Privacy policy
This explains what Unspent collects, why, who else can see it, and how long it is kept. It describes what the site actually does rather than covering every possibility in the abstract.
Last updated September 20, 2026.
What we collect
When you sell a card: the brand, the balance you enter, the card number and the PIN or security code if the card has one, your payout details (a PayPal address, a Cash App tag, or a name and postal address for a check), and an email address to reach you at. When you create an account: your email address and a password. Automatically, on every request: your IP address, which is used to apply the submission rate limit and to spot fraud patterns. We do not ask for your date of birth, your government ID, your bank login or your card details, and there is nothing on this site that takes a payment from you.
Why we need the card number
Because it is the thing being sold. We cannot verify a balance or take ownership of a card without it, in the same way a shop cannot buy something you do not hand over. It is entered over HTTPS on this site and nowhere else. We will never ask for it by email, by phone or through a messaging app.
Where it is stored
Submissions are stored in a Cloudflare D1 database, which is the same infrastructure that serves the site. Card numbers and PINs are readable by exactly one administrative route and are never included in any other response, any log line, or any analytics event. Passwords are never stored at all — only a PBKDF2-SHA256 hash with a random salt per account and 300,000 iterations, which we cannot reverse.
Card details reach the operator's own mail, and nowhere else
You should know this, because most services will not tell you. When a submission comes in, a notification containing the card number, the PIN and a scannable barcode is emailed to the operator so the card can be verified and redeemed without signing in. It is sent only to the operator's own mail — no third party, no staff, no contractor and no other company receives it — and it is the only email card data is ever put into. No seller-facing email ever contains it. Everything a seller receives is written by a person, not generated automatically.
Cookies and analytics
If you log in, we set one cookie holding a session token. It is HttpOnly, Secure and SameSite=Strict, expires after seven days, and exists only to keep you signed in. Only a hash of the token is stored on our side. For traffic measurement we use Cloudflare Web Analytics, which is cookieless and does not track you between sites. We also run the Microsoft Advertising conversion tag, which does set its own cookies from bat.bing.com to measure whether an advert led to a sale; it is not loaded on the dashboard or the administrative pages. We do not use Google Analytics, we do not sell data to advertisers, and we do not run any other tracker.
Who else sees your data
Nobody we do not need. Cloudflare hosts the site, the database and the email, so it processes what passes through them. PayPal or Cash App necessarily see the payout address or tag when we send you money. When we verify a balance, we give the brand the card number — which is how balance checking works for anyone. Beyond that, we do not share, sell, rent or trade your information, and we do not send it to data brokers or advertising networks.
How long it is kept
A submission record is kept for 30 days after payment so a dispute can be checked against what was verified, and account records are kept while the account exists. Expired sessions are deleted as soon as they are seen. If you want your account and the data attached to it deleted, write to us and we will do it, except where we are required to keep a record of a completed transaction.
Your rights
You can ask what we hold about you, ask for a copy of it, ask us to correct it, and ask us to delete it. California residents have these rights under the CCPA, and residents of other places have equivalent rights under their own laws. We do not charge for a request and we do not treat you differently for making one. We have never sold personal information and have no intention of starting.
Children
This service is for adults. We do not knowingly collect information from anyone under 18, and if we learn that we have, we delete it.
Security, honestly stated
Card data is transmitted over HTTPS, passwords are hashed as described above, administrative routes check the session server side before reading anything, and failed logins are throttled by both address and email. No system is perfectly secure and we are not going to claim otherwise. If you find a security problem with this site, tell us and we will take it seriously.
Changes
If this policy changes in a way that affects what we do with your data, we will update the date above and, where the change is significant, say so on the site.
Reaching us
Requests about your data, and anything else covered here, go to [email protected].