Privacy

Last updated 30 October 2026

This site shows a demo of Molehill, a monthly review for online shops, with six fictional brands. It holds no real shop's data. It is run by Rain Kask in Estonia, who decides what personal data it keeps (the controller) until Molehill's company is registered. Contact: hello@molehillapp.com.

What we keep, and why

• Accounts. For each account: its sign-in address, its password as a one-way hash (never the password itself), when it last signed in, and which brands it may see. A demo login has a made-up sign-in address and, so we know whom it was made for, a name we gave it, such as the person's or company's name. Staff accounts also keep the secret of their sign-in code app, encrypted. We keep this to let you sign in and to keep the demo to the people we invited; that is our legitimate interest.
• Sign-in protection. Failed sign-ins are counted per network address for a few minutes, to stop password guessing.
• Server logs. The server's technical logs can contain network addresses, for example of failed connections. They are used only to keep the site running and safe, and are deleted automatically within five weeks.

What we don't do

• No analytics, advertising or tracking, and nothing is sold or shared for marketing.
• The page's font and everything else come from this server, so your browser sends no request to anyone else.
• Two cookies only, both needed for signing in: a session cookie and a security (CSRF) cookie. No consent is needed for them.

Where it is kept

On a server in Helsinki, Finland (UpCloud), in the EU. Cloudflare answers name lookups for molehillapp.com and forwards emails sent to our addresses; it does not see the site's traffic.

How long

An account is kept while it is in use. A demo login stops working on its end date; we delete demo logins when you ask, or once we no longer need them for the demo.

Your rights

You can ask what we hold about you, and have it corrected or deleted, or object to its use: write to hello@molehillapp.com. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).