Privacy Policy

1. Information We Collect

Depending on how you interact with forwarded.lol, we collect the following categories of information:

• Public Bidder Information: When you place a bid, you provide your brand/display name, target destination URL, optional tagline, and an optional logo image. This information is intended for public display on the leaderboard and for visitor traffic redirection.
• Billing & Transaction Information: We collect your email address to issue your payment receipt and verify the transaction with our payment provider. We do not collect, process, or store credit card numbers, CVVs, or bank account details on our servers.
• Automated & Technical Data: When you visit our website, our hosting provider (Vercel) automatically logs standard network information, such as your IP address, browser user-agent, operating system, and timestamp. This data is used solely for rate limiting, DDoS mitigation, and system health monitoring.
• First-Party Analytics Data: We collect anonymised, aggregated analytics to understand how visitors use the site. This includes:
  • The page path visited (e.g. /, /bid)
  • The referring domain (e.g. "google.com") or "Direct" if none
  • A coarse device type (desktop, mobile, or tablet) derived from your browser's User-Agent string
  • A two-letter country code derived server-side from your IP address (the raw IP is never stored)
  • Interaction events (e.g. clicking a bidder link or the "Place a Bid" button)

  No persistent identifiers, cookies, fingerprints, or cross-site tracking are used. All analytics data is processed and stored exclusively on our own infrastructure (Supabase) and is never shared with third-party advertising networks.

2. How We Use Your Information

We use the data collected for the following operational purposes:

• To rank and publish bids in real time on the public leaderboard.
• To execute automated HTTP redirects to the #1 bidder's designated destination website.
• To confirm payment success via secure webhooks from our payment processor.
• To prevent fraud, spam submissions, malicious URL injection, or denial-of-service attempts.
• To respond to support requests or inquiries sent to our contact addresses.

3. Third-Party Service Providers

We integrate with trusted third-party service providers to power specific functions of the platform. These providers process data in accordance with their respective privacy policies:

• DodoPayments: Handles all checkout sessions, payment processing, fraud detection, and tax compliance as the Merchant of Record.
• Supabase: Provides managed cloud database infrastructure (PostgreSQL) to store public bidder records and payment status.
• Cloudinary: Provides media storage and optimized CDN delivery for user-uploaded logo images.
• Vercel: Provides serverless hosting, edge routing, and SSL certificate termination.

4. Cookies & Tracking Technologies

We collect first-party analytics data (page paths, coarse device type, country code, and click events) directly within our own systems for site improvement purposes. This is described in detail in Section 1. We do not use cookies or localStorage for tracking purposes — analytics are recorded entirely server-side or via short-lived, in-memory JavaScript calls that do not persist any identifier on your device.

The only browser storage we use is transient session state required for the bidding interface and countdown timers (e.g. React component state), which is never persisted beyond your current page session.

5. Data Retention & Public Nature of Bids

Because forwarded.lol operates as a transparent public auction and historical wall of bidders, approved paid bids (including your submitted brand name, link, and logo) are retained indefinitely on the public leaderboard as part of the historical record.

Internal payment logs and webhook records are retained as required for tax compliance, accounting, and security audit purposes.

6. Your Rights & Data Correction

You have the right to request updates or corrections to your submitted bidder data:

• Link Correction: If your submitted destination URL changes domain or breaks, you may email us from the verified billing email address associated with the bid to request a destination link update.
• Content Removal: If you wish to have your brand removed from the public leaderboard for privacy or trademark reasons, contact our support team. Please note that bid amounts are non-refundable even upon voluntary removal.

7. Security Practices

We implement industry-standard security measures to safeguard data against unauthorized access, alteration, or disclosure. All communication between your browser and forwarded.lol is encrypted in transit using Transport Layer Security (TLS/HTTPS). Database access is restricted via server-side service keys and strict Row-Level Security (RLS) policies.

8. Children's Privacy

Our platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately so we can take appropriate action.

9. Contact Us

If you have any questions, comments, or concerns regarding this Privacy Policy or how your information is handled, please reach out to us at:

support@forwarded.lol