Privacy

What is collected

To sell you a crown: your email address, the display name you choose, and the record of the claim itself, which crown, what you paid, when, and the order number from the payment provider.

To keep the map honest: a salted, one-way hash of your IP address on the reservations you open, and a count of page views. The hash cannot be turned back into an address; it exists so that one script opening a thousand reservations can be seen and stopped.

To give away a free crown: a short code emailed to you and stored only as a hash until it is used or expires, and a bot check from Cloudflare Turnstile, which sees your IP address and nothing else. A free crown with no such step lets one script take the whole map overnight.

While paid takeovers are closed: if you ask to be told when they open, your email address, which crown you wanted, the price the button was showing at that moment, your language and, if you offered one, your social handle. That record grants nothing — it does not reserve the crown or its price — and it is used to write to you once and to count how many people wanted what. Ask and it is deleted.

What never reaches this site

Card numbers, expiry dates, security codes and billing addresses. Payment is taken on Dodo Payments’ own pages; this site receives an order number, an amount, and a confirmation that the payment settled.

What is published

Your display name, the amount you paid, which city and crown, and when it changed hands. That is the product: a public board of who holds what and what it cost. It is visible to anyone, and it stays in the city’s history after you are outbid.

Your email address is never published and is never shown to other users.

Where it is kept, and who else sees it

In a PostgreSQL database hosted by Supabase in Frankfurt, Germany. The site itself runs on Vercel. Payments and invoicing are handled by Dodo Payments as merchant of record. Verification emails are sent by Resend, which receives your address and the message. The bot check on a free claim is Cloudflare Turnstile, which receives your IP address.

Those five are the only processors. Nothing is sold, rented, or shared for advertising, and there are no advertising or tracking cookies on this site.

Why we are allowed to hold it

Under the GDPR and Türkiye’s KVKK: your email, name and claim record are processed to perform the contract you entered when you paid. The IP hash and view counts are processed on the legitimate interest of keeping the map from being swept by scripts and of knowing whether anybody is reading it.

How long, and how to get it removed

The ownership history is kept indefinitely: it is the public record of who held what, and deleting entries from it would make the board dishonest. IP hashes and view records are kept for 12 months.

Write to hello@outcity.lol to see, correct, or delete what is held about you. Your email address and account details can be erased on request. Past entries in the public history remain, under the display name that was shown at the time, if that name identifies you and you want it changed, say so and it will be replaced with a neutral one.