Privacy Policy

The operator of this site runs it. This describes what is collected and why.

There are no accounts. You cannot sign in, because there is nothing to sign in to. That is the single most important fact on this page: almost everything below is either anonymous by construction or something you typed in on purpose.

What we store

• Bids: the project, the amount, the timestamp, and the rank the bid moved the project from and to. No identity is attached. Not a name, not an account, not an email — the table has no column for one. Bids are not anonymous because you asked for that; they are anonymous because nothing else was ever recorded.
• Payment records: the provider, the provider’s own reference for the checkout, the amount, and whether it settled. Card details never reach our servers — see Dodo Payments below.
• An email address, only if you give one. Two places ask, both optional: a notification address when you bid, so we can tell you if you are outbid; and a contact address when you submit a project, so a listing can be managed later. Neither is required to use the site, and neither is used for anything else — no list, no marketing.
• Click and visit counts: we store a salted hash of your IP address together with a date, used to count a click or a visit once per day. Raw IP addresses are not stored. The hash cannot be reversed to an IP address and rotates when the salt is rotated.
• Bug reports: what you write, plus the page URL, your browser’s user-agent string, a salted IP hash, and — where they exist — the payment reference or error identifier that the report is about. Those last two are the point: a report that says “I paid and nothing happened” is only actionable if it carries the payment reference. An email address here is optional and is used solely to reply.
• Analytics: the production site loads two counters, and neither runs on preview or staging deployments. Google Analytics sets a first-party cookie and reports page views, referrer and coarse location to Google — measurement of the site, not of you across the web; it is not linked to any bid, and we do not enable Google’s advertising or cross-site features on it. Cloudflare Web Analytics counts page views without setting a cookie and without identifying anyone. Both are there because they disagree: ad blockers stop one and not the other, so the gap between them is the honest measure of how much traffic each is missing.

What we do not do

• We do not sell personal data.
• We do not serve advertising, and we do not enable cross-site tracking or ad personalisation on the analytics above.
• We do not store raw IP addresses, anywhere, for any purpose.
• We do not link bids to people. There is no mechanism by which we could: the record does not contain one.

Email

Every address on this site is optional and given for one stated purpose — an outbid notification, a listing you can manage, or a reply to a bug report. Outbid alerts are off unless you ask for them, and since there is no account to manage, replying to one is how you stop them — the alert itself says so. Transactional email is sent via Resend.

Processors

• Vercel — hosting and request logs
• Supabase — database
• Upstash — rate limiting, keyed on the salted IP hash rather than the address
• Dodo Payments — payment processing, and the merchant of record for every bid. Dodo is the seller on your card statement and collects any sales tax due. Card details never reach our servers.
• Resend — transactional email
• Google — analytics (Google Analytics), on the production site only
• Cloudflare — analytics (Cloudflare Web Analytics), on the production site only. Cookieless: it sets nothing in your browser and does not identify you

Your rights

Write to support@unchainedlabs.dev and we will tell you what is held against any address or payment reference you can identify, correct it, or delete it.

Two honest limits on that. The bid and payment record is a permanent financial record and is retained as such — but since it carries no identity, there is nothing in it to attribute to you in the first place. And a salted IP hash cannot be searched for by IP address, because the hash cannot be reversed; it ages out on its own rather than being findable on request.

Contact

support@unchainedlabs.dev