Privacy & developer policy

Last updated: August 22, 2026

This page describes how bidtorank.dev handles data and how we use third-party APIs. It supplements our terms of service.

What we collect

• Listing data — the https URL you submit, fetched title and one-liner, bid amount, rank, click count, and timestamps when the listing goes live.
• Payment metadata — Stripe checkout session ids, payment status, and charge amounts. Card data is handled entirely by Stripe.
• Email (optional) — if you provide one at Stripe checkout or use account features, we store it to associate listings and session cookies.
• Usage signals — anonymous visitor ids in browser storage for online/visitor counts; an httpOnly cookie for click deduplication; signed session cookies if you use /account.
• Server logs — standard request logs (IP, user agent, timestamps) for security, rate limits, and debugging.

How we use data

• Display the public leaderboard and analytics pages.
• Process payments and mark listings live after Stripe confirms payment.
• Count outbound clicks through /go links and filter obvious bots.
• Operate the site, prevent abuse, and improve reliability.

What we do not do

• We do not sell personal data.
• We do not use your listing to send unsolicited email.
• We do not read private X/Twitter user data through the X API.

Third parties

• Stripe — payment processing. See Stripe Privacy.
• Hosting — the app runs on our infrastructure (Docker on a VPS). Database hosted alongside the application.
• X (Twitter) — see Developer policy below.

Cookies & local storage

• btr_visitor_id (localStorage) — counts unique visitors for the live stats pill.
• btr_click (httpOnly cookie) — limits duplicate click counting per browser.
• br_session (httpOnly cookie) — optional signed session after checkout if you use account features.
• Theme preference may be stored by the theme toggle in local storage.

Retention

Live listings and payment records are kept for as long as the directory operates, because listings are permanent by design. Server logs rotate on a short schedule. You may request deletion of personal data (such as email) where it is not required to operate your listing; the public listing row itself may remain if you keep an active paid URL on the board.

Your choices

Do not list on the board if you do not want your URL, hostname, bid, and rank displayed publicly. Block cookies in your browser if you do not want click or visitor tracking — the site will still work for browsing.

Developer & X API policy

bidtorank.dev uses the X API only to post one automated announcement on our official account for each completed listing or top-up payment. Each post includes the public listing URL and the rank reached by that payment. Example: "welcome example.com just took spot #3 on bidtorank.dev" followed by the listing URL.

• Write-only posting from our account — no reading timelines, DMs, or private user data.
• No automated follows, likes, reposts, or replies.
• No posting on behalf of users except factual announcements tied to completed checkout.
• API credentials are stored server-side and never exposed to clients.
• If posting fails, the listing still appears on the website.
• X does not currently expose an official OAuth endpoint to pin or unpin Posts. Rank #1 announcements may be pinned manually until X provides that capability; non-#1 announcements do not change the profile pin.
• We comply with the X Developer Agreement and Developer Policy.

Agents and developers integrating with our public HTTP API should read /skill.md and respect the same listing rules and rate limits as human users.

Contact

Privacy requests and developer questions: hello@bidtorank.dev.