Privacy Policy

Marcin Frątczak, ul. Warszawska 40/2A, 40-008 Katowice, Poland. For anything about your data: marcin@fratczak.pl.

When you sign in with X we read your public profile once and store: X user id, handle, display name, avatar URL, follower count, account creation date and your X bio. Scopes requested are users.read and tweet.read, plus offline.access for the refresh token.

We refresh that data only when you sign in again after 30 days. We never post, like, follow or send messages for you, and we do not read your timeline, direct messages or followers list.

For listings with a bid we also fetch your five latest public posts once a day and show them on the profile.

A profile added by someone else shows only public data: name, avatar and follower count.

• Your bio, one-line title, category, projects and links.
• A blog RSS address, and one pinned post link.
• An email address - only if you type one. X does not share it.
• For the bio page: its text, your social links and which projects appear there.

If you give us an address and leave alerts on: when someone outbids you, when someone bids on your profile, and three days before your balance halves. These are part of the service.

Product news and offers only if you tick the separate box. We store the date and the exact wording you agreed to, and every email carries a one-click way out.

Paying sends your email address and a Stripe customer identifier to Stripe Payments Europe, Ltd., which is the merchant of record. Card details go straight to Stripe's hosted checkout and never touch our servers.

For payment data Stripe is not our processor - it acts as an independent controller under its own privacy policy, because it is the seller on the transaction. We store what we need to show you your own history: amount, date, status, the Stripe identifiers and the receipt link.

Clicks are counted per listing per day, as a number. We do not store who clicked. To stop one machine inflating a counter we keep a short-lived, in-memory note of an address for 24 hours - it is never written to the database.

A vote is stored as a pair: your account and the listing. The public side shows only totals.

• A session cookie after you sign in, valid 30 days. Without it there is no way to keep you signed in.
• A short-lived cookie when you connect another X account, so we know which account to attach it to. It lives ten minutes.

No advertising cookies and no cross-site tracking. Our analytics (below) runs without cookies, so there is nothing here to consent to.

We use DataFast to count page views and see which links bring people here. It runs the cookieless version of their script: it sets no cookie, stores nothing in your browser, and the identifier it derives rotates roughly every 24 hours - so a visit next week is not tied to this one.

What it records is the page you opened, the referring site, and coarse technical facts a browser sends anyway: country, device type, browser. We do not send it your name, your email, your @handle, or anything you typed.

• Stripe Payments Europe, Ltd. - payments and merchant of record.
• Prisma Data, Inc. - the database, hosted in the EU.
• Hetzner Online GmbH - the server, in Germany.
• Cloudflare, Inc. - the domain and traffic in front of the site.
• Amazon Web Services (SES) - sending email.
• DataFast - counting page views, without cookies.
• X Corp. - sign-in and public profile data.

Your listing and profile: until you delete them. Payment records: five years, because tax law says so. Votes and click counters: as long as the listing exists.

Deleting your listing removes the profile, its content and your X data within 24 hours.

Access, correction, deletion, restriction, objection and portability. Most of it you can do yourself from your profile; for the rest write to us.

You can also complain to the Polish data protection authority (Prezes UODO, ul. Stawki 2, 00-193 Warszawa). We would rather you wrote to marcin@fratczak.pl first.

Traffic is encrypted. Secrets live outside the code. The database is not reachable from the public internet. This is a small product run by one person - it is not a bank, and you should not treat it like one.

The date at the top always reflects the current version. A material change is announced on the site.