Privacy policy

We store, for as long as the account exists:

• Your email address, used to sign in and to contact you.
• A bcrypt hash of your password. We cannot read your password and cannot tell you what it is.
• A display name, if you set one. This is shown publicly on bids.
• The country your sign-up request appeared to come from, and the date you registered.
• A session row per active sign-in, so that signing out actually invalidates the session server-side rather than only in your browser.

The handle, display name, tagline, bio, avatar image URL, follower and post count, and category you submit — all of which are published, because a public directory is the entire point — plus a hash of the postback API key issued when the listing goes live.

We do not ask for, want, or accept your Instagram password or session token, we have no Instagram integration, and we do not scrape Instagram. Everything about a listing is what the person who submitted it told us; an operator may correct a follower count or remove a listing afterwards, but nothing is verified against Instagram before it appears.

We store the amount, the currency, the status, the time, the rank it bought, and a Paddle transaction reference. The amount, your display name and the rank are public on that account's ledger — that transparency is the product, and you should not bid if you need the spend to be private.

Card details never reach our servers. Payment is taken by Paddle, who are the merchant of record and the seller on your receipt. What they collect and how they use it is governed by their own privacy notice, shown at checkout. We receive only a transaction id and whether it succeeded.

Every View profile and Follow tap goes through our redirect so it can be counted for the creator who paid for that placement. Per tap we record: which listing, which of the two buttons, the rank the listing held at that moment, a random click token, the country, the browser user-agent string, the referring page, and a salted hash of your IP address — never the address itself. The salt is a server secret and is never published, so the hashes cannot be reversed into addresses by anyone reading the database.

Where a creator reports a new follower back to us, we may hold the identifier or handle they send in order to attribute the follow to a click. We ask creators not to send anything beyond that, and we cannot verify what a third party chooses to post to their own API key.

Aggregate counts for a listing are public. The individual rows are visible only to that listing's owner and to the operator.

One cookie, followersbid_session. It is HTTP-only, same-site, marked secure in production, holds a signed token identifying your session, and lasts 30 days or until you sign out. It exists solely to keep you signed in.

There are no analytics cookies, no advertising cookies, and no third-party tags on this site — which is why you are not being asked to dismiss a consent banner.

Account and listing data lasts as long as the account. Click and follow rows are kept for up to 24 months, because they are the evidence base for a billing dispute about traffic that was paid for, and are deleted after that. Bid records are kept for as long as tax and accounting law requires, which is longer, and cannot be deleted on request while that obligation stands.

Only the processors it takes to run the site: Paddle for payments and tax, our hosting provider, and our database provider. No advertising networks, no data brokers, and no sale of personal data in any sense — including the broad Californian sense that covers sharing for cross-context advertising.

We may disclose data where the law compels it, and to defend against fraud or a payment dispute.

Depending on where you live you can ask for a copy of your data, ask for it corrected, or ask for it deleted, and you can object to processing. Email the address below from the account in question and we will answer within 30 days.

Two honest limits. Settled bids are a matter of public record on the board and in the account ledger; deleting your account removes your display name from them but not the amounts or the ranks they bought. And because visitor IPs are only ever stored as unreversible hashes, we genuinely cannot find or delete “your” click rows on the strength of an IP address alone — there is nothing there to match against.

The site is not for anyone under 18 and accounts may not be created by them. Listings involving minors, and any sexual content involving minors, are removed without refund and reported.

Material changes are announced on the front page before they take effect. The terms of service cover what a bid buys and the refund policy covers getting money back.