Privacy Policy

The operator of outbid.eco decides what is collected here and why, which under the NDPA makes it the data controller and under the GDPR the controller for readers that regulation covers.

Everything in this policy, including any request to see, correct or delete your data, goes to hey@outbid.eco.

The board is deliberately small, and so is this list. There are no accounts, no passwords and no profiles.

• What you submit. The website address or social handle you list, the category you put it in, and the amount you bid. Public metadata for that destination, such as its title, description and icon, is fetched so the listing is recognisable.
• Your claims. Each claim's amount, its rank, the round it paid into and the share set aside for the donation, kept for as long as the board exists. This is the ledger, and it is append-only by design.
• Request data. Standard web server records: IP address, user agent, the page requested and when. These are what any site receives by virtue of being fetched, and they are used to keep the board up and to stop abuse.
• Anything you send us. If you email a takedown, a category correction or a privacy request, that correspondence is kept as long as needed to answer it and to keep a record that it was answered.

Some things on these pages are served by other companies, so your browser contacts them directly and they learn your IP address. This is the full list.

• Bunny Fonts. The typeface is served by Bunny Fonts, a font host chosen because it sets no cookies and logs no personal data. Google Fonts is not used anywhere on this site.
• Google. Listing icons are served by Google's favicon endpoint, so your browser requests them directly and Google receives your IP address and user agent. Those requests are sent with no referrer at all, so Google is not told which page on this site you were on.

The .eco trustmark in the footer is served from this site's own servers rather than hotlinked, so displaying it sends nothing to anyone. Links out to a listing, to a partner or to a .eco profile are ordinary links: nothing is requested until you click one.

No advertising cookies, no tracking pixels and no cross-site identifiers. Your light or dark theme preference is stored in your own browser so the page does not flash the wrong one on the next visit. It never leaves your device and it is not an identifier.

Checkout is handled by Dodo Payments, the merchant of record for the sale, which also collects and remits any tax that applies. Card details and billing information are collected by them and never reach us. What we store is the confirmation that a payment succeeded and its amount, which is what places the ranking.

Visits are counted by Plausible, a cookieless analytics tool the operator runs on its own server rather than a hosted service. Your browser never contacts that server: the script is served by this site and what it counts is posted back to this site, which passes it on. So no domain you did not visit is asked for anything, and nothing is handed to a company.

It sets no cookies and gives you no identifier that persists. To tell a repeat visit from a new one within the same day it hashes your IP address together with your browser's user agent and a salt that is thrown away every 24 hours, so nothing links you across days or across sites, and the address itself is not stored. What is recorded is the page, where you arrived from, and your browser, operating system, device type and country.

The site is served by Cloudflare, which serves the site, encrypts the connection to it, and applies the rate limiting and bot filtering described below. Every request to this site reaches them before it reaches us, so they process the request data described above on our behalf. Your connection to the site is encrypted.

Two protections run there rather than in our own code. A limit on how often the same address may submit a listing or run a search, so one person cannot exhaust the board or our costs; and a check that a request came from a browser rather than a script. Both work by counting requests against your IP address for a short window. If you are over a limit, the check may show you an interstitial page or refuse the request outright. It is not a judgement about you and it clears by itself; if you find yourself blocked and should not be, email us at the address at the end of this page.

Read this one before you list. It is the part that cannot be undone afterwards.

Rank, amounts, listing names, descriptions, icons and destination links are public. Anyone can see them, search engines index them, and other people copy and repost them. Claims are permanent by design: the ledger is append-only, and a claim's amount and donation are a published financial record.

Do not list a destination whose contents you are not willing to have shown. Removing a listing from the board does not retract what was already public while it was up, and it does not remove the payment record, which has to be kept for accounting.

• To provide what you asked for. Creating or raising a listing, showing rank, and taking a payment are all performance of the agreement between us.
• Legitimate interests. Keeping the board fair and working: limiting how often one address can submit or search, telling browsers from scripts, debugging outages, defending legal claims. The first two are described under hosting below. You can object to these, as set out below.
• Legal obligation. Keeping tax, accounting and complaint records for as long as the law requires.

Your personal data is not sold, and it is not shared for advertising. Beyond the companies named above, it reaches others only in these cases:

• Professional advisers. Accountants and lawyers, where needed and under a duty of confidence.
• Authorities. Where the law requires it, or to establish or defend a legal claim.
• A successor. If the site is transferred or sold, the data needed to keep running it moves with it, under this policy.

Some of these companies are outside Nigeria and outside the European Economic Area. Where that is the case, transfers rely on the safeguards those processors provide, such as standard contractual clauses or an equivalent mechanism.

• Public listings and claims. For as long as the board exists. The ledger is a permanent public record.
• Payment and accounting records. For as long as tax and accounting law requires, and long enough to handle a dispute.
• Server records. Kept briefly, and only as long as useful for security, abuse prevention and debugging.
• Correspondence. As long as needed to answer it and to keep a record that it was answered.

Under the Nigeria Data Protection Act 2023 you can ask to see the personal data held about you, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. Where something was done on your consent, you can withdraw that consent at any time without affecting what came before.

Email hey@outbid.eco. We may need enough information to find your data, which for a listing usually means the address you submitted. If you are not satisfied with the answer, you can complain to the Nigeria Data Protection Commission.

One limit: content that is already public on your own website or profile is not made private by having appeared on this board, though you can always ask for the listing itself to be removed.

The GDPR and the UK GDPR apply where we offer this service to you. The lawful bases are the ones described above: contract for taking payment and placing a listing, legitimate interests for keeping the board fair and secure, and legal obligation for financial records.

You have the rights in Articles 15 to 22: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You may also lodge a complaint with the supervisory authority in the country where you live or work. Use the same address above, and we will answer within one month.

The board is for adults and is not directed at children. Personal data is not knowingly collected from anyone under 18. If you believe a child has used the site, write to us and the data we can identify will be deleted.

This policy changes when the site changes or the law does. The date at the top is always the current version, and a material change will be posted here before it takes effect. Sections that say a provider is not yet in use will be filled in with that provider's name, in this document, before it starts receiving anything of yours.