Privacy Policy

From your submission: the display name you type, your Instagram username, an optional one-line description, an optional age, and a city you select from a list.

Derived from your city selection: the city, region, country and approximate coordinates of that city. We store the coordinates of the city, not of you.

After payment: a copy of the public profile photograph associated with the Instagram username you submitted.

Technical data: your IP address and browser user-agent at the moment of submission, kept as evidence of consent and to limit abuse.

From PayPal: a transaction identifier, the amount, the payer's email address and country as reported by PayPal. We never see your card or bank details.

To display your entry, which is the service you are paying for.

To identify your entry when you pay again, so you are charged only the difference. This is why the Instagram username is used as the key.

To keep an auditable record that consent was given, which protects both you and us.

To prevent fraud, abuse and automated flooding of the ranking.

To meet accounting and tax obligations on payments received.

Public on the site: your display name, Instagram username, photograph, optional description, optional age, city, country and total amount paid.

Never public: your IP address, your user-agent, your payer email address, and any payment identifiers.

PayPal processes the payment and is an independent controller of the payment data it holds.

Supabase hosts our database and file storage. Vercel hosts and serves the site.

Google provides the city lookup used by the form and the map view.

We do not sell personal data and we do not share it for advertising.

Entry data and the stored photograph: until you request removal, or until we remove the entry.

Consent evidence (IP, user-agent, timestamps): up to 24 months after the entry ends, because it is the record that the entry was authorised.

Payment records: as long as required by applicable accounting and tax law, typically several years. These are financial records and are not deleted on request.

You may request access to, correction of, or deletion of your personal data, and you may object to its processing.

The fastest route for deletion is the removal page, which handles the public parts immediately.

If you are in the European Economic Area or the United Kingdom, you may also complain to your national data protection authority. If you are in California, you may exercise the rights granted by the CCPA, including the right to know and the right to delete.

We use Google Analytics 4 to count visits and see which pages people reach. It sets cookies named _ga and _ga_<id> that hold a random identifier, and it records your approximate location from your IP address, which is truncated before storage. It is not used for advertising, and we do not sell or share this data.

Two cookies are strictly necessary and are not used for tracking: one keeps the administrator signed in, and one remembers on your own device which entry you paid for, so the leaderboard can point out your row and offer to share your position. Neither is required to browse the site.

PayPal and Google may set their own cookies when their components load. Those are governed by their own policies.

This site is not for anyone under 18. We do not knowingly process the data of minors. If you believe an entry depicts a minor, report it through the removal page and we will remove it.