Privacy

CuBid is operated by Rohan Vora, an individual based in India, who decides what is collected here and why. Anything in this policy can be asked about, argued with, or acted on by writing to the address at the bottom of this page.

The message you write. Its text, and anything optional you attach to it — a recipient's name, a city or country, a link. All of it is public the moment it is posted, and that is the point of the product rather than a side effect of it.

Your email address, if you sign in. It is used to send you a sign-in link and to connect your messages to you. It is never shown on the board, never sold, and never used for marketing.

Your IP address, briefly. It is written to a rate-limit table so that one person cannot flood the board, and it is deleted automatically after two days.

Anonymous traffic statistics. We use Vercel Analytics, which counts page views without cookies and without building a profile of you. It does not follow you to other sites.

We do not collect your name unless you type it, we do not ask for your location, we do not use advertising or tracking cookies, and we have no third-party trackers on the site.

European and UK law asks anyone holding personal data to name the legal ground they are holding it on. Here are ours, in the order the data arrives.

Your message and your email address, because you asked us to. Posting and signing in are things you choose to do, and neither can happen without us holding what you typed. In the language of the GDPR this is performance of a contract — the one you enter into when you post.

Your IP address, because a public board has to survive strangers. One with no rate limit fills with noise inside a day. Two days of an IP address is the least that keeps the board usable. This is our legitimate interest, and you can object to it by writing to us.

Traffic statistics, on the same ground and for the same reason: we need to know whether the site works. They are counted without cookies and never tied to you.

Payment records, because the law requires it. Tax and accounting rules make us keep them for seven years whatever anyone would prefer. That is a legal obligation, and it is the one thing on this page we cannot waive for you.

If you are in India, the DPDP Act frames the same things as consent for what you hand us and as legitimate uses for what we are obliged to keep. Wherever you are, what we actually do does not change.

Your card details. Payments are handled entirely by Dodo Payments, which acts as the merchant of record. Card numbers are entered on their systems, not ours, and never reach CuBid.

What comes back to us is the fact of a payment: an amount, a currency, a timestamp, and Dodo's own reference for it. That is enough to move a message up the board and to keep an accounting record, and nothing more.

Supabase stores the database. Vercel runs and serves the site and provides the traffic statistics. Dodo Payments processes payments and holds the billing details you give them, under their own privacy policy.

That is the entire list. We do not share your data with anyone else, and we do not sell it — not to advertisers, not to data brokers, not to anyone.

These providers operate internationally, so your data may be processed outside the country you live in.

A live message is kept for as long as it is on the board. The board is a public record, and paying for a rank is a public act.

A removed message is kept for seven days and then permanently erased. The seven days exist so that a takedown made in error can be undone; after that the text and every detail in it are destroyed and cannot be recovered.

Your email address is kept while your account exists, and deleted when you ask us to delete it.

IP addresses in the rate-limit table are deleted automatically after two days.

Payment records — amount, date, currency and the processor's reference — are kept for seven years, because tax and accounting law requires it. Once the message they paid for is erased, those records no longer identify anyone.

Deletion. Ask us to take down a message you posted, or to delete your account and the email address attached to it, and we will. Removal starts the seven-day clock in section 06.

A copy of your data. Ask, and we will send you what we hold about you.

Correction. If something we hold about you is wrong, tell us and we will fix it.

Write to the address below from the email address on the account, so we know it is you. We answer within thirty days and usually within two working days. If you are in the EU or UK you have these rights under the GDPR, and if you are in India under the DPDP Act; wherever you are, we will honour them.

If you believe we have handled your data badly and we have not put it right, you can complain to your local data protection authority.

One cookie keeps you signed in. It exists only if you sign in, and clearing it signs you out.

Your browser's local storage remembers small conveniences — that you have already read the explainer, or a bid you had started before signing in. It stays on your device and is never sent to us.

There are no advertising cookies and no cross-site tracking on CuBid, which is why there is no cookie banner asking you to accept any.

CuBid is not for anyone under 18. We do not knowingly collect anything from a child, and if we learn that we have, we delete it.

If this policy changes in a way that matters, the date below changes with it. Continuing to use CuBid after a change means you accept it.