Privacy

Where this site needs to tell visitors apart — to rate-limit bids, to count a link click once rather than fifty times, and to show an approximate “online now” number — it stores a salted SHA-256 hash of the address, truncated to 32 hexadecimal characters. The raw address is used to compute that hash in memory and is never written to disk.

The salt is a secret held only by the server. Without it the hash cannot be reversed or matched against an address you already hold.

Stored with the bid: the destination URL you supply and its domain, the title, description, icon and preview image fetched from that URL, the amount, the payment identifiers returned by Whop, a hashed IP, your browser user-agent string, and the exact version and timestamp of the paid-placement disclosure you accepted.

The user-agent and disclosure record exist for one reason: if a payment is later disputed, they are the evidence of what you were shown and agreed to at the moment you paid. A placement that goes live is public by design — its URL, title, description and the amount paid are shown to everyone.

Stored: your email address, which board you said you were interested in, where the signup came from, a hashed IP, a hashed session identifier and your user-agent string. The email is used to tell you when the board opens. It is not sold, rented, or used for anything else.

Simply opening the waitlist page also records a counter row: the same hashed session identifier, when it was first and last seen, and how many times it returned. It exists so we can tell how many people arrived versus how many signed up — without it, an empty list cannot be told apart from an empty room. It contains no email, no address and nothing typed into the page, and your IP address itself is never written.

There are no advertising cookies, no third-party analytics, no tracking pixels, no session recording, no fingerprinting and no cross-site tracking. No profile is built about you. Nothing on this site is sold to a data broker, because nothing collected here would be worth buying.

Whop processes every payment and is the party that handles your card details. This site never sees or stores a card number. What Whop collects is governed by Whop’s own privacy policy.

Neon hosts the database and Netlify serves the site. Both hold data on Daniel Lomonaco’s behalf and neither uses it for their own purposes. Outbound links you click carry a campaign tag identifying this site as the source; the destination will see that, as it would see any referrer.

Placement and payment records are kept for as long as the placement is public and afterwards for as long as tax, accounting and dispute-resolution obligations require. Visit and click records are aggregate counters keyed by hash and are kept only while they are useful for abuse prevention. Waitlist emails are kept until you ask for removal.

Write to support@overthrone.lol to ask what is held about you, to correct it, or to have it deleted. Include the email address or the placement URL so the record can be found — a hashed IP cannot be looked up in reverse, so it is not a usable identifier for a request.

Deleting a paid placement’s record does not refund it; refunds are governed by the terms, and placement fees are final and non-refundable.

If this policy changes materially, the date at the top changes with it. The disclosure version stored against each bid records what was in force when that bid was made, so a later change cannot rewrite what you agreed to.