Last updated 27 August 2026
LolBoard collects about as little as a site with accounts and payments can. This page says exactly what that is, in the order it is actually collected.
Your email address. Signing in uses Google OAuth, handled by Supabase Auth. We read your email address and nothing else from your Google account — no name, no profile picture, no contact list. We never see or store your Google password.
The sites you list. The domain you submit, and the title, description and favicon we read from that page when you submit it. All of this is public by definition: it is the listing.
Your bids. The amount, and when. Bids are tied to your account internally so you can see your own history.
Payment records. The amount, the status, and the order identifiers Polar gives us. Card numbers are not among them — see below.
We do not store IP addresses, user agents, device fingerprints or per-click logs. There is no table in our database with a row per visitor or a row per click.
Your IP address is read from the request while a page is being served, purely to rate-limit submissions and clicks, and is held in server memory only for the length of that window. It is never written to the database and is gone when the server restarts.
We do not buy data about you, we do not sell or rent anything we hold, and we run no advertising or cross-site tracking pixels.
Everything on a listing row: the domain, title, description, favicon, standing bid, and click count. That is the product.
Bid history on a site page shows amounts and dates against a per-site pseudonym. That pseudonym is stable within one site and unlinkable across sites, and your email address and account id are never exposed through it. Only you see your own bids marked as yours.
Outbound links on the board route through LolBoard so the click can be counted, then redirect straight on. What that records is a single number per site incremented by one — nothing about who clicked, where from, or on what.
Obvious bots and link-preview fetches are skipped, and repeat visits from the same visitor to the same site are only counted once every 10 minutes. The short-lived key that makes that deduplication possible lives in server memory and is never stored.
Payments are processed by Polar, which acts as merchant of record. Your card details are entered on their checkout and never touch our servers — we could not see them if we wanted to.
We send Polar the bid amount and a single reference to the order in our database, and we pass your email address so the checkout arrives pre-filled. They return order identifiers and a payment status. Their privacy policy governs what they do with the billing details you give them.
The only cookies we set are the Supabase Auth session cookies that keep you signed in. They are strictly necessary — sign out and they are cleared. We set no advertising or profiling cookies.
Page views are counted by Vercel Analytics, which is cookieless and does not build a profile of you across sites.
Supabase — database and authentication. Vercel — hosting and page-view analytics. Polar — payments. Google — the sign-in you chose to use.
These are the only third parties that receive anything, and each receives only what its job requires.
Listings, bids and click counts are kept while the listing is on the board, because they are the public record of what was bid for what. Payment records are kept as long as tax and accounting rules require.
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. Deleting your account removes your listings, your bids and your order records along with it.
Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your local data protection authority. Write to hello@lolboard.lol and we will action it.
One limit worth stating plainly: a bid that has already been placed is part of the public history of the board, so amounts and dates may remain on the board in pseudonymous form after an account is deleted. Nothing identifying you remains attached to them.
LolBoard is not intended for anyone under 16, and we do not knowingly collect anything from them. If you believe a child has given us data, email us and we will remove it.
If this policy changes materially we will update the date at the top of this page. Continuing to use the board after a change means the updated policy applies to you.
Questions about any of this go to hello@lolboard.lol. The terms of service cover the rules of the board itself.
