Privacy policy

Last updated 20 August 2026.

What we collect

• From the person booking: your name, email address, an optional phone number, and the message you write.
• The uploaded photo, stored in Supabase Storage.
• Payment metadata from Razorpay: an order id and a payment id. Never card numbers; those go straight to Razorpay and never touch our servers.
• Your IP address, recorded against the consent you gave and used for rate limiting and abuse investigation.
• Bids: name, email and amount. The name you enter and the amount you bid are shown publicly on the auction leaderboard; your email and phone number are not.

Why we collect it

To display your card, to email you about your booking, to take payment, to review content for abuse, and to respond if someone reports it. We do not sell any of this, and we do not run third-party advertising trackers.

Photos of other people

You are uploading someone else's face, so this matters: if you are in a photo on this site and you did not agree to it, tell us and we will remove it. Use the report button on the card, or email us. We do not require you to prove who you are before taking something down.

How long we keep things

• Photos are deleted from storage as soon as a card is rejected or removed.
• Past cards stay on the wall of fame until you ask us to delete them.
• Payment records are retained as long as tax law requires.
• Rate-limit records are short-lived and expire automatically.

Who processes your data

• Supabase: database and image storage.
• Razorpay: payments.
• Resend: transactional email.
• Vercel: hosting and edge delivery.

Your rights

Email harshchauhan419@outlook.com to get a copy of what we hold about you, correct it, or have it deleted. We respond within 30 days, usually much sooner.

Cookies

We set exactly two, and only for administrators signing into the moderation panel: a session cookie and a CSRF token. Regular visitors get no tracking cookies at all.