Yellowhammer Trader — Privacy Policy

1. Scope of this Policy

This Privacy Policy applies to yellowhammertrader.com and all subdomains we operate (collectively, the "Service"). It covers information we collect when you visit the forum, register an account, post in the forum, list items in the Classifieds section, or purchase a paid membership tier.

It does not cover:

• Transactions that take place off-platform between users. Once two users agree to a private sale, YHT is no longer a party to the exchange and we receive no information about it.
• Third-party websites we link to. If you click a link in a forum post and leave YHT, this Policy stops applying at that boundary.
• The browser or network of any visitor who is merely reading public pages without registering. We collect minimal server logs as described below.

This Policy is incorporated by reference into our Terms of Service. Capitalised terms not defined here have the meanings given in the Terms.

2. What we collect

We collect three categories of information.

2.1 Information you give us

• Account data — username, email address, password (stored as a one-way hash, never in plaintext), and the timezone and display preferences you select during registration.
• Forum content — the posts, private messages, classified listings, signatures, attachments, and profile fields you submit. Profile fields other than username and email are optional and visible according to the visibility setting you choose for each.
• Alabama residency attestation — for Verified and Supporter tiers, we collect your self-attestation checkbox status, the Alabama ZIP code you entered (validated against the 3xxxx range), and the timestamp you attested. For Dealer tier, we additionally collect an Alabama-issued license number. See §4.
• Support correspondence — emails, contact-form submissions, and any other communications you send us.
• Advertiser account data — if you purchase an advertising placement (Silver / Gold / Platinum banner, or Platinum CPC), we additionally collect your business name, business address, business contact email, telephone number (if provided), the creative assets you upload (banner image, target URL, alt text), and any invoice or tax forms you submit (W-9 or equivalent). See the Yellowhammer Trader Terms of Service §12 for the full advertising policy.

2.3 Listing-bump data

If you purchase a $5 listing bump for a Classifieds topic, we collect the topic ID, your user ID, the timestamp of the bump, and the bump's expiry timestamp. The bump record is used only to sort the Classifieds topic list and display the "BUMPED" badge during the five (5)-day (120-hour) window, then deleted. See Terms §11.

2.2 Information collected automatically

• Server logs — each request produces a log line with the requesting IP address (set by Cloudflare to the real client IP via CF-Connecting-IP), user-agent string, referrer, requested path, response status, and bytes transferred. Logs are retained for 30 days for security and abuse-investigation purposes and then deleted.
• Session cookies — phpBB sets a session cookie (phpbb3_<sid>) when you log in so the server knows who you are across requests. See §6.
• Anti-spam metadata — phpBB's anti-spam modules may record request timing, referrer, and user-agent to score suspicious posts. These scores are stored against your user ID, not shared externally.
• Ad-impression and click logs — when the YHT advertising leaderboard is served, we log the request and the resulting impression. If a visitor clicks the leaderboard, we log the click with a hashed IP and a 24-hour dedupe window (see Terms §12.5 for the full click-fraud rules). Click logs are used only to bill CPC advertisers and to detect fraudulent clicks; they are not shared with the advertiser in identifiable form. Logs are retained for ninety (90) days for billing-dispute purposes, then aggregated into anonymous counts and deleted.

2.4 Information we do NOT collect

• No browsing history outside our Service.
• No contact list, calendar, or device sensor data.
• No biometric data.
• No precise geolocation beyond the city-level ZIP code you voluntarily enter for Alabama residency verification.
• No advertising identifiers, ad-conversion pixels, or third-party analytics cookies. We do not run Google Analytics, Facebook Pixel, or similar.

3. Why we collect it (purposes)

We process the data above for the following purposes, each tied to a specific legal basis under applicable U.S. and Alabama privacy law:

We do not process your data for any other purpose. In particular, we do not profile you, score you for credit, target you with advertising, or feed your activity into machine-learning models.

4. Alabama residency verification

The Verified and Supporter paid tiers are restricted to Alabama residents. The Dealer tier is restricted to holders of a valid Alabama-issued firearms-dealer license. We verify this as follows:

• Verified / Supporter — at checkout you tick a self-attestation checkbox and enter an Alabama ZIP code. The ZIP must match the pattern ^3[0-9]{4}(-[0-9]{4})?$. Your attestation timestamp and ZIP are recorded in our subscriptions table. We do not run a third-party address lookup.
• Dealer — you additionally enter an Alabama dealer license number. The license number is shown to the site operator (the founder) for manual review before a YHT-NNNN identifier is assigned. License numbers are visible only to the operator and the licensee.

If we discover that an attestation is false (e.g., the ZIP does not match the address on file with the payment processor, or a Dealer is later found not to hold the claimed license), we may revoke the attestation and downgrade the user to the Free tier without refund.

Alabama residency data is retained for the life of the account plus three (3) years for tax-record purposes, after which it is deleted.

5. Payment information

YHT does not collect or store your full credit-card number, CVV, or bank-account credentials. All payment data is handled by our third-party payment processor. The processor gives us:

• A customer / account identifier (e.g., cus_… or equivalent)
• A subscription identifier (e.g., sub_… or equivalent)
• The last four digits of the card and its brand (Visa, Mastercard, etc.)
• Billing status (active, past_due, canceled, etc.)

This is enough for us to display "Paid via Visa ending in 4242" on your account page and to know which tier to grant you. The processor's own privacy practices govern everything they collect on their side; review their published policy before paying.

If we migrate to a new payment processor, your subscription records will be re-associated with the new provider using a migration token, but your stored card details remain with the original processor unless you actively re-enter them.

6. Cookies and similar technologies

We use the minimum number of cookies required to operate the forum:

We do not use any advertising cookies, third-party tracking pixels, or cross-site identifiers. You can disable cookies in your browser, but if you block all cookies the forum will not function.

7. Who we share data with

We share data only with the following categories of recipients, and only the minimum needed for them to do their job:

• Cloudflare, Inc. — provides our DNS, DDoS protection, and TLS termination. Cloudflare sees every request and may store request metadata in their edge logs.
• Our web host — the physical server that runs phpBB and the database. They have root access but do not routinely read user data.
• Payment processor — receives billing data directly from your browser at checkout. We receive only identifiers and status, not card numbers.
• Email delivery provider — sends transactional emails (registration confirmation, password reset, subscription receipts). They see your email address and the message body.
• Advertisers (in aggregate, not individual form) — when you click or view a CPC ad, the advertiser receives an aggregated event count ("approximately N clicks in window W") for billing purposes. The advertiser does not receive your user ID, your IP address, your real name, your email address, or any other directly identifying information about you as a viewer.
• Law enforcement — only in response to a valid subpoena, court order, or other legal process. We will notify you of the request before disclosing, unless we are legally prohibited from doing so.

We do not sell, rent, lease, or trade your personal data to anyone for marketing or any other commercial purpose. We have never done so and will not begin doing so without updating this Policy first.

8. How long we keep data

• Forum content (posts, PMs, listings) — retained while your account is active. When you delete a post or PM we soft-delete it; if you delete your account entirely, we purge the record within 30 days, except where retention is required for legal or tax purposes.
• Subscription and billing records — retained for seven (7) years for tax and accounting compliance.
• Advertiser account and campaign records — retained for seven (7) years for tax and accounting compliance.
• Listing bump records — retained for thirty (30) days after the bump expires (to cover any billing dispute), then deleted.
• Ad click and impression logs — retained for ninety (90) days for billing-dispute resolution (Terms §12.5), then aggregated into anonymous counts and deleted.
• Alabama attestation data — retained for the life of the account plus three (3) years, as described in §4.
• Server logs — 30 days, then deleted.
• Backups — encrypted off-server backups are retained for 30 days on a rolling basis. Older backups are overwritten.

9. Your rights (access, correction, deletion)

You have the following rights with respect to your personal data. To exercise any of them, contact us at the address in §21.

• Access — request a copy of the personal data we hold about you, in a portable format.
• Correction — ask us to correct inaccurate data (most profile fields you can correct yourself from your account page).
• Deletion — ask us to delete your account and associated data, subject to the retention rules in §8.
• Opt-out of any future data sale — moot at present because we do not sell data, but the right is reserved.

We will respond to verifiable requests within 45 days. If you are unsatisfied with our response, you may lodge a complaint with the Alabama Attorney General's office.

10. How we protect data

• All traffic is served over HTTPS with a Cloudflare Origin Certificate and TLS 1.2 / 1.3 only.
• Passwords are hashed with phpBB's bcrypt implementation before storage; we cannot read your password in plaintext.
• The forum database is accessible only from the application server; the application server is reachable only from Cloudflare's edge IPs.
• Backups are encrypted at rest with AES-256.
• Two-factor authentication is available on your account via phpBB's built-in TOTP support. We strongly recommend enabling it.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you by email and post a notice on the forum within 72 hours of confirmation, consistent with applicable U.S. state breach-notification laws.

11. Children's privacy

YHT is not directed at children under the age of 13, and we do not knowingly collect personal data from anyone under 13. Federal firearms law (18 U.S.C. § 922) independently prohibits the sale, transfer, or furnishing of a firearm to any person under 18 for rifles/shotguns, and under 21 for handguns. Because YHT is an outdoor-enthusiast community that includes a firearm-adjacent classifieds area, all users are required to be at least 18 years of age to register.

12. International transfers

YHT is operated from the United States. If you visit the Service from outside the U.S., you understand that your data will be transferred to, stored in, and processed in the United States. The U.S. may not have the same data-protection laws as your home country; by using the Service you consent to this transfer.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top and post a notice in the forum. Material changes that affect your rights will be summarised in a site-wide announcement and, where required by law, notified to you by email before the change takes effect.

14. Contact us

Privacy questions, data-access requests, and account-deletion requests should be sent to:

Yellowhammer Trader — Privacy
Email: [email protected]
Mail: Yellowhammer Trader, LLC, Attn: Privacy Officer, [street address], [city], AL [ZIP]

We aim to acknowledge privacy requests within five (5) business days and resolve them within forty-five (45) days.

15. Specific laws we comply with

This Policy is designed to satisfy the following applicable laws, among others:

• Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506 — see §11.
• Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 — we maintain reasonable security to prevent unauthorized access (§10).
• Alabama Deceptive Trade Practices Act (DTPA), Ala. Code § 8-19 — we do not misrepresent what data we collect or how it is used.
• Alabama breach-notification statute, Ala. Code § 8-38 — see §10 for our 72-hour notice commitment.
• CAN-SPAM Act, 15 U.S.C. §§ 7701–7713 — every marketing-adjacent email we send includes an unsubscribe link, though we rarely send marketing email because we do not advertise.

This Policy is not legal advice; it is a description of our practices. If you need legal counsel regarding a specific privacy issue, please consult an attorney licensed in your jurisdiction.