Operator and scope
Richard Neckar, an individual based in Texas, United States, operates OwnTheSpot. Contact [email protected] with privacy questions or requests. This policy explains the OwnTheSpot website, advertiser accounts and advertising features.
Website and support
OwnTheSpot does not use third-party advertising trackers or analytics scripts. Hostinger and Cloudflare may process network addresses, browser information and technical logs to deliver and protect the site. Cloudflare may use security features and cookies for that purpose.
If you contact support, we use your email address, message and relevant attachments to respond, investigate issues and maintain support records. Do not send passwords, sign-in codes or full card details.
Advertiser accounts
Sign-in uses a short-lived code sent to your primary email instead of a password. The application stores your normalized email, account status, verification time, listing associations and hashed session and challenge records. Plaintext sign-in codes and session tokens are not kept in the application database. Essential account and security messages may be sent to that email.
Listings, payments and public information
Submitted details may include destination URL, name, tagline, category and an optional logo. A selected website logo may be obtained from public metadata, checked and stored instead of hotlinked. Pending logos and requested changes remain private while reviewed.
Approved listing information, exact board bid totals, qualified visit counts, rank and completed top-15 archives are public. Account emails, private complaints, pending changes, moderation notes and fraud signals are not part of the public listing.
Stripe collects payment details through hosted checkout. OwnTheSpot receives payment identifiers, amounts, currency, status, accepted policy versions and information needed to manage purchases, refunds and disputes. OwnTheSpot does not directly collect full payment-card numbers or bank credentials. Stripe processes payment data under its own privacy policy.
Cookies and qualified visits
First-party secure cookies support sign-in and visit counting. A listing-specific cookie lasts 24 hours to avoid counting repeat outbound visits. An internal-browser exclusion cookie can last one year. These cookies are HttpOnly, Secure and SameSite=Lax.
Limited network and browser information is used to derive one-way identifiers for sign-in protection, rate limits and visit deduplication. Raw network addresses and full browser identifiers are not stored in the application database. Temporary rate-limit records are deleted and report fingerprints anonymized after 48 hours. Obvious bots and repeat activity do not count as qualified visits.
Emails and choices
Essential messages may include sign-in codes, receipts and security notices. Outbid notifications, when enabled, are checked every three hours and go to the affected advertiser’s email when a listing loses number one or leaves the top 15. These alerts can be turned off in account settings. They never trigger bids or charges. The optional daily digest is not available. Marketing email is not part of the launch plan.
Service providers and disclosure
Hostinger provides hosting, database and support-email services. Cloudflare provides network security and administrator access. Stripe processes payments and receipts. Google Drive stores encrypted recovery backups. These providers process information needed for their services under their own terms and privacy policies. Processing may occur outside your location.
We do not sell account information or use it for third-party targeted advertising. We may disclose information where necessary to comply with law, handle disputes, protect the service or respond to fraud and security incidents.
Retention and backups
Records are retained as needed to operate accounts and listings, resolve support requests and disputes, prevent fraud and meet applicable legal and financial-record obligations. Closing an account is not immediate deletion of every record. Public completed-board archives may remain available.
Recovery backups contain durable account, listing, payment and review records but omit active sessions and temporary security identifiers. Backups are encrypted and stored in the project’s private Google Drive folder. Local backup copies are retained for 30 days; Drive copies currently have no automatic deletion schedule. Deletion requests are reviewed with backup retention and legal obligations in mind.
Your requests and account closure
Contact [email protected] to request access, correction or deletion of personal information. We may verify your identity before responding. Requests are reviewed against applicable obligations and legitimate retention needs.
A closure request after fresh sign-in hides your listings, ends active sessions and stops new purchases. Support reviews any further data deletion. You may disable outbid alerts separately without closing your account.
Changes
Updates to this policy will be published with a revised date. Material new uses of information will be described before they are introduced.