Payment and security

Hourden accepts USDT, USDC, BTC, ETH and LTC. There is no card rail. This is a deliberate choice: card processors classify this category as high risk, and a frozen processor account takes customer balances down with it. A crypto payment settles on the network, so a credited balance is not reversible by a third party.

Whatever coin you send is credited to your account as a US dollar balance at the rate quoted when the invoice was created. From that point the balance does not move with the coin price - a deposit of $50 stays $50 whatever Bitcoin does afterwards. Orders are charged against that dollar balance.

The order form sends a package id, a quantity and a link. It never sends a price. Whatever a browser claims something costs is ignored and the charge is computed from the catalog on the server. The debit and the order are written in the same database transaction, so there is no state where money left your balance and no order exists.

Not at sign-up, not at checkout, not in support. Delivery is always against a public profile or post address. There is no feature on this site that would work better if you handed over credentials, so there is no reason for us to have them.

An email address, a password hash, your balance, your orders and the links you submitted with them. Sign-in attempts are recorded with an IP address to stop brute force. Payments are recorded with the transaction reference. That is the whole list - there is no profile building and no third-party data purchase.

Hashed with bcrypt, never stored in a readable form, and never recoverable by us or by support. An account created through Google sign-in has no usable password at all. Sessions are cookie-based over HTTPS only, and the session identifier is regenerated the moment an account gains privilege, which is what stops session fixation.

You can ask for your account and its data to be removed. The data deletion page explains what goes, what has to stay for accounting, and how long it takes.