We keep as little about you as we can: enough to log you in, switch your membership on, check payments, and remember your settings. No ads, no tracking, no outside analytics, and we never sell your data.
What we keep, and why
- Your Discord account basics. You log in with Discord, and we only ask it who you are: your Discord ID, username, display name and avatar. We don't get your email address or your messages.
- Your membership. When it started and when it ends.
- Payments. The plan, amount, promo code, payment method, dates and status. For PayPal and Revolut, also the transaction ID, the name on the account you paid from, and the screenshot you send us, so we can match the payment. Card payments are handled by Stripe and crypto by NOWPayments: we never see your card number or wallet details.
- Your settings. Your watchlist, saved deal filters, alert settings, and, if you turn on notifications, each device's notification address and a label like “Windows · Chrome”.
- Invites. Your invite code, and who invited whom, so the right member gets their extra days.
- Autopilot, if you use it. When you accepted its agreement; for each account, the name you gave it, a masked e-mail (like pa•••@gmail.com), a scrambled form of the e-mail so the same account can't be added twice, console or PC, and what our trading software reports (status, coins, cards bought and sold, profit); your Discord webhook link and SBC choices. The EA password and authenticator key are locked (encrypted) in your browser before they're sent, so the site never sees them: only our trading software can open them, and the site deletes its locked copy as soon as the software has picked it up.
- Visit counts. To see how many people find us and join, we count a few pages a day (the front page, the free deals, the plans) as plain daily totals. To count you once a day rather than on every visit, a scrambled form of your IP address is held in memory until the day ends, with a key that changes every day, and never saved. Members aren't counted.
- Protecting the deals. Each member's copy of the deals is marked, so a leak can be traced to an account. To stop abuse, we count requests per account (or per IP address when you're not logged in); those counts are kept in memory for up to an hour and never saved.
We use all this to run the service you asked for: logging you in, giving you access, checking payments, sending the alerts you set up, and keeping memberships to one person each.
Cookies
Only the ones the site needs to work. None of them track you.
sw_session: keeps you logged in, for up to 30 days.sw_oauth: used during Discord login, for 10 minutes.bb_ref: remembers an invite link you opened, for up to 30 days.sw_tz: your time zone, so times show in yours, for a year.
Your browser also stores display choices, like list or card view, on your device only.
Who else sees it
- Discord, for logging in. Our Discord bot also gives members their role and sends you DMs about your membership and payments.
- Stripe (card) and NOWPayments (crypto) process those payments, and get your order reference and Discord ID with it. With PayPal or Revolut you pay them directly.
- Our team checks PayPal and Revolut payments, including your screenshot, in a private staff channel on our Discord server.
- Your browser's notification service (for example Google or Apple) delivers notifications, if you turn them on.
- Cloudflare carries the site's traffic to our server.
- EA: with Autopilot, our trading software signs in to your accounts at EA, through a proxy server, to trade on them. If you add a Discord webhook, Discord gets a message for each card bought and sold.
We don't share your data with anyone else, unless the law requires it.
How long we keep it
- Login sessions: 30 days, or until you log out.
- Your account, membership and settings: while you use BelowBIN. Ask us and we'll delete them.
- Payment screenshots: deleted automatically 90 days after we've checked the payment, or sooner if you ask.
- Other payment records: kept for our accounts and in case of a dispute.
- Notification addresses: until you turn notifications off, or the device stops accepting them.
- Autopilot logins: deleted when you remove the account, or 7 days after your plan ends. The rest of an account's details go with it.
- Backups: a nightly copy of the database, each kept for 14 days.
Your rights
You can ask for a copy of what we hold about you, ask us to correct or delete it, or object to how we use it. Ask us in Discord (below). If you're not happy with our answer, you can complain to your data protection authority (in the UK, the Information Commissioner's Office).
BelowBIN isn't meant for children under 13.
Contact
Questions, requests about your data, or a problem with a payment: open a ticket in the support channel of our Discord server. Give us your payment reference (it starts with BB-) if it's about a payment.
