Privacy Policy

This describes what this service stores, why, how long, and how to get it back or get rid of it. It is written from the database schema rather than from a template, so each item below is something that actually exists.

Who holds it

What we collect

• Your email address and handle, from signup. The handle is public; the email is not.
• Your state, optionally, because some states are excluded from some rounds.
• A shipping address and a recipient name, only when something is owed to you. This is the only place this service holds a real name and a real place. It is never published.
• Your bids, guesses, points movements and charges. These are the record of the auctions you took part in.
• Your chat messages, if you post in a round’s chat: what you typed, and what everyone saw, which is the same unless we hid a word. Our operators can see what you typed. Our server logs and error reports never include it.
• Card metadata — brand, last four digits, expiry. Card numbers never reach this service.Stripe collects them on Stripe’s own pages and gives us a token.
• A record of every email we send you: kind, subject, address, and whether it was delivered. Not the message body.
• Sign-in failures for an address, to slow down password guessing. Deleted when you sign in successfully.
• Server logs with a request id, the path and the status. Not request bodies.
• Which pages you visit, through Google Analytics: the page address, the site or campaign link that brought you here, your device and browser type, and a rough location Google works out from your connection. It sets a cookie on this site to tell one visit from the next. Nothing is sent from the password-reset and email-confirmation pages, because their addresses carry a one-time code.

What we do not do

• No advertising and no ad trackers. Google Analytics, above, is the one third-party script on this site, and it runs with Google signals and ad personalisation switched off.
• No tracking pixels in email. We do not measure whether you opened a message about your own money.
• We do not sell or rent your information, and there is no marketing send in this system — every email is the consequence of something you did.

Who else sees it

• Everyone who opens a round sees what you post in its chat, under your handle. Chat is public.
• Stripe processes payments and receives your email address and card details. We receive a token and metadata.
• Our email provider receives your address and the message, in order to deliver it.
• Google receives the page visits described above. It is not told who you are: no email address, account, bid or shipping address is sent to it. You can block it with Google’s opt-out add-on or any tracker blocker, and the site works the same without it.
• Error reporting, if enabled on a deployment, is configured to send no personal data.
• A shipping carrier receives the address on a parcel, because that is what a parcel is.

How long we keep it

• Password-reset and email-confirmation links are stored hashed, are single use, and are deleted once expired.
• Sign-in sessions are stored hashed and are deleted after they expire.
• Payment webhooks are kept as a record of what happened, and the full payload — which carries billing details — is discarded after 180 days, past the window a payment dispute can be raised in.
• Bids, guesses and points movements are kept indefinitely. They are the evidence that a round ran as described, and they are what the public bid ladder is built from.
• Chat messages are kept with the round they were posted in. After 90 days, a message with a hidden word keeps only what everyone saw, and a message we removed keeps no words at all. When we remove a message, our moderation log keeps a copy of what it said, and that log is not deleted. If we mute you in chat, we keep our reason for our own records; we tell you how long the mute lasts, not why.
• Page-visit data is held by Google, for the retention period set on our Google Analytics account.

Getting your data

Your profile has Download my data, which gives you a JSON file with your account, bids, guesses, charges, points, chat messages and shipping history — the same records this service holds, in one document, immediately.

Deleting your account

Your profile has Delete my account. Here is exactly what that does, including the part that is not a clean wipe:

• Removed: your shipping address and recipient name, your sign-in sessions and links, your sign-in failure counter, and any winner quote or photograph.
• Replaced with an anonymous marker: your email address, your handle, and the recipient address on the record of emails we sent you.
• Blanked:the words of every chat message you posted. The messages stay in their rounds as “from a deleted account”, with no handle and no words, so the conversations around them still make sense. Any message we had removed is still in our moderation log.
• Kept: your bids, guesses, charges and points movements, attached to that anonymous marker. They are the record of auctions other people took part in, the public bid ladder is built from them, and removing them would rewrite what happened rather than just who it happened to.
• Cards are detached at Stripe so nothing can be charged. Stripe keeps its own records of payments it processed.

We cannot delete an account while something is still owed to you and unshipped, while a settlement window is open, or while you have paid for a round and not guessed on it — in each case we would be throwing away the thing we need in order to finish. Each resolves within days and the refusal says which one applies.

Contact

Write to the address above. See also our Terms of Service.