Privacy Policy
Outbid takes no account and asks for no details. This says what little is held anyway when you look at the board or pay for a place on it, who else processes it, and how to get it back or get rid of it.
- Last updated
- 23 August 2026
- Applies to
- outbid.awesomeindie.com
Who we are
Outbid is at outbid.awesomeindie.com, run by Awesome Indie, an independent project owned and operated by its founder, Diogo Capela. For data protection purposes we are the controller of the personal data described here.
Write to [email protected] about anything in this document, including a postal address if you need one in writing.
What this policy covers
This covers the board at outbid.awesomeindie.com and its own API. The directory at awesomeindie.com is a different site with accounts, profiles and email, and it has its own Privacy Policy. The two share a database and nothing else, and being signed in over there does not sign you in here.
It does not cover the products on the board. Those are other people's websites, and the moment you click through you are on their terms and their privacy policy rather than ours.
There is no account
Bidding here is anonymous by design. There is no sign-in, no registration and no profile, and browsing the board identifies you to us in no way at all.
What we collect
The address you submit
The URL, its host, and the verdict our AI reached about it. That is kept whether or not you go on to pay, because re-reading the same page for every attempt would be slow for you and expensive for us. A stored verdict is reusable for 24 hours.
The row written for it
The product name, the one line description, the category you picked and the address of the site's icon. Once a listing is live, all of that is public.
Your payment
The payment itself happens on Polar. What comes back to us is the order reference, the checkout reference, the amount that cleared, the currency, and the email address you gave Polar. If Polar recognises you as a customer it has already linked to a directory account, we also receive that account identifier. We never receive or store card details.
Analytics
Every page loads Google Analytics, measurement id G-HGV8ZBJFX2, which is the same stream awesomeindie.com reports into. What it sends to Google is the page you are on, a rough location worked out from your IP address, your device and browser, the site that referred you, and a random number in a cookie that tells a returning browser from a new one. It is used to see which parts of the board people read. The Cookie Policy lists the cookies and says how to refuse them.
Requests and rate limits
Your IP address arrives with every request, as it does with any website. We use it to rate limit the checkout and the click counter, in memory, so a burst clears on its own and nothing about it is written to the database. Our web server and Cloudflare keep short-lived request logs of their own.
Clicks
A click on a listing adds one to a counter on that listing. There is no row per click, no identifier and nothing attached to it that could point back at a person.
Error reports
When something breaks, we send ourselves a message on a private Telegram channel. It can contain the address you submitted and the technical detail of the failure, because that is what makes a bug fixable.
What your browser stores
One value, outbid.theme, remembering whether you chose light or dark. It stays in your browser and is never sent to us. The Cookie Policy covers it in full.
What we do not collect
No advertising network, no remarketing, no pixel belonging to a social platform, no session recorder and no fingerprinting. Google Signals is off, so what the analytics collect is never joined to anybody's Google account, and the analytics have no way to reach the email address on a payment: the two never meet. We do not sell or share data, because we do not have the kind anybody would buy.
Why we are allowed to hold it
| What | Why | Lawful basis |
|---|---|---|
| The address and the row | To publish the listing you paid for | Performance of a contract |
| The email and order references | To match a payment to a listing, and to handle refunds | Performance of a contract |
| The stored AI verdict | So re-checking an address costs nothing | Legitimate interests |
| What the analytics measure | To see which parts of the board are read, and what a change to it did | Legitimate interests |
| IP addresses in rate limits and logs | To keep the board up and stop abuse | Legitimate interests |
| Error reports | To find and fix faults | Legitimate interests |
Where we rely on legitimate interests, you can object. Clause 09 says how.
Who else processes it
| Who | What they get | What for |
|---|---|---|
| Polar | Your payment details and email address | Taking the payment as merchant of record, and the receipt |
| OpenRouter and the model it routes to | The address you submit and the text of that page | Judging the listing and writing its row |
| What the analytics send: page, rough location, device, referrer and a cookie identifier. Separately, a request from your browser for a site icon | Counting visits, and serving the icon shown on each listing | |
| Cloudflare | Your IP address and request headers | Serving the site and blocking attacks |
| OVH | Whatever the server holds, in Europe | Hosting the app and the database |
| Telegram | Error and event messages, which can include a submitted address | Our own private operations channel |
The icon beside each listing is fetched by your browser from Google's favicon service, so Google sees that request the way it would see any request for an image. Nothing about your visit is sent along with it by us.
What ends up public
A live listing is public, and that is what it is for: the product name, the description, the category, the icon, the address, the amount standing on it and the number of clicks it has sent. We also post about the board on our own social accounts, which can include naming the listing at the top of it.
The email address behind a payment is never published, never shown on the board, and never given to another bidder.
How long we keep it
A listing stays while it is live. A listing that is removed, or refunded down to nothing, stops being shown but its record stays with the payment it belongs to.
Payment records are accounting records and are kept as long as the law requires, which is years rather than months. Polar keeps its own copy under its own policy. Stored AI verdicts and error messages are kept while they are useful and cleared when they are not.
What the analytics collect is held by Google under Google's own retention setting for the property, and the cookies behind it expire two years after your last visit. Clearing them, or using any of the ways to refuse them in the Cookie Policy, ends it sooner.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to a use based on legitimate interests, or ask for it in a portable form. Email [email protected] and a person will answer.
Because nobody signs in here, we may have to ask for something that ties you to the payment before we act, such as the order reference or the email address you used. That is a protection for you rather than an obstacle: without it, anyone could ask us about anybody's listing.
We cannot delete a payment record while we are required to keep it, and taking a listing down does not undo the payment that put it up. If you are in the EU or the UK you can also complain to your national data protection authority, though we would rather you gave us the chance first.
Where the data goes
The server and the database are in Europe. Polar, OpenRouter, Google, Cloudflare and Telegram are outside the European Economic Area, mostly in the United States, and those transfers rest on the standard contractual clauses or an adequacy decision, whichever their own terms provide.
Children
Outbid is not for children. You need to be at least 18 to bid, and we do not knowingly hold data about anybody younger. If you think we have, tell us and we will delete it.
Security
Everything is served over HTTPS, behind Cloudflare, on a server maintained by one person. Card details never reach us at all, which is the single biggest thing keeping this safe. That said, one person and one server is exactly what it sounds like, and we would rather say so than imply a security department that does not exist.
Changes to this policy
We may update this policy. The date at the top of the page is always the current version, and a material change will be announced on the board. Earlier versions are in the public git history of the site.
Contact
Anything about this policy, or about data we hold: [email protected]. For a takedown or a refund, [email protected] reaches the same person.