The short version
There are no user accounts on this site. Card details never reach this server. There are no advertising cookies and nothing here is sold or shared with advertisers.
This site does use Google Analytics to count visits and see which pages people read. That is a third party script, and it sets cookies in your browser. It is described in full below, along with how to refuse it. What else is stored is the listing you submitted, the record of the payment, and an IP address used to stop abuse.
What is stored
Listing data
For every listing: the normalised link, its title, its description, its category, its detected type, a copy of its icon downloaded to this server, the total amount paid, and the times of the first and most recent payments. All of this is public. It is what the board displays.
Titles and descriptions are read from the page you submitted, and you can edit them before paying. Do not put anything private in them.
Payment records
For every payment attempt: the listing it was for, the amount, the currency, its status, the identifiers Dodo Payments assigns to the checkout session and the payment, the times it was created and cleared, and the IP address the attempt came from.
Email address
If you give an email address during checkout so Dodo Payments can send a receipt, that address is passed back to this site with the payment confirmation and stored on the payment record. It is used to identify your payment if you contact support. It is not added to any mailing list, it is never sold, and no marketing is sent to it.
IP address
Your IP address is recorded on payment attempts and counted against short lived rate limit windows. It is used to limit how often a single address can call the preview, search and checkout endpoints, and to investigate fraud or abuse. Rate limit rows are deleted automatically after 24 hours. The IP on a payment record is kept with that record.
Session cookie
A session cookie is set, named bidmy_sess. It holds a session identifier used to carry a security token that protects forms against cross site request forgery, and to remember the preview you just requested so checkout does not have to trust data coming back from your browser. It is not an advertising cookie and it does not identify you. It expires when you close your browser.
Visitor counter
The count of people online and the total number of visitors shown at the top of the board come from a second first party cookie, named bidmy_vid. It holds a random number and nothing else. While a page is open your browser tells this site roughly once a minute that it is still here, and that is all it reports. The cookie lasts a year, is never shared, and is not used to follow you anywhere else.
When you click through to a listing, this site adds one to that listing's click count. Only the number is kept. There is no record of who clicked, and repeated clicks from the same connection within a few minutes count once.
Analytics cookies
Google Analytics sets its own cookies, named _ga and _ga_ followed by a measurement identifier. They hold a randomly generated number that lets Google tell one browser from another, so that two visits from you are not counted as two people. They are set on your first visit and last up to two years unless you clear them.
These are the only cookies on this site that are not strictly necessary for it to work. If you would rather not have them, any of the following prevents them: blocking third party scripts in your browser, using a content blocker, turning on Do Not Track in a browser that acts on it, or installing the browser add-on Google publishes for opting out of Analytics. The site works normally either way. Nothing is withheld from you for refusing.
Your light or dark theme preference is stored in your own browser using local storage. It never reaches this server.
Card details
Payment card details are handled entirely by Dodo Payments and never touch this server. This site never sees, receives, processes or stores a card number, expiry date or security code. When you click through to pay, you leave this site and enter Dodo Payments' checkout. Their handling of your data is governed by their own privacy policy.
Fetching the page you submit
When you submit a link, this server requests that page to read its title, description and icon. The request comes from this server, not from your browser, and it carries an ordinary browser user agent. The site you submitted will see this server's IP address in its logs, not yours. The icon is downloaded, checked, re-encoded and stored here, so the board never loads an image from a remote server.
Who else sees your data
- Dodo Payments processes payments and receives the amount, the return address and the listing identifiers needed to confirm the payment back to this site.
- The hosting provider stores the database and the server logs as part of running the site.
- Google Fonts serves the two typefaces this site uses. Your browser requests them directly from Google, which means Google receives your IP address as part of that request.
- Google Analytics counts visits. Your browser sends it the page you are on, the page you arrived from, your approximate location, and your device and browser type. Google shortens the IP address before storing it and this site has not enabled any advertising or audience sharing feature. It is used to see which pages are read and roughly how many people read them, nothing more.
Nothing is sold. Nothing is shared with advertisers. Data is disclosed beyond this only when the law requires it.
How long things are kept
- Listings and payment records are kept for as long as the site runs, because they are the ranking history the board depends on.
- Rate limit rows are deleted after 24 hours.
- Visitor counter rows are kept, because the running visitor total is counted from them. Each holds only a random identifier and the times of the first and most recent visit. No address and nothing that identifies you is stored with it.
- Analytics data is held by Google under their own retention settings, not on this server. This site keeps no copy of it.
- Admin sessions expire after 8 hours.
- Server error logs are kept only as long as they are useful for fixing faults.
Your requests
You can ask what is stored about a payment you made, ask for the email address on a payment record to be removed, or ask for a listing to be taken down. Write to contact@bidmy.app from the address used for the payment, or include enough detail to identify the payment.
The amount and timing of a payment cannot be erased while the listing is on the board, because those figures are the rank itself. Removing them would mean removing the listing.
Children
This site is not intended for anyone under 18 and payments should not be made by anyone under 18.
Changes
If this policy changes, the updated version is published on this page with a new date at the top.