Privacy notice

Deliberately little. Specifically:

• Your email address, only if you give one when claiming a listing. Used to tell you when someone outbids you, and for nothing else. It is never displayed publicly and never sold.
• Your wallet address and the details of your payment, where you pay onchain. These are already public on the blockchain; we record them to establish who controls a listing.
• A salted hash of your IP address, to rate limit submissions, count clicks once per visitor, and show how many people are currently on the site. We do not store raw IP addresses.
• The content you submit: the URL or handle, description, category and any logo you upload.
• Aggregate click counts per listing per day. These are totals and are not linked to individuals.

We do not use advertising cookies, we do not track you across other sites, and we do not sell or share personal data for marketing.

If you pay by card, the payment is handled by Stripe. Your card number never reaches our servers and we never store it. We receive only confirmation that a payment succeeded, its amount, and an identifier for it. Stripe processes that data as its own controller under its privacy policy.

Payments made in USDC are recorded on Base, a public blockchain. That record includes the paying wallet address, the amount and the time, and it is maintained by a network we do not control.

We cannot delete anything from a blockchain, and neither can anyone else. If you ask us to erase your data we will remove what we hold in our own database, but the underlying payment will remain publicly visible on Base permanently. Please take that into account before paying onchain.

Payment and listing records: to perform the contract between us, and because we need them to keep an accurate record of money received.

Hashed IP addresses: our legitimate interest in preventing abuse and in counting clicks honestly, which is a figure other people pay on the strength of.

Your email address: your consent, given when you choose to enter it. You may withdraw it at any time and we will stop sending outbid notices.

Payment records are kept for as long as we are required to keep financial records, and in any case while the listing they paid for exists. Hashed IP addresses used for rate limiting are deleted after 24 hours; those used for the visitor count are deleted after an hour. Unused claim attempts expire after 24 hours.

We use Vercel for hosting and file storage, Neon for the database, Stripe for card payments, Resend for sending email, and Reown for connecting wallets. They process data on our behalf, or as their own controllers where noted.

Listing logos are served from Vercel or, where no logo was uploaded, from Google’s favicon service. Loading a page therefore reveals your IP address to those services in the ordinary way that loading any image does.

If you are in the EU or UK you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable form. Write to team@frontrun.auction and we will respond within one month.

You also have the right to complain to a supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).

The one thing we cannot do is erase a blockchain record, for the reason set out above.