Privacy

OPERATOR LEGAL NAME, OPERATOR REGISTERED ADDRESS, is the controller of the personal data described here. For anything on this page, including a request to see or delete what we hold, email privacy@paytowin.gg.

These operator details are not finished yet. Do not rely on this page until they are.

Everything, itemised. There is no other category.

• Your email address. Required to claim a spot. It is the only way back into your listing, because signing in is a link sent to it. Never displayed publicly, never sold, never used for marketing.
• Your listing. The name you claim, the handle derived from it, your featured link, any extra links, the category you pick and an avatar if you upload one. All of this is public, which is the point of it.
• Payment records. Amount, currency, the provider's reference for the payment, and where the chain exposes it, the paying wallet address and transaction hash. We never see or store card details, seed phrases or wallet credentials.
• Counting reads and clicks. When somebody views a profile or follows a link out, we record which listing, when, the referring page, and the browser's user-agent string, plus a one-way hash of the IP address. The hash exists so the same visitor is not counted twice and so obvious bots can be excluded.
• Reports. If you report a listing, we keep the reason and, if you give one, a contact so we can follow up. Reports are never shown publicly.
• Ordinary server logs kept by our hosting provider for security and debugging, on their retention schedule.

• Not your IP address. It is hashed with a server-side secret the moment it arrives and only the hash is written down. The hash cannot be turned back into an address, and the same visitor produces a different hash on a different deployment.
• No identity documents and no KYC. There is no verification step, no ID upload and no proof of identity anywhere in the product.
• No advertising or analytics third parties. No pixels, no ad network, no session recording, no cross-site tracking. The click counting described above is ours and stays on our own database.
• No profiling and no automated decisions that produce a legal or similarly significant effect on you.

• To run the thing you asked for. Your listing, your payments and your sign-in exist because you asked us to put you on the ladder. In GDPR terms, performance of a contract.
• To keep the board honest and working. Rate limiting, de-duplicating counts, filtering bots, and acting on reports. In GDPR terms, our legitimate interests in a functioning and non-fraudulent service.
• To meet obligations we cannot opt out of, such as keeping records of payments received and responding to a lawful request.

Public: your claimed name and handle, your avatar, your links, your category, your score, your rank, and the fact and amount of payments onto your listing as they appear in the live activity feed. The site also generates a share card carrying the same details.

Never public: your email address, anything you send us in a report, and the contact details of anybody who reports a listing.

Once something has been public, other people may have copied, screenshotted or cached it. Taking a listing down removes it from us. It does not reach into somebody else's screenshot.

We use a small number of service providers, each doing one job under contract:

• Vercel hosts the site and stores uploaded avatars.
• Supabase hosts the database.
• NOWPayments processes crypto payments. They receive the amount and an internal reference for your listing. They do not receive your email address or your name from us.
• Resend delivers the sign-in emails, so it processes your email address to send them.

We do not sell personal data, and we do not share it for advertising. We would disclose it if legally required, or to protect someone from harm.

Our providers operate internationally, so your data may be processed outside the country you are in, including in the United States. Where that involves a transfer out of the UK or the EEA, it relies on the standard contractual clauses or an equivalent approved mechanism in our agreements with those providers.

• Your listing and email: while the listing exists, and then deleted when it is removed.
• Payment records: kept after a listing is removed, for as long as we need them for accounting and legal reasons. These are records of money received and we cannot simply delete them on request.
• Click and view counts: hashed and aggregated, kept while the listing exists.
• Sign-in links: single-use and expire in minutes.
• Reports: kept after they are resolved, so a listing that is reported repeatedly is visible as such.

Depending on where you live you can ask us to show you what we hold, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. If you are in California, you also have the right not to be discriminated against for asking, and we confirm again that we do not sell or share personal information.

Email privacy@paytowin.gg and we will answer within a month. To take a listing down immediately without waiting for us, use /report.

If you think we have handled your data badly, you can complain to your local data protection authority. In the UK that is the Information Commissioner's Office.

One cookie, and only after you sign in. It is called cl_session, it holds a signed reference to your listing and an expiry date, it lasts 30 days, and it is what keeps you logged in. It cannot be read by JavaScript and it does not follow you to other sites.

There are no analytics, advertising or preference cookies, which is why this site does not ask you to accept any. Browsing the ladder sets nothing at all.

This site is for adults. It is not directed at anybody under 18 and we do not knowingly hold data about a minor. If you believe a minor has created a listing, tell us at privacy@paytowin.gg and we will remove it.

If we change what we collect or what we do with it, this page changes and the date at the top moves. If the change is significant and we hold your email, we will tell you directly rather than quietly editing this page.