Privacy Notice

NOTICE SCOPE

What this notice covers

This notice explains how Outbid.today handles personal data when you browse a mission, submit or refuel a product, complete Polar Checkout, use a private management or winner-claim link, contact us, or access administration tools.

Outbid.today is the controller for the processing described here. Listed product sites, Polar, TrendsFast, and other third-party services may act as separate controllers for their own processing under their notices.

INPUT TELEMETRY

Data we collect

• Submission data: product URL, normalized destination and domain, product name, pitch, favicon or fallback, and the information needed to recognize an existing product.
• Payment data: amount, currency, payment status, timestamps, Polar checkout, order, and transaction references, refund or dispute state, and the customer email Polar returns. Outbid.today does not receive or store full card details.
• Mission and exposure data: fuel totals, rank, milestone and overtake events, mission history, aggregated leaderboard and Radar impressions, outbound clicks, CTR, time in the top three or orbit, and winner or prize status.
• Self-reported outcome data: attributed revenue supplied through a valid product-management capability, the confirmed net-fuel snapshot used as its denominator, the resulting ROI, and report timestamps.
• Presence data: a random anonymous browser identifier stored locally, a derived session hash, and recent heartbeat timestamps while the page is visible. We do not use browser fingerprinting for presence.
• Technical and safety data: IP address and request metadata available in hosting or security logs, user agent, errors, suspected abuse, blocked domains, moderation records, and administrative access records.
• Private workflow data: hashed management, claim, or session-token material, claim status, fulfilment information, report URL if supplied, and correspondence with us.

PROCESSING PURPOSE

Why we use data

We process data to:

• create Checkout sessions and confirm, reconcile, refund, or dispute payments;
• identify products, prevent duplicates, calculate rankings, finalize missions, and preserve winner history;
• display paid products, activity, permanent profiles, exposure statistics, clearly labeled self-reported ROI, sponsored redirects, Radar rotation, share cards, and badges;
• measure live presence and aggregated impressions and clicks without inventing unavailable values;
• secure private links, administer Orbit Pack claims, and fulfil TrendsFast reports or promotional credits;
• detect prohibited destinations, manipulation, fraud, attacks, and violations of the Rules or Terms; and
• operate, troubleshoot, improve, document, and comply with legal obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement, legitimate interests in operating and securing the race, compliance with legal obligations, and consent where we specifically request it. You can withdraw consent without affecting earlier lawful processing.

PUBLIC SIGNAL

What becomes public

Product name, pitch, domain, favicon or initial, paid fuel, current and historical rank, mission activity, exposure statistics, lifetime totals, mission results, winner badge, non-private prize status, and a self-reported ROI claim may be publicly visible and preserved in permanent product or mission pages. A report is labeled self-reported and includes its report date. Because confirmed fuel and ROI are public, visitors may be able to infer the attributed revenue amount. Daily rank resets, but product history and winner legacy remain.

Customer email, full payment identifiers, private claim and management links, token hashes, internal moderation notes, and admin credentials are not intended for public display. Do not put personal or confidential information in a public product name, pitch, or destination URL.

ATTRIBUTION

Sponsored redirects and best-effort metrics

Paid product visits use an Outbid.today redirect that records an aggregate click and appends campaign parameters identifying Outbid.today, the mission, and an allowlisted placement such as leaderboard or Radar. Paid links are marked sponsored. The destination receives those parameters and ordinary web-request data under its own privacy practices.

Impression, click, presence, CTR, and time-based figures are operational estimates. We may deduplicate or filter bots and obvious abuse. Metrics may be delayed or missing, and we never substitute fabricated visitors, clicks, bids, activity, winners, testimonials, or reports.

MISSION PARTNERS

Service providers and disclosures

We disclose the minimum relevant data to providers that help operate the service:

• Polar hosts Checkout and processes payment, email, refund, and dispute information.
• Neon hosts the operational PostgreSQL database.
• Vercel hosts the application and may process request logs, deployment data, and privacy-conscious analytics.
• TrendsFast receives winner and product information needed to prepare a genuine report or assign promotional credits when its integration is configured or fulfilment is requested.

We may also disclose data to professional advisers, a successor in a business transaction, or authorities and rights-holders where reasonably necessary to comply with law, protect people or the service, investigate fraud, or address infringement. We do not sell personal data or share it for cross-context behavioral advertising.

LOCAL SYSTEMS

Cookies and browser storage

The public race can store a random anonymous browser ID locally to support the lightweight live-viewer heartbeat. Interface preferences, such as muted sound, may also be stored locally. This identifier is not designed to fingerprint you or follow you across unrelated sites.

A secure, HTTP-only cookie protects an authenticated admin session. Private management and claim capabilities rely on high-entropy links or tokens; server records store hashes where designed to do so. Essential security and session storage is used to provide the requested service, not for advertising.

DATA LIFETIME

How long data remains

Product pages, paid fuel records, lifetime statistics, completed mission results, activity records, winner records, and public badges can be retained long term because permanent legacy is a core feature. Payment and accounting records are retained as needed for reconciliation, disputes, tax, fraud prevention, and law.

A current self-reported ROI can remain with the public product profile until the product manager updates or removes it, or moderation removes it. The spend snapshot and timestamps remain fixed until an authorized update so later fuel does not silently rewrite an earlier claim.

Presence sessions are designed to be short-lived and stale heartbeat records are pruned lazily. Aggregated impression and click buckets can remain as product statistics. Expired pending submissions and claim capabilities can be removed or invalidated; proof of fulfilment and security records may remain as necessary. Hosting logs follow the host's configured retention.

A moderation removal can stop public access without erasing records we reasonably need for payment integrity, abuse prevention, disputes, or legal compliance.

ACCESS CONTROL

Security and private links

We use measures designed for the sensitivity of the data, including verified Polar webhook signatures, idempotent event processing, server-side validation, restricted admin sessions, destination allowlisting, hashed private tokens, and secret values kept out of browser code.

No system is perfectly secure. Treat management and claim URLs like passwords, do not forward them, and contact us if one is exposed. We will never ask you to email full card details or an admin password.

GLOBAL INFRASTRUCTURE

International processing

Providers may process data in countries other than your own. Where required, appropriate safeguards such as adequacy decisions or approved contractual terms are used for restricted transfers. Provider locations and safeguards can change as their infrastructure evolves.

YOUR CONTROLS

Privacy choices and rights

Depending on your location, you may request access, correction, deletion, restriction, objection, or portability, and may withdraw consent. You may also complain to your local data-protection authority. These rights can be limited by payment, recordkeeping, fraud-prevention, freedom-of-expression, and other legal requirements.

Send a request to hello@outbid.today. State the product or payment context, but do not send card details or private tokens by email. We may need to verify that you control the relevant email, product, or private capability before acting. You can clear the anonymous browser ID and preference data through your browser's site-data controls.

NOTICE CONTROL

Children, changes, and contact

Outbid.today is not directed to children, and paid participation is limited to people at least 18. If you believe a child supplied personal data, contact us.

We may update this notice as the service or law changes. The effective date will be revised, and material changes will be presented reasonably before they apply. Questions, rights requests, and privacy concerns can be sent to hello@outbid.today.