Privacy Policy

This Privacy Policy explains how outbid.lol (https://outbid.lol) collects, uses, and shares information when you visit the site, click a listing, or pay for a ranking. It sits alongside our Terms of Service.

Who is responsible

The controller for personal data processed through the Service is Jonathan Wilke, an individual based in Germany.

• Email: contact@supastarter.dev
• X: @jonathan_wilke

What we collect

We keep the Service small. We collect only what we need to run the board, take payment, stop abuse, and understand traffic.

• Visitor identifier. A random ID in an HTTP-only cookie named outbid-visitor-id, stored for up to one year. We use it to attach a checkout to a browser, limit duplicate click counts, and keep the board usable. It is not your name.
• Checkout and listing data. The URL or X handle you submit, the category, bid amount, and the public name, description, and image we resolve for that destination. Payment confirmation identifiers from Polar (order and checkout IDs) are stored so we can place the ranking.
• Payment data. Card details and billing identity are collected by Polar, not by us. Polar may send us confirmation that you paid and a net amount. See Polar's own privacy notice.
• Clicks. When you visit a listing from the board, we may record the listing, a time, the visitor ID, and a hashed IP address. The hash is for rate limiting and fake-click reduction, not to profile you.
• Technical data. Standard request data such as user agent, referrer, and IP address may be processed by our host and by DataFast to operate and secure the Service.
• Messages you send us. If you email a notice, a category correction, or a privacy request, we keep that correspondence as needed to respond and to keep a legal record.

Cookies

The visitor-ID cookie is a strictly necessary cookie. It lets checkout and click protection work. We do not use it for advertising. Analytics on outbid.lol is loaded with DataFast's cookieless script. Your browser or device may also store a theme preference locally so the page can stay light or dark.

Why we use this data

• Contract. To take payment, create or raise a listing, show rank, and provide the Service you asked for.
• Legitimate interests. To keep the board fair (rate limits, bot filtering), display public listing metadata, measure visits, debug outages, and defend legal claims. You may object to processing based on legitimate interests as described below.
• Legal obligation. To keep tax, accounting, and complaint records where the law requires it.

Public listings

Rank, spend, names, images, descriptions, and destination links on the board are public. Anyone can see them, including search engines. Do not list a destination if you do not want that information shown. We fetch public metadata from the site or X profile you submit so visitors can recognize the listing. That fetch may disclose to the destination that outbid.lol requested the page.

Who we share data with

• Polar — checkout and payment confirmation.
• DataFast — cookieless visit and live-visitor counts. We also show a public stats page and may use an affiliate link to DataFast.
• Hosting, database, and edge infrastructure (currently including Vercel and Postgres) so the site can run.
• Identity lookup helpers (for example X profile and avatar services) so we can show a name and picture before and after checkout.
• Professional advisers, authorities, or a buyer of the Service if we must share data to comply with law, enforce the Terms, or transfer the project.

We do not sell your personal data. Some processors may be outside the European Economic Area. Where we rely on them, we use appropriate safeguards such as the processors' standard contractual clauses or an equivalent mechanism they provide.

How long we keep it

• Visitor IDs last up to one year in the cookie, or until you clear cookies.
• Public ranking entries stay while the listing is on the board and may remain in backups or activity history after a takedown for a limited time.
• Payment identifiers and amounts are kept as long as needed for accounting, tax, fraud, and dispute handling.
• Click records and IP hashes are kept only as long as useful for rate limiting, abuse prevention, and aggregate counts.

Your rights

If the GDPR or similar law applies to you, you may ask us to access, correct, delete, or export personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing was based on consent. You may also lodge a complaint with a supervisory authority, including in Germany or in your country of residence.

Email contact@supastarter.dev. We may need enough information to find your data. Public listing content that is also on your own website or X profile is not made private just by appearing on the board; you can ask us to remove the listing.

Children

The Service is for adults. We do not knowingly collect personal data from children. If you believe a child has used the Service, contact us and we will delete the data we can identify.

Changes

We may update this policy when the Service or the law changes. The date at the top of this page is the current version. If a change is material, we will post the updated policy here.