Privacy

• We collect the minimum needed to take payments, count honest votes, and pay winners.
• We don't sell data, run ads, or use tracking cookies.
• Payout details are encrypted and deleted as soon as the money is sent.
• IP addresses are never stored in readable form, and the scrambled versions are deleted after 12 months.

When you sign in to vote (Google or GitHub): your account ID with that provider, your email address, your display name and profile picture, and — for GitHub — when your account was created. We use these to make sure each vote is one real person, and to show you which apps you've voted for.

When you vote: which app you voted for and when, plus a one-way hash of your IP address and browser user-agent. The hash lets us spot one device casting votes from many accounts without keeping your actual IP.

When you list an app or boost: what you type in the form, the screenshot you upload, and from Stripe your email address, the amount paid, and a card fingerprint (a code Stripe gives us that identifies a card without revealing its number). We use the fingerprint to detect duplicate or fraudulent entries.

When you claim a prize: the name on your account and your PayPal email or bank details. These are encrypted before they're stored, only readable by us, and deleted when we mark the prize as paid.

Analytics: we use Vercel Analytics, which counts page views and a few events (like “share clicked”) without cookies and without identifying you.

• Everything on a listing: app name, one-liner, link, screenshot, confession, and the builder name and handles you choose to add.
• Boost amounts, plus the display name and message if you give them.
• Vote totals per app (hidden in the last 48 hours of a round). Who voted for what is never public.
• Winners' app names and prize amounts, permanently, on the winners page.

We use a handful of services to run the site. Each only gets what it needs:

• Vercel — hosting and analytics.
• Neon — our database, hosted on AWS in Sydney, Australia.
• Stripe — card payments and refunds.
• Google and GitHub — sign-in.
• Resend — sending emails (listing approved, you won, prize sent).
• PayPal or Wise — sending prizes, only for winners who choose them.

Some of these services store data outside Australia, including in the United States.

• Listings, votes and results: for as long as the site runs, because they make up the public record of each round.
• Hashed IP and user-agent on votes: 12 months, then deleted automatically.
• Payout details: until the prize is paid, then deleted.
• Payment records: as long as tax law requires (usually 5–7 years), held by Stripe and in our accounts.
• Screenshots from abandoned checkouts: deleted after 24 hours.

You can ask us for a copy of the data we hold about you, to correct it, or to delete it. We'll do that within 30 days, except where we need to keep something for a legal reason (like payment records) or where deleting it would change the result of a finished round. If you're in the UK or EU you also have rights under GDPR, including complaining to your local data protection authority. In Australia you can complain to the OAIC.

Email hello@mycrapapp.bingo. See also the terms.