Privacy Policy

The data controller for this Service is the operator of outbid.day (see our Terms of Service for the named operator). Privacy questions and rights requests can be sent to hello@outbid.day. We respond within 30 days.

We use first-party cookies only: a session cookie for CSRF protection on form submissions, a preference cookie that records your light/dark theme choice, and an analytics cookie set by our privacy-respecting analytics provider. We do not use third-party advertising cookies and we do not sell personal data.

We process your data to: (a) publish the listings you create on the public leaderboard; (b) operate the leaderboard, the daily archive, and the all-time Hall; (c) detect and prevent abuse, fraud, and Terms violations; (d) respond to rights-notice and support requests; and (e) produce aggregated analytics about Service usage. We do not build advertising profiles, we do not send marketing emails, and we do not share data with data brokers. Stripe’s payment-receipt email is the only transactional email associated with a claim.

When you create a listing, the display name and tagline we parsed from your URL’s public Open Graph metadata, the product URL, favicon, current rank, and current price are visible to anyone visiting the Service. We do not store or display any buyer email on the public site. If you reclaim a higher rank, the public record of who held that slot at a given moment is preserved in the daily archive.

We share data only with the infrastructure providers that operate the Service: (a) Stripe — to process payments; (b) our database and hosting provider — to store listings, bids, and webhook payloads; (c) our analytics provider — to measure aggregate usage. Each provider receives only the data necessary to perform its function and is bound by its own privacy obligations. We do not sell personal data, and we do not share data with advertising networks.

We retain listing and bid records for 7 years to substantiate gross revenue under U.S. tax law (IRC §6501 statute-of-limitations floor). After that window, listings remain in the public daily archive as historical record but are no longer linked to bid rows for accounting purposes. We do not store buyer emails on our infrastructure; the email you type at Stripe Checkout is retained only by Stripe under stripe.com/privacy.

Depending on where you live, you may have rights to access, correct, port, or delete the personal data we hold about you, and to object to or restrict certain processing. We collect very little personal data on our infrastructure (see “What we collect” above), so most requests will turn out to be no-ops — that’s by design. To exercise any of these rights, email hello@outbid.day with the URL of the listing you’d like us to act on plus any context that helps us identify the relevant record (a screenshot of the product page, the Stripe receipt address, or any other identifying detail). We respond within 30 days.

The Service is not directed to children under 13 (or under the relevant minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has created a listing, contact hello@outbid.day and we will delete the listing.

We may update this Privacy Policy as the Service evolves. The effective date at the top of this page reflects the most recent revision. Material changes will be announced on the homepage for at least 14 days before they take effect.