Privacy

Who this is

BidSurvivor is run by one person, at 15 Collins St, Melbourne VIC 3000, Australia. For anything in this page, including a request to see or delete what is held about you, the address is cyber.breach.space@gmail.com. It reaches a human, not a queue, and there is no form to fill in.

If you only visit

A cookie called bsv_visitor is set: a random identifier, no personal data in it, HTTP-only, one year. It exists so a bid placed without an account still belongs to somebody, and so the visitor counts on /stats are of people rather than page loads.

Against that identifier the site stores:

• Visitor — first seen, last seen, a page-view count.
• Event — one row per page view, brand card opened, click through to a brand’s own site, or bid form opened. Each carries the visitor id, which brand, which slot and the UTC day. Nothing else.

No IP address is stored. No advertising or analytics tracker runs on the board, and there is no Google Analytics anywhere on this site. Your browser also keeps your theme, sound and haptics preferences in local storage — those never leave your device.

If you bid

• The URL you gave, and the brand name, logo, description and category read from that page.
• An email address, only if you type one. It is optional on the quick form. It is used to tell you when somebody outbids you or when a slot you held closes, and for nothing else.
• The bid — amount, slot, time, and whether it won.

Card details never reach this server. The payment form is Stripe’s own, running in an iframe; what is stored here is Stripe’s identifier for the payment and nothing else. Nobody at BidSurvivor can see your card.

If you have an account

Sign-in is handled by Clerk. This site stores your Clerk id, your email address and your username, so that credit and bids can be attached to an account rather than a browser. No password is ever sent to, stored by, or logged by this application — Clerk handles all of it, and password changes happen on Clerk’s own form.

If we emailed you and you never asked us to

Some brands are placed on the board by us rather than by their owners, and those companies get one message telling them so. If that was you, this is where the address came from:

• Usually your own website. A published contact address, read from your contact or home page.
• Sometimes Prospeo, a B2B contact database, and only when your site publishes no address we could find. The email itself says so when this is the case. What is held is a name and a work address — nothing else, and nothing is passed on.

The lawful basis is legitimate interest: telling a company that its logo is on our page. You can object at any time, and the link in the email does it in one click, with no reply and no account. That click removes the listing, stops any further email, and marks the domain so it is not placed again.

Who else receives anything

• Clerk — sign-in. Your email and username.
• Stripe — payments. Your card, directly from your browser, plus a receipt address if you gave one.
• Resend — email delivery. The address a message is going to, and its contents.
• OpenRouter — reads a brand’s public website to write its one-line description. Public page text only; never anything about a visitor.
• Serplify — search-result data used to find candidate brands. Domains, not people.
• Prospeo — as described above.
• TinyAdz — advertising on the writing, about, FAQ, contact and brand pages. Never on the board itself. Like any ad network it sees the request its own script makes.

Nothing is sold. Nothing is shared for anyone else’s advertising. There is no data broker on the receiving end of this site.

How long things are kept

• Bids and won slots — permanently. The board is a public record of what was paid for what, and the Hall of Survivors would be a lie if entries could be withdrawn. A brand name and a slot are not deleted.
• Email addresses — until you unsubscribe or ask. An unsubscribed address is kept as a one-line suppression record, because the only way to reliably never write to somebody again is to remember not to.
• Visitor and Event rows — kept while the numbers on /stats are being reported.

What you can ask for

Email cyber.breach.space@gmail.com and you can have: a copy of everything held about you, a correction, deletion of your account and personal data, or an objection to any email. There is no form and no verification hoop beyond replying from the address in question. It is one person reading it, so allow a couple of days.

The one thing that cannot be undone is a public bid that won a slot, for the reason above. Everything else goes.

Changes

When this page changes it is because the code changed. It is written from the schema, so if something here disagrees with what the site does, the page is the thing that is wrong — say so and it will be fixed.