Legal
Last updated: August 2026
Bid submissions: the product domain/URL, category, and bid amount you submit, plus your email address if you provide one for bid notifications.
Click data: when a visitor clicks a product link on the board, we record the target domain and the time of the click. This powers the public click counters. No IP addresses or device identifiers are stored for clicks.
Payment data: processed entirely by our payment providers (Stripe, and Polar.sh as a fallback). We never see or store full card numbers. We store a payment session reference and payment status.
Usage data: basic, privacy-respecting analytics of page visits.
To operate the leaderboard: rank bids, display click counts, and compute trending products.
To send transactional email: bid confirmations, payment receipts, and outbid alerts (via Resend).
To prevent fraud: rate limiting, idempotency checks, and duplicate-bid detection.
We never sell your personal data.
Contract performance: providing the bidding service you asked for.
Legitimate interest: operating the leaderboard and preventing fraud.
Consent: for any optional marketing emails (which you can withdraw at any time).
Stripe: payment processing (stripe.com/privacy).
Polar.sh: backup payment processing (polar.sh/privacy).
Supabase: database and hosting of your bid records (supabase.com/privacy).
Resend: transactional email delivery (resend.com/privacy).
Vercel: web hosting (vercel.com/privacy).
Bids are retained for as long as they are active and for a reasonable period afterward to resolve disputes and detect fraud.
Click counts are aggregated; individual click rows are retained indefinitely to keep counters accurate.
You may request deletion of your bid data at any time via [email protected].
Depending on your jurisdiction, you may have rights to access, correct, delete, or port your data, and to object to processing. To exercise them, email [email protected]: we respond within 30 days.
The Service does not use advertising cookies. We use minimal, privacy-respecting analytics without cross-site tracking.
The Service is not directed at children under 16. We do not knowingly collect their data.
We may update this policy; material changes will be posted here with a new "Last updated" date.
Privacy questions: [email protected].