The Index / privacy

Privacy

What we hold, why, for how long, and who else sees it. Nothing here is boilerplate; each item was checked against what the software does.

Who we are

Oust is operated by an individual based in India. Contact for anything on this page: contact@oust.ink. See the imprint.

What we hold, and why

• When you bid: your listing — name, link, logo, copy, offer — and a record of the bid: the word, the amount, the time. This record is public and permanent; it is the ledger the site rests on. It shows your listing name, never your email.
• Your email address, passed to us by the payment provider when a payment completes. We hold it for one purpose: to tell you when someone takes your word. It is not shown anywhere, not shared, and not used for anything else.
• Payment details: we never receive them. Dodo Payments, as merchant of record, collects your name, billing details and card. Their privacy policy governs that.
• Logos: re-encoded to a plain image and stored publicly, because they are shown publicly. Nothing embedded in the file you uploaded survives the re-encode.
• Clicks on a listing: a salted hash of your address and browser, kept so the same visitor is not counted twice. We do not store your IP address for this, and the hash cannot be turned back into one.
• “Here now”: a random identifier your browser generates, used to count how many people are on the site. It identifies a tab, not a person.
• Server logs: when the site refuses a request for exceeding its rate limit, the requesting IP address is written to our host's logs so abuse can be traced. Ordinary visits do not log your address.
• Your theme preference, if you set one, is kept in your own browser and never sent to us.

We set no cookies of our own, run no analytics, and embed no advertising or tracking scripts.

Who else touches it

• Dodo Payments — takes payment as merchant of record and passes us your email.
• Supabase — hosts the database and logo storage, in the United States.
• Vercel — hosts the site and holds the server logs, in the United States.
• Resend — delivers the notice that someone took your word, from a data centre in Japan.
• Google Fonts — your browser fetches the site's typefaces from Google, so Google sees your IP address in the ordinary course of serving the file.
• Wikimedia — we read public page-view counts to compute attention data. Nothing about you is sent.

How long

• Click records: 48 hours.
• “Here now” identifiers: one hour.
• Listing drafts staged during checkout: 30 days.
• Bids and listings: permanent, as the public record of the board.
• Your email: as long as the bid it belongs to, or until you ask us to remove it.
• Opt-outs from email: permanent, so we cannot forget that you asked.

Your choices and rights

• Every notice carries a link that stops them. It takes effect immediately.
• You may ask us to remove your email address, to see what we hold, or to correct it. Write to contact@oust.ink.
• Removal of a listing is through /disputes; the historical record of a bid stays.
• Residents of India have rights under the Digital Personal Data Protection Act, 2023, and residents of the EU and UK under the GDPR. We honour requests under both within the time each allows.

Age

The site is not for anyone under 18, and we do not knowingly hold data about them.

Changes

If what we collect changes, this page changes first.