Your information, explained.

Information you provide

When you create an account, we collect your email address and password. Passwords are stored as bcrypt password hashes, not as readable passwords. When you submit an advertisement, we collect the display name, destination URL, optional logo and artwork URLs, headline, description, category, optional country, receipt email, and the promotion amount.

Names, ad copy, category, destination links, and submitted artwork may be shown publicly with the promotion. Receipt email, account email, and password hash are not intentionally displayed on the public board.

Account, payment, and activity records

We store account session records, promotion status and rank, payment amount and status, payment-provider identifiers, ad impressions, tracked outbound clicks, and ranking events. We use these records to operate the board, provide advertiser dashboards, moderate listings, prevent duplicate payment processing, and reconcile transactions.

Payments are processed by Stripe when Stripe Checkout is offered. If another payment method is offered, its provider processes payment details under its own privacy terms. BidRush does not store full card numbers or security codes.

Cookies and audience counts

When you sign in, BidRush sets a necessary, 14-day session cookie marked HttpOnly and SameSite=Lax; it is marked Secure in production. The cookie keeps you signed in and is removed when you sign out or expires.

The live audience counter stores a random browser-tab identifier in sessionStorage. The server stores a SHA-256 hash of that identifier with a New York calendar date and last-seen time. The counter reports anonymous browser sessions, not verified individual people. Promotion views are counted when a listing enters view, and outbound clicks are counted when a visitor follows a tracked promotion link.

The application does not intentionally store visitor IP addresses in its analytics database or use third-party behavioral advertising trackers. The hosting, network, or security providers may process technical request data, including IP addresses, in their own infrastructure logs.

Images and external websites

Advertisers may provide image URLs, and the site may request a website icon from the advertiser’s domain. These images are loaded from those external domains in your browser; BidRush does not upload or host them. Those domains may receive standard connection information from your browser. Following an advertiser link takes you to a separate site with its own privacy practices.

When information is shared

We share the information needed to run the service with infrastructure and database providers, payment providers such as Stripe, and service providers that help secure or maintain BidRush. These providers process information for their services under their own terms. We may also disclose information when required by law, to respond to valid legal process, or to protect users, the service, and the public.

We do not currently use third-party behavioral advertising pixels. If that changes, this notice and any required choices will be updated before the new tracking is used.

Retention and security

We keep account and session information while needed to operate accounts, then delete or de-identify it when no longer needed, subject to security, dispute, legal, and accounting requirements. Payment, ranking, moderation, and audit records may be retained longer to document transactions, handle disputes, meet legal obligations, and protect the service. Visitor session counts are retained in hashed form for aggregate reporting; the current application has no automated deletion schedule for those records.

We use technical and organizational safeguards appropriate to the service, including password hashing, restricted admin access, and signed payment webhooks. No online service can promise perfect security.

Your choices and privacy requests

You can sign out to clear your account session cookie. You can also block or clear browser storage, although that may affect sign-in or audience counting. If applicable privacy law gives you rights to access, correct, or delete personal information, or to object to certain processing, contact us and we will review your request under the law that applies.

Some records may need to be retained for payment, security, legal, or dispute purposes. We may need to verify your identity before acting on a request.

Children

BidRush is intended for advertisers and visitors who are at least 18 or the age of majority where they live. The service is not directed to children under 13, and we do not knowingly ask children under 13 to create accounts or submit advertisements.

Changes and contact

We may update this notice as the service changes. The effective date above will change when we publish a revised version.

Before public launch, configure NEXT_PUBLIC_CONTACT_EMAIL so people have a working address for privacy questions and requests.