Privacy Policy

• Southern East Inc., a Canadian company in Ontario, runs outbid.fyi.
• We use your information to run and improve outbid.fyi, keep it secure, and talk with you.
• We do not sell your personal information. We do not share it for targeted advertising.
• We may publish or share statistics that do not identify anyone.
• We will ask you first before we give a partner anything that identifies you for the partner's own use, including training AI.
• If we change how we use your information, we will tell you at least 30 days ahead. We will not apply a new use to information we already have unless you say yes.
• Your choices: Your Privacy Choices. Questions: Rishit Patel. Mail the address in Who we are. We do not publish a privacy email yet.

outbid.fyi is run by Southern East Inc., a company based in Ontario, Canada, at 222 Main St E, North Bay, ON P1B 1B1, Canada("we", "us"). We decide how and why your personal information is used, so we are responsible for it. Some laws call this the controller.

Privacy Officer: Rishit Patel. For people in Quebec, this is also our person in charge of the protection of personal information.

Mail: Southern East Inc., 222 Main St E, North Bay, ON P1B 1B1, Canada.

We do not publish a privacy email on this site. You can also message Rishit Patel on X: @imrishit98.

This policy covers the outbid.fyi website, accounts, listings, sponsor slots, and the emails we send about those things. It does not cover other Southern East Inc. sites. Those sites have their own policies.

What we actually collect

Account. The sign-in page offers Google and GitHub. Those buttons work when the matching keys are set on the server. Email and password sign-in is turned off. If you sign in, we store your name, email, profile image, and the sign-in tokens those services send. We also store the session IP address and browser type. Better Auth keeps this in our Supabase database, with a cookie so you stay signed in.

Sponsor slot. The advertise form asks for a site URL, a name, a one-line description, and an email. Stripe bills that email each month until you cancel. We store the Stripe customer id and subscription id. We do not store your full card number.

Listings. The public submit form asks for a board URL. A one-time verified listing can then start a Stripe checkout. If you are signed in, that checkout can include your account id and name in Stripe metadata. A separate submissions address can also store a board name, URL, tagline, niche, mechanic, highest bid, and notes.

Badge check. If you claim a board while signed in, we store your account id, the hostname, and the page URL. We then read that public page to see if our badge is there.

Analytics. PostHog can receive page views, clicks, and JavaScript errors when analytics is allowed. If you are signed in and identified analytics is allowed, we also send your account id, email, and name. Details are in the PostHog section below.

Country and region. Our host can send a country code and a region code from the IP address. We use that only to decide the analytics banner and the Quebec rule. We store it in a short-lived cookie so the browser can apply the same rule. We do not use it to name the company you work for.

What this is

Sometimes we turn information into statistics, or into other information that does not identify anyone. For example, how many boards are in the directory, or a total visitor count.

The homepage shows one public total. The server asks PostHog for the number of distinct person ids and the number of page-view events. It does not look up a company from your IP. That homepage total is not held back when the count is under 10. It still does not name anyone.

How we make partner statistics

For a statistic we publish as research, or share with a partner, we remove names, contact details, account ids, and other direct identifiers. We combine information from many people or businesses. We do not publish or share any such figure based on fewer than 10 people or businesses. Before release, we check that no one can reasonably be identified from the result, on its own or combined with other information that is reasonably available. We will record what we did and repeat the check over time.

Our commitments

We keep this information in non-identifying form. We will not try to re-identify anyone, except to test that our methods work. We do not use it to make decisions about you or to target you with ads or offers.

We use it to run, secure, and improve outbid.fyi, to publish research, reports, and benchmarks, and to share or license it with the partners described in Who we share information with. We will require anyone who receives it to agree in writing not to re-identify anyone, not to combine it with other data to do that, and not to pass it on without the same terms.

De-identified information is different

Some information is only de-identified. A PostHog id is a code for a browser. When identified analytics is on, we can still link that code to your account. That information can still be linked back to you, so we treat it as personal information. We use it only for our own product analytics and to fix the site. We do not give it to partners unless you have agreed (Programs you choose to join).

Service providers

These companies help us run outbid.fyi. They act on our instructions. They may not use your personal information for their own purposes. Where we do not name a region, we have not published one.

PostHog, in plain words

When analytics is on, the browser library records page views (including when you move between pages), clicks, and JavaScript errors. It stores a first-party cookie whose name starts with ph_ and a local storage entry. That cookie lasts about 365 days. Each request still reaches PostHog from your IP address. We tell PostHog not to store that IP. Session replay is off, so PostHog does not record a video of the page.

If you are signed in, and identified analytics is allowed, we send PostHog your account id, email, and name. A profile is created only for people we identify that way.

If our host says you are in Canada and Quebec, we do not send your account id, email, or name. PostHog stays anonymous unless you turn identified analytics on at Your Privacy Choices.

If you opt out, withdraw analytics consent, or your browser sends Global Privacy Control, we do not load PostHog in that browser. We delete analytics cookies and local storage whose names start with ph_ or __ph_. We do not identify you. The same choice stops analytics events that our server would send during that browser visit, such as a checkout event. The public visitor count still works. It is a total, not your visit.

After Stripe confirms a payment, Stripe calls our server. That call does not carry your browser opt-out. We may still record a payment event in PostHog with a listing or sponsor id, an amount, and a Stripe id. Those events do not include your email.

In the EEA, the UK, and Switzerland, and when we cannot tell the country, we do not load PostHog until you agree. Until then it does not set a cookie, write local storage, or send a request.

People and apps you choose

When you pay, you go to Stripe, and Stripe's policy applies to what you type there. When a listing or sponsor card is public, anyone can see the name, URL, and text you gave us. If you open a share link, the site you open receives the page URL because you opened it.

Business and research partners

This section applies on December 1, 2026. Before that date, we do not send data to any business or research partner. On and after that date, this section is in effect.

We may work with partners such as universities and research groups, analytics and market-research firms, and companies that build, test, or supply data for AI and machine-learning systems. By default, partners receive only the statistics and anonymized information described above.

• We will not give a partner information that identifies you for the partner's own use, including training its AI models, unless you have opted in.
• Every partner signs a written agreement. It limits use to the stated purpose, bans re-identification and onward sale, requires security and deletion, and lets us check compliance.
• Before any sharing starts, we will list here the types of partners we actually work with and what they receive. As of October 2026, we do not share personal information with any business or research partner.

Legal and safety reasons

We may disclose information when the law requires it, in response to valid legal process, or to protect people, our rights, or outbid.fyi from fraud or abuse.

Business transfers are in If our business changes hands.

We do not offer these programs today. If we do later, they stay off until you turn one on. Examples:

• Contributing examples to help build or test AI tools.
• Being introduced to a partner's expert network or research study. The partner may pay you directly for your work.

Before you join, we will show you a separate screen that says who the partner is, exactly what we will share, why, how long the partner keeps it, whether it leaves Canada, and whether you will be paid. Saying no does not change how outbid.fyi works for you. Nothing is pre-ticked.

You can leave at any time at Your Privacy Choices or by writing to the Privacy Officer. Leaving stops future sharing. We will also ask the partner to delete what it received, as our agreement with it requires. If your information has already been used to train an AI model, the partner may not be able to remove it from that model. If that applies, we will say so on the sign-up screen.

If you sign up with a partner directly, the partner's terms and privacy policy apply to what you give it. A partner cannot send you marketing email because you agreed to something with us. It has to ask you itself.

This section applies on December 1, 2026. The limits below are already how the site works. Before that date, no data goes to any partner for AI training. On and after that date, this section is in effect.

• We do not sell personal information to train AI models, including large language models.
• We do not let partners train AI models on information that identifies you unless you opt in. If you do, we share only what you tell us to. That program is not offered today.
• We do not use your personal information to train AI models.
• We do send public text from listed board pages to OpenAI so we can read numbers those pages show. That is not training, and it is not your account, email, or name.
• Anyone can see content you post publicly, including search engines and AI crawlers we do not control.

This section applies on December 1, 2026. Before that date, we do not transfer personal information as part of a business sale. On and after that date, this section is in effect.

If Southern East Inc., or one of our sites, is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or insolvency, personal information may be shared with the other parties and their advisers.

• Before a deal closes, we share only what is needed to evaluate it, de-identified where we can. We share it under a confidentiality agreement that limits use to the deal and requires return or deletion if the deal does not go ahead.
• After a deal closes, the new owner may use your information only as this policy describes. To make a material change, it must follow the changes section: 30 days' notice, and your consent for new uses of information it already holds.
• We will tell you within 30 days after a closing in which your information changes hands. We will give you the new owner's name and contact details. You can delete your account before or after.
• A deal whose main purpose is selling personal information is not a business transfer. The rest of this policy applies to it.

• Do Not Sell or Share My Personal Information, and opt out of targeted advertising and profiling. Use the switch on Your Privacy Choices. We do not sell or share personal information today. If that ever changes, this switch already works.
• Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as an opt-out of sale, sharing, and targeted advertising for that browser. We honor GPC one browser at a time. It does not change other browsers where you are signed in. We read the Sec-GPC request header and navigator.globalPrivacyControl. When we have applied it, the choices page shows "Opt-Out Request Honored". GPC does not unsubscribe you from email.
• Optional programs and consents. See and change each one on that page. Withdrawing is as easy as agreeing. It stops future use. It does not undo what was lawfully done before.
• Marketing email. We do not send a marketing list from this site. Emails we send are transactional, such as a sponsor manage link. If we ever send a commercial message, it will have an unsubscribe link, and we will process that within 10 business days.
• Cookies. If you are in the EEA, the UK, or Switzerland, or we cannot tell the country, non-essential analytics stay off until you agree. You can change that choice later on Your Privacy Choices.
• Access, correct, delete, port, object, appeal. Write to the Privacy Officer by mail or on X. We do not have a delete button in the product. We reply within 30 days. We may need to confirm who you are. If we refuse, we will explain why and how to appeal or complain.
• Someone acting for you. An authorized agent can make a request with your signed permission. We may still confirm your identity with you.
• No penalty. We will not charge you more, give you a worse service, or refuse service because you used these choices.
• We confirm every request by email or on screen. If you have opted out of sale or sharing, we will not ask you to opt back in for at least 12 months.

Cookies and similar storage

This section applies to residents of California and other US states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Texas, and Oregon. It is our notice at collection. Last updated: October 2026. The sign-in page, the advertise form, and the listing form link here.

Sale and sharing. In the past 12 months, we have not sold personal information and have not shared it for cross-context behavioral advertising. That means ads that follow you from site to site. This site does not load advertising cookies.

Minors. We do not knowingly sell or share personal information of anyone under 18, and we do not target ads to them.

Sensitive information. We use sensitive personal information only for purposes the law allows without a limit right, such as providing the service and keeping it secure. We do not use it to infer things about you.

De-identified information. We keep and use de-identified information only in de-identified form. We will not try to re-identify it, except as the law allows to test our methods. We require anyone who receives it to make the same commitments in writing.

AI training. See Do we use personal information to train AI?

Your rights. You can ask to know and access, delete, correct, and get a portable copy of your personal information. You can opt out of sale, sharing, targeted advertising, and profiling that has legal or similarly significant effects. In some states you can also get a list of the specific third parties we have disclosed to. We will not treat you differently for using these rights.

How to use them. Write to the Privacy Officer by mail or on X, or use Your Privacy Choices. We reply within 30 days. US law allows 45 days, and one extra 45 days if we tell you why. We will not use that extra time unless we have to. We will confirm your identity first. An authorized agent may act for you with your signed permission. If we refuse, reply "appeal" and we will respond within the time your state's law allows. If you are still unhappy, you can contact your state Attorney General.

Financial incentives. We do not offer any.

You can access, correct, delete, restrict, and get a portable copy of your data. You can also object to processing based on legitimate interests, and you can always object to marketing. Where we rely on consent, you can withdraw it at any time. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

We are based in Canada. The European Commission and the UK recognize Canada as providing adequate protection for organizations covered by PIPEDA. Some providers process information in the United States, including PostHog, Stripe, and Loops. We do not name a specific transfer contract on this page. Analytics stay off for EEA, UK, and Swiss visitors unless they agree.

We have not appointed an EU or UK representative.

You can complain to the data protection authority where you live or work. We would like the chance to help first. Write to the Privacy Officer.

• Person in charge. Our person in charge of the protection of personal information is Rishit Patel. Reach the Privacy Officer by mail at the address above, or on X at @imrishit98. This policy is the public notice. We have not published a separate governance-policy page.
• Purposes and consent. We collect only what we need for the purposes we tell you before or at collection. We ask for consent separately for each specific purpose, in clear and simple terms. We ask for express consent for sensitive information. We will not use your information for a new purpose without your consent, except where Quebec law allows it.
• Privacy by default. Optional sharing and programs are off until you turn them on.
• Identification and profiling. Identified analytics (sending your account id, email, and name to PostHog) is off when the host says you are in Canada and the region is Quebec. If an older analytics id was tied to your account, we delete that stored id before the next analytics event. You can turn identification on at Your Privacy Choices. We do not use a precise location feature.
• Anonymization. We anonymize information only for serious and legitimate purposes, following Quebec's Regulation respecting the anonymization of personal information. We will record each process in a register.
• Outside Quebec. Service providers may process information in the United States or Canada. We do not publish a single database region. Before information leaves Quebec, the law expects a privacy assessment. We have not published that written assessment.
• Research. We disclose information without consent for study, research, or statistics only where Quebec law allows, after a privacy impact assessment and under a written agreement.
• Your rights. You can access and correct your information, withdraw consent, and get your information in a structured, commonly used technological format. You can ask us to stop disseminating or to de-index information. You can also get information about any decision made only by automated processing. We reply within 30 days.
• Complaints. You can complain to the Commission d'accès à l'information du Québec.
• French. This policy is in English. A French version is not published on this site yet.

Small changes. For typo fixes, clearer wording, changes that give you more protection, or a new service provider doing the same kind of job, we update this page and the Last updated date.

Material changes. Examples: a new type of partner, a new purpose for using personal information, sharing information that identifies you where we did not before, starting to use your information to train AI, or weakening any promise in this policy.

• We will tell you at least 30 days before the change takes effect. We will email account holders and show a clear notice on outbid.fyi. The notice explains what is changing, why, and what your choices are.
• A material change applies only to information we collect after it takes effect. We will use information we already hold in a materially new way only if you agree first, by an action such as ticking a box or tapping Yes. Staying on outbid.fyi, or not replying, does not count as agreeing.
• If you do not agree, we will keep handling your existing information under the earlier version. You can also close your account at any time by writing to the Privacy Officer.

This is the first version of this policy. There is no earlier version to archive.

If the law makes us change something faster, we will give as much notice as we can.

Read the Privacy Policy, Terms, and Your Privacy Choices.