Privacy policy

antioutbid.lol is a public record of a public leaderboard. It is built to need almost nothing about you, and this policy describes the little it does collect in plain terms rather than in the language of a form you are expected to skim.

Who is responsible

This site is operated by Sanganix AI (“we”, “us”). For privacy purposes we are the data controller under the EU/UK GDPR, the data fiduciary under India's Digital Personal Data Protection Act 2023, and a business under the California Consumer Privacy Act as amended.

Contact for any privacy matter, including requests and complaints: sagarkushwah2510@gmail.com. We do not have a statutory Data Protection Officer; requests go to the same address and are handled by a person.

What we collect, and why

1. A cookieless record of page views

This powers the “N online · M visitors” counter. For each page view we store:

• sha256(IP address + browser user-agent + a salt) — a one-way hash. The IP and user-agent themselves are discarded and never written down.
• The path you visited, the date, and the host of the referring site (never a full URL).

The salt changes every day. This is the important part: the same visitor produces an unrelated hash tomorrow, so there is no identifier capable of following anyone across days. It is also why our visitor count is a sum of daily figures rather than a true all-time total — we gave up the better number to avoid holding a durable identifier.

No cookie is set and nothing is stored on your device for this.

2. Third-party analytics (DataFast)

We use DataFast for aggregate traffic statistics. It is cookieless and privacy-focused, and the resulting dashboard is published openly — the same numbers we see. DataFast acts as our processor. See their own privacy notice for what they process on our behalf.

3. If you claim a placement

Payments are processed by Lemon Squeezy, who act as Merchant of Record. They are the seller for that transaction and an independent controller of the data you give them: your name, email, billing address and payment method. That information is collected on their checkout, on their systems.

Card and bank details never touch our servers. What we receive and store is limited to: the URL or handle you submitted, the amount, a Lemon Squeezy order identifier, and our own internal quote identifier. We do not store your name or email.

4. Public information about the link you submit

When a placement is paid for, our server fetches the submitted address once and reads its title, description and icon so the placement can be displayed. This reads only what any visitor to that page would see. It is information about a website, not about a person.

5. Server logs

Our web server and its protective services keep short-lived operational logs, which can include IP addresses, for security and abuse prevention — blocking automated attacks requires knowing which address is attacking. These are not used for analytics or profiling.

What we do not do

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. Under the CCPA that means there is no “Do Not Sell or Share” action to take, because the activity does not occur.
• We run no advertising network, no third-party ad pixels, and no data brokers.
• We do not build profiles, and no decision about you is made by automated means.
• We do not knowingly collect anything from children. See below.

Legal bases (EU/UK GDPR)

• Legitimate interests (Art. 6(1)(f)) for the cookieless view counter, aggregate analytics and security logging. Our interest is in knowing whether the site works and keeping it available; the impact is minimal because the data is aggregate and carries no durable identifier.
• Performance of a contract (Art. 6(1)(b)) for processing a placement you have paid for and displaying it.
• Legal obligation (Art. 6(1)(c)) where records must be kept for tax or accounting purposes — generally by Lemon Squeezy as the merchant of record rather than by us.

Because our analytics set no cookies and read nothing from your device, the consent requirement of the ePrivacy Directive does not arise, which is why you are not being shown a cookie banner. If that changes, you will be asked first.

How long we keep things

• Page-view records: retained in aggregate. Because the salt rotates daily, records older than a day cannot be linked to any later visit by design.
• Placement and payment records: kept while the placement is displayed and afterwards as an accounting record.
• Security logs: days to weeks, then rotated away.
• Leaderboard data about outbid.lol: kept indefinitely. It is a historical record of public business information and contains no personal data.

Where data goes

Our server is hosted in Oracle Cloud's India (Hyderabad) region. Lemon Squeezy and DataFast operate internationally, including in the United States. Where personal data leaves the EEA or the UK, transfers rely on the mechanisms those providers put in place, generally the European Commission's Standard Contractual Clauses.

Your rights

If you are in the EU, EEA or UK

You have the right to access your personal data, to have it corrected or erased, to restriction, to portability, and to object to processing based on legitimate interests. You may also complain to your national supervisory authority — you do not have to contact us first, though we would rather you did so we can fix it.

If you are in India

Under the DPDP Act 2023 you may request access to a summary of your personal data and its processing, request correction, completion, updating or erasure, nominate another person to exercise your rights in the event of death or incapacity, and use our grievance redressal route. The address above is that route; we will respond within the period the Act requires. If unresolved, you may approach the Data Protection Board of India.

If you are in California or another US state with a privacy statute

You may request to know the categories and specific pieces of personal information we hold, request deletion, request correction, and opt out of sale or sharing — noting that we do neither. We will not discriminate against you for exercising any of these rights. We do not offer financial incentives for personal information.

A limit worth stating honestly

For the page-view counter we hold a daily, salted hash and no identifier you could give us to match against it. That means we usually cannot find “your” rows even if you ask us to. This is the intended consequence of not holding identifiers, not an excuse to avoid a request — for anything we can identify, such as a placement you paid for, we will act. For payment data held by Lemon Squeezy, contact them directly, and tell us if you would like help doing so.

Children

This site is not directed at children and placements may not be purchased by anyone under 18, or under the age of majority where they live. We do not knowingly collect personal data from children. India's DPDP Act requires verifiable parental consent for anyone under 18; we address this by not offering the service to them at all. If you believe a child has provided data, write to us and we will delete it.

Security

The site is served over HTTPS only. Administrative access requires a key, automated intrusion attempts are blocked, and secrets are held outside the codebase. No system is perfect, and we would rather say that than claim otherwise.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how we use data already collected, say so prominently on the site rather than quietly editing the page.

Related

See the terms for how placements work, the no-refund position, and why this is a leaderboard rather than a game of chance. See about for how the data is collected.