EFFECTIVE NOVEMBER 1, 2026
Your privacy.
Poacher is operated by Exitus Holding, LLC. This policy covers our website, app, alerts and account communications.
What we collect
We collect your email address, account settings, time zone, saved searches, links, requirements, matches and feedback. If you choose a password, we store a password hash. We also store sign-in and security records, including hashed network and device identifiers used to limit abuse.
Stripe collects your card details. Poacher receives payment identifiers, payment status and limited card information needed to show your saved payment method. We do not store your full card number or security code.
If you turn on text message alerts, we collect the mobile number you enter, the date, time and network address of your opt-in, the consent text you were shown, the alerts you chose to receive by text, and delivery and opt-out records for each message.
Our hosting and security providers process connection information such as IP addresses, browser details, request times and errors. We keep usage, payment and notification records so we can calculate charges, deliver alerts and resolve problems.
How we use it
We use this information to run your searches, evaluate potential matches, deliver notifications, manage your account and balance, prevent fraud and improve the reliability of the service. Your requirements and relevant source content may be sent to AI providers to build an alert or decide whether a result fits.
Reusable knowledge about a public website can improve later alerts. Your private search brief, account credentials and payment information are not published to other customers.
Service providers
We use Stripe for payments; Mailgun for email; Twilio for text messages; Google Workspace for support mail; Vercel, Fly.io, Neon and Tigris for hosting, data and backups; and OpenRouter and the selected model providers for AI processing. Depending on the source, requests may use providers such as DataImpulse, Bright Data or Browserless. When you connect Slack, Discord, ntfy or browser notifications, alerts are delivered through that service or your browser’s push service. If you allow optional measurement, Google Analytics, Google Ads and Meta receive the data described under Cookies. Operational alerts may go to our private Slack workspace. Providers receive the information needed for their part of the service. Processing may take place in the United States or other countries where they operate.
We do not sell personal information for money. If you turn on advertising measurement, Google and Meta may use their cookies to measure our ads and show you Poacher ads on other sites; some laws call this “sharing” for cross-context behavioral advertising. It stays off unless you turn it on, and Global Privacy Control keeps it off. We may disclose information when required by law, to protect rights and safety, or as part of a business transfer.
All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.
Cookies and local storage
The app uses cookies for sign-in, security and account continuity. The marketing site uses this browser tab’s session storage to preserve the search you are creating.
Privacy choices lets you accept or reject optional analytics and advertising measurement separately. Both stay off until you turn them on, and you can change them at any time. A random optional browser identifier lasts up to 30 days, and a separate cookie remembers your choice for up to 180 days.
Optional analytics records public page paths, recognized referral categories and registered campaign labels, and can connect those visits to your signup and first activated alert after you sign in. In the app, it also counts when you open a matching result’s original page. That stores the result’s internal ID, not its title or address. On poacher.io, Google Analytics may receive those public-page visits with its own cookies. Poacher may also send Google Analytics your signup and first activated alert, identified only by Google’s browser identifier.
Advertising measurement lets Google Ads and Meta set their own cookies on poacher.io to measure whether our ads led to your signup or first activated alert, and to show you Poacher ads elsewhere. If you arrived from a Google ad, Poacher stores Google’s click identifier and may report your first activated alert to Google Ads.
Neither option sends your search text, requirements, result titles, result addresses, email address or payment details to these services. Turning an option off stops new collection, deletes the identifiers Poacher stored for it, and asks Google and Meta to stop using their cookies on our site. Data already received by Google or Meta is governed by their policies.
Text message alerts
Text message alerts are optional and are never a condition of using Poacher. If you enroll a mobile number in the app, we use it only to send the alerts you set up and the service messages that go with them, such as the enrollment confirmation and replies to STOP and HELP. We do not send promotional text messages, and we do not sell, rent, share or transfer your mobile number, your opt-in data or your consent to any third party. Twilio delivers the messages on our behalf and receives your number and the message content for that purpose only.
Reply STOP to any text alert to end them; we send one message confirming that you are unsubscribed. Reply HELP for help, or contact us below. Text alerts are also turned off when you remove the number in notification settings or close your account.
How long we keep information
Saved alerts and results remain in your account until removed or the account is closed. Results older than 60 days are archived; archiving is not deletion. An unsigned signup draft expires after one hour. Sign-in codes expire after ten minutes, and expired challenges are removed by scheduled cleanup. Email content held for delivery is cleared after its delivery window expires.
Closing your account stops new checks and recharges immediately. We remove account content after pending work, payments and refunds have settled. Payment, accounting, consent and limited abuse-prevention records may remain where needed for financial obligations, disputes, security or legal requirements. Encrypted rolling backups are retained for 30 days; deletion records are reapplied if a backup is restored.
Google click identifiers are kept for at most 90 days after the click; measurement sent to Google and Meta is retained under their own settings. Text message consent and opt-out records are kept while a number is enrolled and afterwards only as long as needed to show that consent was given or withdrawn.
Your choices
You can change your details, pause alerts, turn off recharge, request an account export, remove an enrolled mobile number or close your account from account settings. Reply STOP to any text alert to end text alerts. For access, correction, deletion or another privacy request, contact us below. We may need to verify ownership before acting. You may also have rights under the laws where you live.
Poacher is intended for adults. Please do not submit children’s personal information, passwords for other websites, or sensitive personal information in search requirements.
Changes and contact
We update this page when our practices change. We will notify account holders of material changes that affect them.
Exitus Holding, LLC
279 Troy Rd, STE 9-146
Rensselaer, NY 12144, United States