Privacy Policy

This describes what this service stores, why, how long, and how to get it back or get rid of it. It is written from the database schema rather than from a template, so each item below is something that actually exists.

Who holds it

What we collect

• Your email address and handle, from signup. The handle is public; the email is not.
• Your state, optionally, because some states are excluded from some rounds.
• A shipping address and a recipient name, only when something is owed to you. This is the only place this service holds a real name and a real place. It is never published.
• Your bids, guesses, points movements and charges. These are the record of the auctions you took part in.
• Card metadata — brand, last four digits, expiry. Card numbers never reach this service.Stripe collects them on Stripe’s own pages and gives us a token.
• A record of every email we send you: kind, subject, address, and whether it was delivered. Not the message body.
• Sign-in failures for an address, to slow down password guessing. Deleted when you sign in successfully.
• Server logs with a request id, the path and the status. Not request bodies.

What we do not do

• No advertising, no analytics, no third-party trackers on this site.
• No tracking pixels in email. We do not measure whether you opened a message about your own money.
• We do not sell or rent your information, and there is no marketing send in this system — every email is the consequence of something you did.

Who else sees it

• Stripe processes payments and receives your email address and card details. We receive a token and metadata.
• Our email provider receives your address and the message, in order to deliver it.
• Error reporting, if enabled on a deployment, is configured to send no personal data.
• A shipping carrier receives the address on a parcel, because that is what a parcel is.

How long we keep it

• Password-reset and email-confirmation links are stored hashed, are single use, and are deleted once expired.
• Sign-in sessions are stored hashed and are deleted after they expire.
• Payment webhooks are kept as a record of what happened, and the full payload — which carries billing details — is discarded after 180 days, past the window a payment dispute can be raised in.
• Bids, guesses and points movements are kept indefinitely. They are the evidence that a round ran as described, and they are what the public bid ladder is built from.

Getting your data

Your profile has Download my data, which gives you a JSON file with your account, bids, guesses, charges, points and shipping history — the same records this service holds, in one document, immediately.

Deleting your account

Your profile has Delete my account. Here is exactly what that does, including the part that is not a clean wipe:

• Removed: your shipping address and recipient name, your sign-in sessions and links, your sign-in failure counter, and any winner quote or photograph.
• Replaced with an anonymous marker: your email address, your handle, and the recipient address on the record of emails we sent you.
• Kept: your bids, guesses, charges and points movements, attached to that anonymous marker. They are the record of auctions other people took part in, the public bid ladder is built from them, and removing them would rewrite what happened rather than just who it happened to.
• Cards are detached at Stripe so nothing can be charged. Stripe keeps its own records of payments it processed.

We cannot delete an account while something is still owed to you and unshipped, while a settlement window is open, or while you have paid for a round and not guessed on it — in each case we would be throwing away the thing we need in order to finish. Each resolves within days and the refusal says which one applies.

Contact

Write to the address above. See also our Terms of Service.