Privacy Policy

The controller for personal data processed through the Service is [Your Name / Entity Name], based in [Country].

• Email: [your contact email]
• X / Instagram: [@yourhandle]

We keep the Service small. We collect only what we need to run the board, take payment, stop abuse, and understand traffic.

• Visitor identifier. A random ID in an HTTP-only cookie named inbids-visitor-id, stored for up to one year. We use it to attach a checkout to a browser, limit duplicate click counts, and keep the board usable. It is not your name.
• Checkout and listing data. The Instagram @username you submit, the category, rank amount, and the public name, bio, follower count, avatar, and destination link we resolve for that profile. Payment confirmation identifiers are stored so we can place the ranking.
• Payment data. Card details and billing identity are collected by Dodo Payments, not by us. Dodo Payments may send us confirmation that you paid and an amount. See Dodo Payments' own privacy notice.
• Instagram profile data. When you submit a username, we fetch publicly available profile data (avatar, bio, follower count, verified status) directly from Instagram or a third-party lookup service to display your listing. We do not access private account data and do not require you to log in or connect your Instagram account.
• Clicks. When you visit a listing from the board, we may record the listing, a time, the visitor ID, and a hashed IP address. The hash is for rate limiting and fake-click reduction, not to profile you.
• Technical data. Standard request data such as user agent, referrer, and IP address may be processed by our host and by [Analytics Provider] to operate and secure the Service.
• Messages you send us. If you email a notice, a category correction, or a privacy request, we keep that correspondence as needed to respond and to keep a legal record.

The visitor-ID cookie is a strictly necessary cookie. It lets checkout and click protection work. We do not use it for advertising.

Analytics on inbids.lol is loaded with [Analytics Provider]'s cookieless script. Your browser or device may also store a theme preference locally so the page can stay light or dark.

• Contract. To take payment, create or raise a listing, show rank, and provide the Service you asked for.
• Legitimate interests. To keep the board fair (rate limits, bot and fake-follower filtering), display public listing metadata, measure visits, debug outages, and defend legal claims. You may object to processing based on legitimate interests as described below.
• Legal obligation. To keep tax, accounting, and complaint records where the law requires it.

Rank, spend, Instagram usernames, avatars, bios, follower counts, and destination links on the board are public. Anyone can see them, including search engines. Do not list a profile if you do not want that information shown.

We fetch public metadata from the Instagram profile you submit so visitors can recognise the listing.

• We do not require Instagram login or OAuth access to list a profile.
• We do not post, follow, like, or take any action on your Instagram account.
• We only display information that is already public on your profile.
• We do not sell your personal data.

• [Payment Processor] — checkout and payment confirmation.
• [Analytics Provider] — cookieless visit and live-visitor counts.
• Hosting, database, and edge infrastructure (Vercel and Supabase / PostgreSQL) so the site can run.
• Instagram profile lookup helpers (third-party services) so we can show a name, avatar, bio, and follower count before and after checkout.
• Professional advisers, authorities, or a buyer of the Service if we must share data to comply with law, enforce the Terms, or transfer the project.

Some processors may be outside your region. Where we rely on them, we use appropriate safeguards such as the processors' standard contractual clauses or an equivalent mechanism they provide.

• Visitor IDs last up to one year in the cookie, or until you clear cookies.
• Public ranking entries stay while the listing is on the board and may remain in backups or activity history after a takedown for a limited time.
• Payment identifiers and amounts are kept as long as needed for accounting, tax, fraud, and dispute handling.
• Click records and IP hashes are kept only as long as useful for rate limiting, abuse prevention, and aggregate counts.
• Instagram profile snapshots (avatar, bio, follower count) are refreshed periodically and old snapshots are discarded once superseded.

If the GDPR or a similar law applies to you, you may ask us to access, correct, delete, or export personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing was based on consent. You may also lodge a complaint with a supervisory authority in your country of residence.

Email [your contact email]. We may need enough information to find your data. Public listing content that is also on your own Instagram profile is not made private just by appearing on the board; you can ask us to remove the listing.

The Service is for adults. We do not knowingly collect personal data from children. If you believe a child's Instagram profile has been listed, contact us and we will remove it.

We may update this policy when the Service or the law changes. The date at the top of this page is the current version. If a change is material, we will post the updated policy here.