SubMintBack to marketplace
LEGAL

Privacy Policy

Last updated: 26 October 2026.

Information we collect

SubMint may collect your name, email address, password hash, optional Telegram username, account sign-in provider, order data, payment network and blockchain transaction identifiers. Passwords are stored as salted PBKDF2-HMAC-SHA256 hashes protected by a server-side secret, not plaintext.

Google sign-in

If Google sign-in is enabled and you choose it, SubMint receives identity information such as your verified email, display name, Google account identifier and profile image from Google for account authentication.

Blockchain data

Public blockchain transactions are visible on their respective networks. SubMint may monitor public receive addresses and transaction data to match payments to orders. We do not need or request wallet private keys, seed phrases or recovery phrases.

How information is used

Information is used to create and authenticate accounts, create and track orders, provide support, prevent abuse, reconcile payments, improve the marketplace.

Data sharing

Information may be shared with legitimate fulfillment or infrastructure partners only where necessary to operate the service, complete an order, prevent abuse or comply with legal obligations.

Security

SubMint uses HttpOnly signed session cookies, password hashing and server-side access controls. No security measure is absolute; users should protect their own account and wallet credentials.

Retention and rights

Before public launch, SubMint should define retention periods and user rights processes appropriate to the jurisdictions it serves and the hosting/analytics providers actually used.

Contact

For privacy or support questions, email support@submint.in or use the official Telegram contact at t.me/subscriptionmint.

First-party analytics

SubMint records basic usage events such as page views, marketplace searches, product views, checkout starts, traffic source, device category and country. Raw IP addresses are not stored. A rotating anonymous identifier is derived at the server for aggregate visitor counts. Search landing pages retain a traffic-source label and external referring origin in first-party session storage for up to 30 minutes of inactivity, so a visit can be attributed as you move between pages. Those landing-page events omit URL query strings from the recorded path and referring address.