Payment and security

Hourden accepts cryptocurrency through CoinPayments (USDT, USDC, BTC, ETH, LTC and many more) and PayPal. You finish the payment on the provider's page, so there is no card form on this site. The balance is credited only after the provider confirms the payment to our server directly - never because a browser says it paid.

Whatever coin you send is credited to your account as a US dollar balance at the rate quoted when the invoice was created. From that point the balance does not move with the coin price - a deposit of $50 stays $50 whatever Bitcoin does afterwards. Orders are charged against that dollar balance.

The order form sends a package id, a quantity and a link. It never sends a price. Whatever a browser claims something costs is ignored and the charge is computed from the catalog on the server. The debit and the order are written in the same database transaction, so there is no state where money left your balance and no order exists.

Not at sign-up, not at checkout, not in support. Delivery is always against a public profile or post address. There is no feature on this site that would work better if you handed over credentials, so there is no reason for us to have them.

An email address, a password hash, your balance, your orders and the links you submitted with them. Sign-in attempts are recorded with an IP address to stop brute force. Payments are recorded with the transaction reference. That is the whole list - there is no profile building and no third-party data purchase.

Hashed with bcrypt, never stored in a readable form, and never recoverable by us or by support. An account created through Google sign-in has no usable password at all. Sessions are cookie-based over HTTPS only, and the session identifier is regenerated the moment an account gains privilege, which is what stops session fixation.

You can ask for your account and its data to be removed. The data deletion page explains what goes, what has to stay for accounting, and how long it takes.