Privacy

• Your name and email. Required to issue your receipt and to reach you about your listing.
• Payment records. The amount, the Razorpay order and payment identifiers, and the invoice number.

We never see your card or UPI details. Payment is handled entirely by Razorpay on their own pages. Nothing that could be used to charge you touches our servers.

• A visitor cookie. The first page you open sets one small first-party cookie, ob_visitor: a random value that says nothing about you and is never shared. It lets us count your browser once a day and, while a tab is open, once as “online”. On that very first page, before your browser has it, a salted hash of your IP address and browser user agent stands in; the raw address is never written down. A second cookie, ob_seen, holds only the date you were last counted, so later pages that day are not counted again.
• A heartbeat. While a tab is open and visible, the page tells our server once a minute that someone is here. That sets a marker against the cookie’s value that expires two minutes later; it is not stored, creates no record, and stops when the tab is hidden or closed. The “online” figure is the number of those markers.
• Clicks on outbound links. When you follow a listing’s link to its site we record one click — only for a real page visit, never a script, prefetch or link preview. So that a double-tap or a refresh is not counted twice, those links set one small first-party cookie: a random value, sent only to our link redirects, that says nothing about you and is never shared. The click is stored with a salted hash of that value (or, on your first click, of your IP address and browser user agent) — never your raw IP.
• The page path. Which page, not who.

We do not use advertising cookies, we do not build profiles, and we do not sell anything to anyone. The aggregate figures are published openly on the stats page.

• Payment and receipt records: retained as long as Indian tax law requires. These cannot be deleted on request — they are statutory records.
• Individual click records: 90 days, then deleted automatically. Each listing’s click total — a single running number with nothing about any visitor in it — is kept permanently, and deleting the records does not lower it.
• Individual visit records: 90 days, then deleted automatically. What remains is one number per day — how many visitors that day — kept permanently for the public counters, with nothing about any visitor in it.
• Abandoned checkouts: expired automatically and cleared.

• Razorpay — payment processing.
• Resend — sending your receipt and invoice.
• Supabase — database hosting.
• Vercel — application hosting.

Each receives only what it needs to do that job.

The listing itself — title, description, domain, category, amount paid, rank and click count — is public by design. That is the product. Your name, email and any tax details are never shown publicly.

Email 24b0616@iitb.ac.in from the address you paid with. We will send you everything we hold about you, or delete it, within 30 days — except statutory tax records, which we must keep and will identify to you.