Privacy

Who this is

BidSurvivor is run by one person, at 15 Collins St, Melbourne VIC 3000, Australia. For anything in this page, including a request to see or delete what is held about you, the address is cyber.breach.space@gmail.com. It reaches a human, not a queue, and there is no form to fill in.

If you only visit

A cookie called bsv_visitor is set: a random identifier, no personal data in it, HTTP-only, one year. It exists so a bid placed without an account still belongs to somebody, and so the visitor counts on the front page are of people rather than page loads.

Against that identifier the site stores:

• Visitor — first seen, last seen, a page-view count.
• Event — one row per page view, brand card opened, click through to a brand’s own site, or bid form opened. Each carries the visitor id, which brand, which slot and the UTC day. Nothing else.
• Resolved location — the IP address a request arrives from is read once, sent to a lookup service (ipinfo.io) to resolve a coarse city, region, country and time zone, and then discarded — the address itself is never written anywhere, on a visitor row or a signed-in account. Re-resolved at most once a week. It is what lets the admin troubleshoot where activity is coming from, and — for a marketer’s own account — what schedules their daily referral report at their own local morning rather than a fixed hour picked for everyone.

Your IP address itself is never stored — see Resolved location above for the one thing it is used for and immediately discarded after. There is no Google Analytics anywhere on this site. Your browser also keeps your theme, sound and haptics preferences in local storage — those never leave your device.

Microsoft Clarity runs on every page for session replay and heatmaps — it is the one analytics tracker on the site, added to see where people actually get stuck rather than guess. It sets two cookies, _clck (one year, ties your sessions together) and _clsk (one day, ties events within a session), and records page interactions — clicks, scrolls, mouse movement — but never form field values or payment details, which never reach this server either way. Microsoft’s own retention and processing terms apply to what it holds; see Clarity’s privacy page for the specifics. Block it the same way you would any tracker — an ad blocker or a browser privacy setting stops it like any other third-party script.

If you bid

• The URL you gave, and the brand name, logo, description and category read from that page.
• An email address, only if you type one. It is optional on the quick form. It is used to tell you when somebody outbids you or when a slot you held closes, and for nothing else.
• The bid — amount, slot, time, and whether it won.

Card details never reach this server. The payment form is Stripe’s own, running in an iframe; what is stored here is Stripe’s identifier for the payment and nothing else. Nobody at BidSurvivor can see your card.

If you have an account

Sign-in is handled by Clerk. This site stores your Clerk id, your email address and your username, so that credit and bids can be attached to an account rather than a browser. No password is ever sent to, stored by, or logged by this application — Clerk handles all of it, and password changes happen on Clerk’s own form.

If we emailed you and you never asked us to

Some brands are placed on the board by us rather than by their owners, and those companies get one message telling them so. If that was you, this is where the address came from:

• Usually your own website. A published contact address, read from your contact or home page.
• Sometimes Prospeo, a B2B contact database, and only when your site publishes no address we could find. The email itself says so when this is the case. What is held is a name and a work address — nothing else, and nothing is passed on.

The lawful basis is legitimate interest: telling a company that its logo is on our page. You can object at any time, and the link in the email does it in one click, with no reply and no account. That click removes the listing, stops any further email, and marks the domain so it is not placed again.

Who else receives anything

• Microsoft Clarity — session replay and heatmaps, as described above. Page interactions and the two cookies named above; never form values or payment details.
• Clerk — sign-in. Your email and username.
• Stripe — payments. Your card, directly from your browser, plus a receipt address if you gave one.
• Resend — email delivery. The address a message is going to, and its contents.
• ipinfo.io — resolves the IP address a request arrives from into a coarse city, region, country and time zone. Sent only the IP address, once per resolution; nothing else about you or your account, and the address is never sent back or stored here.
• OpenRouter — reads a brand’s public website to write its one-line description. Public page text only; never anything about a visitor.
• Serplify — search-result data used to find candidate brands. Domains, not people.
• Prospeo — as described above.
• TinyAdz — advertising on the writing, about, FAQ, contact and brand pages. Never on the board itself. Like any ad network it sees the request its own script makes.

Nothing is sold. Nothing is shared for anyone else’s advertising. There is no data broker on the receiving end of this site.

How long things are kept

• Bids and won slots — permanently. The board is a public record of what was paid for what, and the Hall of Survivors would be a lie if entries could be withdrawn. A brand name and a slot are not deleted.
• Email addresses — until you unsubscribe or ask. An unsubscribed address is kept as a one-line suppression record, because the only way to reliably never write to somebody again is to remember not to.
• Visitor and Event rows — kept while the published numbers are being reported.

What you can ask for

Email cyber.breach.space@gmail.com and you can have: a copy of everything held about you, a correction, deletion of your account and personal data, or an objection to any email. There is no form and no verification hoop beyond replying from the address in question. It is one person reading it, so allow a couple of days.

The one thing that cannot be undone is a public bid that won a slot, for the reason above. Everything else goes.

Changes

When this page changes it is because the code changed. It is written from the schema, so if something here disagrees with what the site does, the page is the thing that is wrong — say so and it will be fixed.