Privacy

Who is responsible

farhan ahmad, ., 68723 Schwetzingen, Deutschland. Full details are in the imprint.

For anything on this page, write to farhan2008hb@gmail.com.

Server logs

The site is hosted by Vercel Inc. Like any web host, Vercel processes the technical data your browser sends in order to deliver the page — IP address, time, requested address, browser and operating system. This is necessary to operate the site and to defend it against abuse (Art. 6(1)(f) GDPR). We do not merge this data with anything else and we do not use it to build profiles. Hosting takes place partly on servers outside the EU; Vercel is bound by the EU standard contractual clauses.

Visitor statistics

We use Vercel Web Analytics to see which pages are visited and roughly where visitors arrive from. It is cookieless: it does not store or read anything on your device, it assigns no persistent identifier, and it does not follow you to other sites. What we see are aggregate counts per page, not individuals. Legal basis: our legitimate interest in knowing which parts of the site are useful (Art. 6(1)(f) GDPR).

Clicks on agent links

When you open an item at a shopping agent, we record which item, which agent, the page you came from, and the time. That is the entire record. No IP address, no browser identifier, no cookie — the entries cannot be traced back to you, and we could not link two of your clicks together if we wanted to. We use the totals to see which finds are worth posting (Art. 6(1)(f) GDPR).

Things stored in your own browser

Your theme choice, your wishlist, your haul and your recently viewed items are kept in your browser’s local storage. They stay on your device, they are not cookies, and they are not sent to us unless a feature on the page explicitly needs them. Clearing your browser data removes them.

Saved wishlists

If you save a wishlist so it survives clearing your browser, we store a random identifier generated on your device together with the item ids you saved. That identifier is not derived from anything about you and is not linked to any other data. You can delete a saved wishlist at any time from the wishlist page, which erases the record.

Accounts

You do not need an account to browse. You need one to post a haul, to vote and to take part in a contest. When you create one we store a username, and — depending on how you signed in — your email address, your avatar and your Discord user id. If you sign in with Discord or Google, we receive those details from them; we never receive your password. Legal basis: Art. 6(1)(b) GDPR, because you asked us for an account.

If you sign in by email, we send exactly one message — the sign-in link — through Resend (Resend Inc., USA), and we store a one-time code for it that expires after 20 minutes. If you use the button that adds you to our Discord server, Discord asks for your permission first and we only ever use it once.

Your account is kept while it exists. You can download everything we hold about you and delete your account at any time from your account page. Deleting erases your username, email, avatar, Discord link and Kakobuy id; hauls you already published stay online without your name, because other people’s votes and comments are attached to them (Art. 17(3) GDPR).

Contest entries: if you enter a Kakobuy user id, we store it and check it against our partner dashboard, which is the only way to confirm the condition that the account was created through our link. That check is done by hand and the result is stored with your account.

Cookies

This site sets a cookie only when you sign in: one that keeps you signed in, and a short-lived one during the sign-in itself. Both are strictly necessary for a service you requested, so no consent banner is required (§ 25(2) TDDDG). There are no advertising or tracking cookies.

Photos you upload

Haul photos are stored publicly, because they are meant to be seen. Before storing, we re-encode every image, which removes the location data phones write into photo files. We cannot remove what is visible in the picture itself — a shipping label with your address, for example. Check your photos before uploading, and ask us to take a haul down whenever you want.

Likes

A like is stored with your account and the time you gave it, so that one account counts once and so that we can find coordinated voting. We also store a shortened, encrypted fingerprint of your internet connection — not your IP address itself, and not anything that can be turned back into it. We cannot use it to find you; we can only use it to see that several accounts liked the same haul from the same connection. We do this because there is real prize money involved and voting rings are certain (Art. 6(1)(f) GDPR — preventing fraud). These fingerprints are deleted 90 days after a season closes, and immediately if you delete your account. We do not store your browser identifier, where you came from, or your location.

We may reduce a like count when votes were not genuine, and we may add likes carried over from our Discord. Where we have added any, the haul page says so with the number and the reason.

Comments and reports

Comments are public and carry your username. We store the same kind of shortened, encrypted connection fingerprint with a comment as with a like, and for the same reason — to see when one person is working several accounts. If you delete your account, your comments stay online without your name, because other people replied to them (Art. 17(3) GDPR), and the fingerprint is cleared straight away. If you report a haul or a comment, we see who reported it — the person you reported does not, and your report is included in your data download.

The leaderboard

If you enter the contest, your username, your haul and its like count appear publicly in the ranking, and the winner’s username and haul are published. That is the service you asked for (Art. 6(1)(b) GDPR). If your haul appears in a public list without you having entered, you can object at any time and we will take it out of the list (Art. 21 GDPR).

You have to be 16 to have an account here, and we store only that you confirmed it — never a date of birth. If you win a prize we ask you once, at that moment, whether you are 18 or over, because for under-18s we need a parent’s or guardian’s confirmation before paying out.

How long we keep things

Account data: while your account exists. Contest documentation, including the final standings and the payout record: 8 years, because it is an accounting document under German tax and commercial law. Connection fingerprints on likes: 90 days after the season closes. Sign-in codes: the link stops working after 20 minutes, and the record of the request — which holds a one-way hash of your connection, never the address — is deleted after 90 days, because it is the only signal we have for spotting one person creating many accounts.

Database

Catalogue data and the records described above are stored with Supabase, on servers in the EU.

Leaving this site

Agent links, marketplace links and the Discord invitation take you to services we do not run. From the moment you arrive there, their privacy policies apply and we have no insight into what they collect. Agent links are affiliate links: the agent learns that the visit came from us, which is how any commission is attributed.

Your rights

You have the right to information, correction, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR), and the right to complain to a supervisory authority. If you have an account, the fastest route is your account page: it can export everything we hold about you and delete it, without asking anybody. For the records described further up — server logs, click counts, anonymous wishlists — one honest caveat applies: they contain no identifier tied to you, so we usually cannot find “your” data on request, because nothing links it to you in the first place.