you when Happy Hudding opens; each of those emails has a one-click link that takes you off the list.
Property watches. If you set a Happy Hudding property watch, we store its name and the search criteria you chose (such as state, ZIP code, or price and discount limits) with your account, and email you matching listings. Every alert email has a one-click unsubscribe that deletes all of your watches.
Subscription status. If you subscribe to a paid plan (The Wall Premium or Happy Hudding), we store your plan, subscription status, and renewal dates so we know what to unlock. Payment itself is handled by Stripe (see §7); we never see or store your full card number.
Session cookie. Once you sign in, a signed session token is set as an httpOnly cookie so your browser stays logged in. It is a first-party, essential cookie — it is not readable by page scripts and is not used for tracking.
Theme preference. Your dark/light mode choice is stored in your browser’s localStorage so the page doesn’t flash the wrong theme on reload. This stays on your device.
Server request logs. Our backend records standard web request metadata (IP address, user-agent, requested path, timestamp) for operational debugging, abuse prevention, and capacity planning.

3. What we don’t do

We never see or store your full card number — Stripe handles payment data.
No invasive third-party analytics (Google Analytics, PostHog, etc.). We use Cloudflare Web Analytics, a cookie-less beacon that reports aggregate page-view counts without tracking individuals across sites or storing anything on your device.
No advertising, no ad pixels, no remarketing tags.
No session-replay scripts.
No selling, renting, or trading of personal information.

4. Cookies and similar technologies

We do not set cookies for tracking or analytics. The only cookie we set is the essential, httpOnly session cookie created when you sign in (see §2). We also use your browser’s localStorage for on-device preferences such as your theme choice and saved searches — these stay on your device. Our analytics beacon (Cloudflare Web Analytics) is cookie-less. If we ever add tracking cookies, we will update this page and present a notice first.

5. Accounts and payments

Accounts are optional — the free tier works without one. If you create an account or subscribe to a paid plan, here is what is involved:

Email + password identify your account and let us send service messages (for example, billing receipts or security notices).
Billing is processed by Stripe. Stripe receives your card details directly and tokenizes them; we never store full card numbers. We keep only your subscription status.
Account activity tied to your account, such as last login, kept to operate the service.

6. How we use what we have

To serve the dashboard and keep it online.
To operate your account and manage your subscription and billing.
To send service messages (receipts, security or account notices).
To investigate abuse, bugs, and outages.
To comply with applicable law when required.

We do not use server logs to build profiles of individual readers, and we do not enrich them with third-party data.

7. Service providers we use

CDN and edge hosting — Cloudflare, Inc. Traffic to the site passes through Cloudflare’s network, which also provides the cookie-less Web Analytics beacon described in §3.
Backend server — Hetzner Online GmbH. Our application server runs in Hetzner’s data center in Falkenstein, Germany (EU data location). Server request logs live there.
Database — Neon. Account and subscription data is stored in a managed Postgres database hosted by Neon.
Payments — Stripe, Inc. Card payments and subscription billing are handled by Stripe. Stripe receives your payment details directly; we receive only your subscription status, and never see or store full card numbers. See Stripe’s privacy policy for how they handle payment data.
Transactional email — Resend. Service email (account and alert messages) is delivered through Resend when email sending is enabled.
AI processing — Anthropic. We use a language model to summarize public market, news, and public-record content (see the AI-assisted labels on the dashboard). Your account data is never sent to it.
Public data APIs. We pull data from public sources (FRED, Tiingo, House Clerk, Senate eFD, Census Bureau, etc.). See the Data sources page for the full list. Those providers see our server-side requests, not you.

8. Your rights

If you have an account, you can email us to:

Request a copy of the data tied to your account.
Correct inaccurate account data.
Delete your account and its associated data (or do it yourself from your Happy Hudding account page).
Opt out of non-essential email. Account and security notices are service messages; property-watch alerts and launch-list emails are optional, and each one carries a one-click unsubscribe.

If you browse without an account and haven’t joined the launch list, we have no identity-linked data to act on. Email hello@happyhudding.com with any privacy request; we aim to respond within 30 days.

9. Children

The site is not directed at children under 13 (or under 16 in regions where that is the threshold), and we do not knowingly collect data from them. If you believe a child has provided data to us, contact us and we will delete it.

10. Security

We use HTTPS for all traffic, store account passwords salted and hashed (PBKDF2-HMAC-SHA256, never in plain text), use scoped API keys for upstream data providers, and rely on standard cloud-provider security controls. No system is perfectly secure. If you find a vulnerability, please report it to hello@happyhudding.com.

11. Changes to this policy

We will update this page when our data practices change. Material changes will be flagged in the “Last updated” line at the top and, where appropriate, called out on the dashboard.

12. Contact

Privacy questions: hello@happyhudding.com. Postal contact will be added when we form a legal entity for the product.