Outbid the Outbid decides how your personal data is used (it is the "controller", or "data fiduciary" under Indian law). Contact: [email protected].
1. What we collect
- Account. Your email address, and a display name taken from it. If you sign in with X, your X name, handle and profile picture as X sends them. We do not use passwords.
- Listing. The name, link, one-line pitch and optional X handle you choose to show on the throne. This is public by design.
- Purchases. The pack you bought, the amount and currency charged, the time, the status, and the payment reference from our payment processor. We never receive or store your card number or other payment credentials.
- Payment notifications. When a payment, refund or dispute happens, our payment processor sends us a notification, and we keep a copy to fix problems and answer disputes. Besides the purchase it names, a notification can include your name, billing address, the type of card and its last four digits. It never contains the full card number.
- Play. Your credit balance and its history, the reigns you held, their price, duration and click counts.
- Notifications. Whether you want an email when you are dethroned, and when we last sent you one. If you turn on notifications in a browser, the delivery address that browser gives us (an address at its push service, with the keys to encrypt messages to it) and the browser's user agent, so you can tell your devices apart.
- Sessions and security. When you sign in we store your IP address and browser user agent with the session, to keep accounts secure, and to limit abuse we count sign-in, checkout and claim requests per IP address for up to a day. Our web server and our network provider keep short-lived request logs that include IP addresses.
Clicks on a throne link are counted as a number only. We do not record who clicked. The "watching" counter is a count of open connections and is not stored.
2. Cookies
One kind: the cookies that keep you signed in. They are strictly necessary, so there is no consent banner. We set no advertising, analytics or social-media cookies, and we load no third-party scripts or fonts.
3. Why we use it
- To run your account, your wallet and the throne, which is performing our contract with you.
- To send sign-in links and messages about your account, such as a notice that you were dethroned. Dethroned emails and notifications can be turned off at any time, from your account page or from the link in each email.
- To take payments, handle refunds and disputes, prevent fraud and abuse, and keep the site secure, which is our legitimate interest and in part a legal duty.
- To keep the accounting and tax records the law requires.
We do not sell personal data, and we do not use it for advertising or profiling.
4. What is public, permanently
Taking the throne publishes your listing's name and link, the price, the start and end of the reign and its click count in the Chronicle, the Hall of Fame and the Ledger. These records are kept permanently: an honest, unedited history is the point of the site. Your email address is never shown. On the Ledger, a purchase is labelled with your listing name, or failing that your display name or the part of your email before the @. If a record shows your personal name and you want it gone, write to us and we will replace the name and link in the public record with a placeholder; the reign itself stays.
5. Who we share it with
- Dodo Payments, our merchant of record, who processes your payment and handles tax. They receive your email and the purchase details, collect your billing and card details themselves, and are an independent controller of that data under their own privacy policy.
- Resend, who deliver our emails and so process your email address.
- Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser), only if you turn on notifications. It relays each notification to your device; the message is encrypted for your browser, so the service cannot read it.
- Cloudflare, who sit in front of the site for security and speed and so process request data including IP addresses.
- Our hosting provider, on whose servers the site and its database run.
- X, only if you choose to sign in with X.
- Authorities, where the law requires it.
These providers may process data outside your country, including in the United States, the EU and India, under their own safeguards for international transfers.
6. How long we keep it
- Account and listing: until you ask us to delete the account.
- Sessions: until they expire or you sign out. Server logs: up to 30 days.
- A browser's notification address: until you turn notifications off there, sign out in that browser, or the browser withdraws it.
- Payment notifications: their contents are deleted after 180 days. A line recording that the notification arrived, and what it led to, is kept with the purchase records.
- Purchase and credit records: as long as tax and accounting law requires, which can be up to 8 years, even after the account is deleted.
- The public record of reigns: permanently, as described in section 4.
7. Your rights
Wherever you live you can ask us for a copy of your data, to correct it, or to delete your account. Under the GDPR and UK GDPR you can also object to or restrict processing, ask for your data in a portable form, and complain to your data protection authority. Under India's Digital Personal Data Protection Act you can additionally nominate someone to exercise your rights, and raise a grievance with us and then with the Data Protection Board. California residents: we do not sell or share personal information.
To use any of these, write to [email protected] from your account email. We reply within 30 days. Deleting an account gives up any credits left in it, because credits cannot be paid out.
8. Age
The site is for adults. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.
9. Security
Traffic is encrypted in transit, sign-in is by single-use emailed link, payment details stay with the payment processor, and access to the database is restricted. The few people who administer the site can see account, purchase and session records in order to run it, moderate listings and handle payments; what they do there is logged. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.
10. Changes
If this policy changes we update this page and its date. If a change is material we announce it on the site before it takes effect.