Privacy policy

If you buy a listing: the URL you submit, the title, description, image and category you write, and the amount and status of your payment. This is the listing itself — most of it is published on the board on purpose.

If you visit or click a listing: we count the visit and the click. Your IP address and browser user agent are hashed with a secret salt before they are stored, so what we keep cannot be read back as an IP address. We keep them in that hashed form to detect click fraud and to make rate limiting work.

We do not collect: your name, email address, postal address, phone number, date of birth, or any payment credential. We never see your wallet details or your card details, because we never handle them.

We use no advertising cookies, no analytics cookies, and no third-party trackers. The only cookie the Service sets is a session cookie for site administrators. Your age confirmation is stored in your browser's local storage on your own device and is never sent to us.

• —NOWPayments processes payments. When you pay, you are on their page and under their privacy policy. They tell us only that a given order was paid, and we never receive your payment credentials.
• —Supabase hosts the database and the listing images.
• —Vercel and Cloudflare serve the site and filter malicious traffic. They process request metadata, including your IP address, to do that.
• —Cloudflare Turnstile runs the bot check on the submission form.

• —Listings are permanent by design — a listing is a public record of an advertising placement.
• —Payment records are kept as long as required for accounting and dispute handling.
• —Hashed click and visit records are kept for up to 24 months, then deleted.

Depending on where you live you may have rights to access, correct, or erase personal data we hold about you, or to object to our processing of it. Because we collect so little and hold no account, in practice this usually concerns a listing you purchased.

A listing is a published advertisement and a record of a commercial transaction, so we may decline to erase one while we have a legitimate or legal reason to keep it — but we will always tell you why.

To make a request, use the contact page. Include the listing URL so we can find it.

The Service is not for anyone under 18 and we do not knowingly collect anything from a minor. If you believe a minor has submitted something to us, contact us and we will remove it.

Payment webhooks are cryptographically signature-verified, uploaded images are re-encoded before storage, and database access is restricted to our own server. No system is perfectly secure, but we do not hold the kind of data that would make a breach valuable — because we never collected it.

If this policy changes, the revised version appears here with a new date above.