Privacy
Last updated 29 August 2026. This page says what we collect, why, and for how long. The operator of PayOrPost, a sole trader in the United Kingdom, is the data controller. Contact is through the form in the footer of every page.
The launch list
If you leave your email on the holding page, we keep that address to send one email when the board opens. Basis: your consent. The address appears nowhere else and joins no marketing list. It is deleted after the launch email, or sooner if you ask through the contact form. Asking costs nothing and withdraws the consent.
Accounts
When you create an account we keep your email address and send sign-in links to it. No password exists. The sign-in email is delivered by our database provider, Supabase. Basis: the contract with you. Kept while the account exists; you can ask for deletion at any time.
Buyers
When you buy a position, or book a sharer's offer, we keep the email you entered, what you bought, the price, your link, any message to the sharer, and the Stripe payment identifiers. Stripe processes your card; we never see the card number. Stripe sends your receipt. Basis: the contract with you. Kept for six years for accounting. Sharers who set up payouts get a Stripe account of their own; Stripe holds their identity and bank details under its own policy, and we hold only the account reference.
Sharers
When you share a listing we keep a handle, an email, an optional link, and the URL of your post, which we fetch once to check it is public and carries your share link. Your handle, rank and click counts appear on the public earned board. If you publish offers, the post types and prices you set appear on your public sharer card. Basis: the contract with you. Kept while the profile is active.
Readers
We never store your IP address. A visitor is counted with a one-way hash of the address that cannot be reversed. When you arrive through a share link we also record a random session id, a hash of your browser settings, the site you came from, whether the address belongs to a datacentre, how long you stayed, and whether you scrolled or clicked. That is the raw evidence behind the earned board. Basis: our legitimate interest in counting real readers and preventing fraud. Raw events are kept for 90 days.
Messages
A contact message or a post request is stored with the name, email, link, budget and text you entered, and read by the operator. Basis: your request. Kept for one year.
Where the data lives
The database is hosted by Supabase and the site by Railway. Payments are handled by Stripe. Exchange rates are fetched from the European Central Bank by way of Frankfurter without any personal data. These providers may process data outside the UK and the EEA; each transfer is covered by the provider's standard contractual clauses or an adequacy decision.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, receive it in a portable format, restrict or object to processing, or withdraw a consent, through the contact form in the footer. We answer within one month. You can complain to the Information Commissioner's Office at ico.org.uk or to your local EU data protection authority.