Privacy policy

1. Who this applies to

It covers visitors, people who sign in, and anyone who pays for a listing. It applies worldwide. If a privacy law in your country (including India's Digital Personal Data Protection Act, 2023, or the GDPR) gives you extra rights, we honour those rights as they apply to us.

2. Data we collect

We collect only what we need to run the board, take payment, and keep accounts secure.

• Account data: email address, display name, and (if you use Google) your Google account ID. We use these to sign you in and to prove who owns a listing.
• Google account data (only if you tap Continue with Google): your Google user ID, verified email, and name. We request the openid, email, and profile scopes. We do not ask Google for your contacts, Drive files, Gmail, calendar, location, or advertising identifiers.
• Magic-link data: if you sign in by email, we store a short-lived hashed token and send one message to that address. We do not get extra data from Google in that flow.
• Email confirmation codes: when you claim a rank or board listing without signing in, we email a 6-digit code and store a short-lived hash of that code so we can confirm the mailbox.
• Placement data: the public name, role or organisation text, category, and link you put on the listing. That listing is shown on the homepage.
• Transaction data: amount, currency, purpose, status, time, and the payment reference from Cashfree or Razorpay. We do not store card numbers, CVV, expiry dates, or UPI PINs.
• Technical data: IP address, browser type, and basic device data used to run the site, set a session, and stop abuse.
• Support data: whatever you send to our email addresses.

3. How we use Google user data

When you sign in with Google, Google sends us an ID token after you approve the prompt. We read your Google user ID, verified email, and name from that token. We use that data only to:

• Create or find your Outbid Me account and keep you signed in.
• Match you to listings owned by that email so you can raise or manage them.
• Show your display name on the board where a listing is public.
• Send service messages about your account or a payment, if we have your email.

We do not use Google user data to build advertising profiles, to train unrelated AI models, to sell leads, or to contact people who have not signed in. We do not grant other apps access to the Google token. OutbidMe's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. Why we use other data

• To deliver the listing you buy and show it on the live board.
• To confirm payments, issue the refunds the Cancellation and Refund Policy allows, and keep payment records.
• To detect fraud and meet law that applies to us, including Indian tax and payment-aggregator rules.
• To answer support and grievance requests.

5. Legal basis

We use data to perform the listing contract, to comply with law, and to keep the platform secure. Signing in with Google is optional; you can use an email magic link instead. Buying a listing uses a 6-digit email code and does not require a signed-in session. Where a privacy law requires consent for an extra purpose, we will ask first. You can withdraw optional consent without undoing a listing already paid for.

6. Who we share data with

• the payment processor shown at checkout: to collect the listing price in your currency and process refunds. Card and UPI details stay on the processor’s PCI DSS systems. We send them the amount, currency, and a payment reference — not your Google password.
• Google: only to complete Continue with Google (authentication). We do not share your listing or payment history back to Google for ads.
• Hosting and operations providers under contract: Vercel (this website) and Microsoft Azure (the API, database, and session store). They process data on our instructions.
• Email delivery (GoDaddy / Workspace SMTP) when we send a magic-link sign-in message or a 6-digit listing confirmation code.
• Advisers, tax authorities, or law enforcement when the law requires it.

We do not sell personal data. We do not share Google user data with data brokers, independent ad networks, or other sign-in providers.

7. Storage, security, and retention

Account records (email, Google user ID, display name) stay while the account is open. Public listing text stays while that listing is on the board. Payment records stay as long as tax, accounting, and dispute rules require (often up to eight years in India). Magic-link tokens expire in ten minutes and are stored only as a hash. Email confirmation codes expire shortly after they are sent and are stored only as a hash. Session cookies are HttpOnly and last up to seven days, or until you sign out.

We do not store raw card data, CVVs, or your Google password. Access to production systems is limited to operators who run the service.

8. Cookies

We use first-party cookies that are needed to sign in and keep the site working. We do not use third-party ad cookies, and we do not run third-party analytics. To show the visitor counter, your browser stores a random ID in its own local storage and sends it to our API as a periodic heartbeat. That ID is not linked to your name, your account, or your payments, and we delete the records after two days.

• ow_session: keeps you signed in after Google or a magic link. HttpOnly.
• ow_oauth_state: a short-lived value used only during Continue with Google, then cleared.
• ow_theme: remembers light, dark, or match-system for the site appearance.

Blocking cookies in your browser will stop sign-in from sticking.

9. Your rights and how to delete data

You can ask to access, correct, or delete the personal data we hold, or get a copy of it, by writing to privacy@outbidme.world. We may need to verify it is you. Deleting an account removes the Google user ID and sign-in email from the account record. Public listing text already shown on the board may remain as part of the paid placement history unless the law requires us to take it down.

You can stop Google sign-in at any time in your Google Account under third-party access, at myaccount.google.com/permissions. That does not automatically delete the Outbid Me account; email us if you want that deleted too.

10. Children

The service is for people aged 18 or over. We do not knowingly collect data from children. If a minor has submitted data, contact privacy@outbidme.world and we will delete it.

11. Grievance officer

Complaints can go to the officer on our Grievance Redressal page. We acknowledge them within 48 hours and aim to close them within 30 days.

12. Changes

If we change how we use Google user data or other personal data, we will update this page and the “Last updated” date. Material changes to Google data use will be reflected here before we start that new use.

13. Contact

OutbidMe
https://www.outbidme.world
privacy@outbidme.world