Security

Last updated: October 4, 2026

To bid for you, SniperMate needs access to your ShopGoodwill account. We take that seriously. This page explains how we protect it, in plain language.

Your ShopGoodwill password is never stored

When you connect ShopGoodwill, your password is encrypted and sent once to ShopGoodwill to sign you in. We never save it. We keep only the session that ShopGoodwill issues, which lets us place your bids.

Your ShopGoodwill session is encrypted

  • The session is encrypted with AES-256-GCM before it is saved.
  • The encryption key is kept apart from the database, so a copy of the database alone cannot be decrypted.
  • Each encrypted session is tied to your account and cannot be used with any other.
  • It is never sent to your browser.
  • Disconnecting ShopGoodwill deletes it immediately.

Your SniperMate password

Your SniperMate password is stored only as a one-way hash, so nobody, including us, can read it. If you sign in with Google, there is no SniperMate password at all; we check Google's signed confirmation instead.

Payments

Card payments are entered on a secure form provided by Stripe and go directly to Stripe. Your card details never reach our servers.

How the service is built

  • Every page is served over HTTPS.
  • The website has no direct access to our database. Every request goes through our API, which checks it before reading or changing anything.
  • Connections between our own servers also use HTTPS, with certificates verified.

Protecting against abuse

  • You must verify your email address before you can schedule snipes or buy Snipe Wins.
  • Verification and password-reset emails are rate limited.
  • Our contact form has spam checks and rate limits.

What we don't do

We do not sell your data, and we do not use analytics, advertising or tracking cookies. Our Privacy Policy explains exactly what we collect and why.

Reporting a security issue

If you believe you have found a security problem, please email [email protected] with the details. Please do not access other people's data or disrupt the service while looking into it.

No system is perfectly secure, but we limit what we keep and protect what we hold.