Privacy Policy

1What we store

• The domain you submit. It is your identity on the board and it is public.
• Your order. Which pack, the amount, the Stripe session and payment identifiers, and its status. This is our record that a pack was paid for.
• Your cards. The six trait values, rating and mint time of every card pulled for your domain, and its dust balance and ledger.
• Click counts. The number of visitors the board has sent to your site, shown publicly as your Reach. This is a count, not a profile: we do not store who clicked.
• The email you paid with. Passed to us by Stripe on a confirmed payment and held against your buyer record, so you can sign back in and recover your collection. It is never shown on the board.

That is the whole list. There is no account, so there is no name, no password and no profile. We do not run an analytics or advertising script on this site, we do not use third-party tracking pixels, and we do not sell or share any of the above with anyone.

2Payment details never reach us

Payments are taken by Stripe. Your card number, expiry and security code are entered on Stripe’s own checkout page and are never sent to, seen by, or stored on OutRip. We receive back only the fact that a payment succeeded and the identifiers needed to match it to your order.

Stripe collects your email address to send you a receipt, and handles it under its own privacy policy at stripe.com/privacy. Stripe passes that address back to us on a confirmed payment and we store it against your buyer record, for one purpose only: it is what lets you sign back in and recover your collection after clearing cookies or switching device. We do not send you marketing.

3The two cookies

OutRip sets exactly two cookies. Both are strictly functional, both are HttpOnly — meaning no script on any page can read them — and neither is used for advertising or tracking across sites.

• outrip_pending — set when you start a checkout, holding the order you are buying, signed. It is what lets you get back to a pack you paid for if the tab closes before it opened. Expires after 30 days.
• outrip_buyer — set when you start a checkout, holding an opaque buyer id, signed. It holds no domain and nothing about you. It is what shows you your collection and authorises trading your cards in, and it is signed precisely so that nobody can point it at somebody else’s collection. Expires after one year.

Clearing them costs you nothing but the collection view; your cards and your board position are held against your buyer record and your domain, not against the browser, and signing back in with your Stripe email returns them. Your theme preference is kept in your browser’s local storage and never sent to us.

4Who processes the data

• Stripe, Inc. — payments. United States.
• Supabase — the database holding orders, cards and products. United States.
• Vercel, Inc. — hosting and delivery. Server request logs, retained by Vercel on its own schedule.

OutRip is operated from the United States and the data above is stored there. If you use the product from outside the US, you are sending it there.

5How long we keep it

Orders and their payment identifiers are kept for seven years, because they are financial records. Cards, products and board entries are kept for as long as the board runs — a leaderboard is a historical record, and removing an old entry would change everyone’s rank behind it.

6Your choices

Email hello@thecompound.tech and we will, without charge:

• tell you everything stored against a domain you control;
• remove your product from the board and delete its cards and dust;
• restore your collection view on a new browser, using your Stripe receipt.

Depending on where you live you may also have rights to correct, port or restrict what we hold, and to complain to a data protection authority. We will honour those requests wherever you live rather than checking whether we have to. We may need to keep the order record itself to satisfy clause 5.

7Children

OutRip is not for children. It is sold to people aged 18 or over who are promoting a product, and we do not knowingly collect anything from a child. If you believe a child has used it, email us and we will delete what we hold.

8Changes and contact

If this policy changes, the date at the top changes with it, and any change that widens what we collect will be described on this page before it takes effect.

OutRip is operated by Compound Labs, New York, NY. Privacy questions and deletion requests: hello@thecompound.tech. The terms of service cover the rest.