Privacy Policy

Last updated 2026-08-30

This explains what whowins.lol collects when you use whowins.lol, why, and what you can ask us to do about it. We have tried to keep it specific rather than general. The operator named at the bottom of this page decides what is collected and why, and is the one to write to about any of it.

If you only browse

We do not ask you to sign up, and nothing here is an advertising or tracking cookie. Page views are measured, but by a cookieless provider that collects no personal data.

A one way fingerprint of your network address, browser and language

Stored as a hash, not as the address itself. Used to count outbound clicks without counting the same visitor twice, and to spot automated traffic. We cannot reverse it back into your address.

Country code

Sent by our network provider. Used to spot unusual traffic patterns.

Outbound clicks

When you click through to a listed product we record that a click happened, with the same one way hash, so the product owner can see how much traffic we sent. Repeat clicks from the same visitor within an hour are not counted again.

Page views

Counted by DataFast, a cookieless analytics provider. It sets no cookie and gives you no identifier, so we see how many people opened a page, never who they are.

Bot check

Cloudflare Turnstile runs before a link is added or a seat is paid for. It is a privacy focused check that does not profile you across sites.

We set one cookie, and only to remember whether you chose the light or dark theme. It carries no identifier.

If you add a link

Your email address

Used to send your invoice and to reach you about your listing. Never shown on the site, never sold, never used for marketing you did not ask for.

The name, link, description, category and logo you add

Public by design. That is the listing.

The emails we send you

We keep a copy of every notification we send about your listing: the address it went to, the subject, the text, whether it arrived and the reason if it did not. It is how we can tell you what we sent and prove we tried.

If you pay

Payments are processed by a merchant of record, which appears as the seller on your statement, issues your invoice in its own name and handles sales tax and VAT. It receives your email and billing details directly and is responsible for them under its own privacy policy. We never see or store your card details. We keep the transaction reference, the amount, the currency and which seat it was for, so we can answer questions about a payment.

Why we are allowed to hold it

• Your email, your listing and the payment record: because we cannot deliver the seat you bought or answer a question about it without them. It is the contract between us.
• Click hashes, country codes and failure logs: because we have a real interest in knowing the site works, in counting traffic honestly and in keeping automated abuse off the boards, and none of it identifies you by name.
• Payment records we have to keep for accounting: because the law says to keep them.

How long we keep things

• Click hashes and click records: kept while the listing exists, because they are what the traffic count is built from.
• Failure logs: capped at the most recent 500 entries; older ones are deleted automatically.
• Product listings: kept until you ask us to remove them.
• Notification records: kept while your listing is on the site. If you ask us to remove the product and its history, these go with it.
• Payment records: kept as long as we are required to keep them for accounting.

Who else sees it

Our infrastructure runs on Cloudflare, which processes requests and stores the database and images. The merchant of record processes payments. Notification emails are sent through Cloudflare Email Service, with Resend as a backup route if that fails. DataFast receives a cookieless page view count and nothing that identifies you. We do not sell data and we do not share it for advertising.

These providers run on servers outside Türkiye, so hosting your listing and sending you an email means the data crosses a border. We use providers that publish their own data protection terms and commit to a recognised transfer mechanism for exactly this.

Your choices

Write to info@whowins.lol to get a copy of what we hold about your listing, to correct it, to have it sent to you in a portable form, or to have your product and its history removed. We reply within two business days. Removing a listing also removes it from public leaderboards.

You can also object to what we do with it, or ask us to restrict it while a question is open. If you think we have handled your data badly and our answer does not satisfy you, you can complain to the data protection authority where you live. In Türkiye that is the Personal Data Protection Authority (KVKK).

Children

The service is not aimed at children and we do not knowingly collect data from them.

Changes

If we change this policy we update the date at the top. Material changes will also be noted on the site.