Privacy Policy

You can browse without giving us anything. We do not require an account and we set no advertising cookies of our own.

Our host records standard server logs — IP address, time, page, user agent — for security and debugging. We also count requests per IP address in order to rate-limit abuse of the endpoints that fetch external URLs. These records are kept for up to 30 days.

Videos on the boards are embedded from YouTube using its privacy-enhanced domain, which limits but does not eliminate what Google receives. When a video plays, Google may still receive your IP address and set cookies. That is governed by Google's privacy policy, not this one.

We collect and store:

• The website URL you submit, and the name and preview image we read from its public metadata.
• The video URL you submit, if any, and its public title and channel name.
• Your email address, which comes from Stripe Checkout. We use it to contact you about your slot — to confirm approval, tell you you have been outbid, or ask about your creative. We do not send marketing.
• Your bid amount and its status, and a reference to the Stripe payment.

We never see your card number. Stripe handles payment details directly and we hold only their identifier for the transaction.

Note that a live slot is public by design: the name and image read from your site, and your link, are shown to everyone who visits.

We use a small number of processors, each of which sees only what it needs:

• Stripe — payments and your email address.
• Neon — the database holding bids and submitted URLs.
• Our hosting provider — serving the site and keeping server logs.
• YouTube / Google — only when a video plays, as described above.
• PostHog — product analytics: which pages are viewed and which elements are clicked, so we can tell whether the city is understandable. Session recording is switched off and form inputs are not captured. Only active if analytics is configured for this deployment.

We do not sell or rent personal information, and we do not share it for advertising. We may disclose information if the law requires it, or to protect the service from fraud, abuse or a security threat.

Bid records are kept for as long as we operate the service, because they are the history of who held what — we need them for accounting, disputes and chargebacks. Server and rate-limit logs are kept for up to 30 days. If you ask us to delete your email address we will do so unless we are required to keep it for tax or fraud purposes.

Wherever you live, you can email hello@24boards.lol to ask what we hold about you, to correct it, to get a copy, or to have it deleted, and we will respond within 30 days.

If you are in California, the CCPA gives you these rights explicitly, plus the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined there.

If you are in the UK or EU, our lawful bases are: performing our contract with you (running your slot), and our legitimate interest in keeping the service secure (logging and rate limiting). You may also complain to your local data protection authority.

24 Boards is not directed at children and we do not knowingly collect anything from anyone under 13. If you believe we have, email hello@24boards.lol and we will delete it.

Payments are handled entirely by Stripe. Traffic is encrypted in transit and the database is access-controlled. No system is perfectly secure, and we cannot guarantee absolute security.

If we change this policy materially we will post it here with a new effective date. If the change affects information we already hold about you, we will email you.