Effective date: 9 August 2026
Data controller: Sasha Marshall Arts, LLC, doing business as Lit Hype Squad
Contact: hey@lithypesquad.com
Sasha Marshall Arts, LLC decides what personal data this platform collects and why, which makes it the data controller for everything described below.
Account — email, display name, handle, avatar, timezone, age confirmation, password or identity-provider ID.
Profile — bio, socials, wishlist link, and your birth month and day. We do not ask for or store your birth year.
We do not collect legal names, phone numbers, or postal addresses. There is no field for them anywhere in the product. Physical rewards ship from your own public wishlist, which means the retailer holds your address and we never see it.
Activity — Squad memberships, tasks completed, Hype earned and spent, rewards redeemed, messages, applications, warnings.
Sign-in records — IP address, approximate location derived from it (country, region, city), device and browser details, and time, for every sign-in attempt. See section 3.
Technical — cookies needed for sessions and security. We do not run advertising trackers.
We don't ship anything. Rewards reach you one of four ways:
From your own public wishlist. You add a wishlist link to your profile, the author buys the item, and the retailer delivers it. The retailer already knows where you live; the author doesn't, and neither do we. This is the route we recommend for anything physical.
Digitally, in the app or by email. As an experience — naming a character, a call, a credit in the book. Or posted by the author, arranged privately between the two of you.
If an author posts something, they may add a carrier and tracking number so you can follow it. Two things worth knowing:
build a link you click. We make no request and receive no destination.
to anyone holding the number. It's visible only to you and that author, and we delete it 30 days after you confirm the parcel arrived.
If an author posts something themselves, you'll arrange it in a private thread. Those are free text, so they may contain whatever you type — including an address, if you choose to share one. We treat that thread accordingly:
Sharing an address is your choice, and the author becomes responsible for it once you do. We'd rather say that plainly than pretend the risk isn't there.
The complete list of personal data we hold:
| What | Why | Kept for |
|---|---|---|
| Email address | Your account. Required. | Until you delete it |
| Display name and @handle | Shown to squadmates, used for mentions | Until you delete it |
| Optional bio and social handles | Shown to squadmates; verifying shared posts | Until you delete it |
| Birth month and day | Squad birthday wishes. No year, ever. | Until you delete it |
| Public wishlist link | Sending you rewards, if you add one | Until you delete it |
| Squad activity | Points earned, tasks done, messages posted | Life of the Squad |
| Private message contents | Your conversation with an author | 60 days after the last reply |
| Carrier tracking number | So you can follow a parcel | 30 days after you confirm receipt |
| Sign-in records | Account security. See section 3. | 90 days |
That's it. There is no structured field for a name, phone number, or address anywhere in the product.
Author accounts are the sole administrators of their Squads and cannot be shared. To protect them, we record the IP address, approximate location, device, and time of every sign-in.
We use it to:
We keep sign-in records for 90 days, then delete them. IP addresses and location data are personal data under GDPR and UK GDPR; our lawful basis is legitimate interest in account security. Only you and our security staff can read your own sign-in history — no team member of any permission level can see another person's.
authentication, payments, email, image moderation, and error monitoring. Each is bound to use the data only to provide that service.
wishlist link, and your activity in their Squad. Nothing more, because nothing more exists.
sexual abuse material, which we report proactively.
We do not sell your data. We do not share it for advertising.
Every image uploaded is scanned by an automated moderation service before it becomes visible. This is how we keep the platform safe-for-work.
You can access, correct, export, or delete your data, object to processing, and withdraw consent. Depending on where you live, you may also have rights to restrict processing or to appeal a decision.
Delete is a real button, not a support ticket. From your profile you can erase your account. When you do:
are deleted immediately
deleting them would let an author erase their own fulfillment record
Requests: hey@lithypesquad.com. We respond within 30 days. You can also complain to your local data protection authority.
| Data | Kept for |
|---|---|
| Sign-in records | 90 days |
| Account and profile | Until you delete it |
| Anonymised ledger entries | Life of the Squad |
| Billing records | As tax law requires |
| Deleted Squad data | 30-day hold, then purged |
Data is processed in the United States. Transfers out of the EEA or UK rely on Standard Contractual Clauses.
The companies that process data on our behalf:
| Who | What they do | Where |
|---|---|---|
| Netlify | Hosts the website | United States |
| Neon | Stores your account and squad data | United States |
| Auth0 (Okta) | Handles sign-in | United States |
| Cloudflare | Stores uploaded images | Global network |
| Stripe | Processes payments | United States |
| Resend | Sends our email | United States |
| Ably | Delivers chat messages | Global network |
| Sightengine | Screens uploaded images | European Union |
Each is bound by contract to use your data only to provide that service.
You must be 18 or older. We don't knowingly collect data from anyone younger, and we delete it if we find it.
Material changes get 30 days' notice by email and in-product.