Skip to content
flexrank

flexrank — Privacy Policy

Effective date: August 25, 2026 · Last updated: August 25, 2026

This document is available in several languages for convenience. In case of any conflict or ambiguity between versions, the English version prevails.

1. Introduction

flexrank ("we", "our", "us") respects your privacy and is committed to protecting the personal data of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website and multi-social pay-to-rank platform (the "Service"). By using the Service you acknowledge that you have read and understood this policy.

2. Data we collect

A. Information you provide directly

  • Account information — when you register via Firebase Authentication (email/password, Google, GitHub) we collect your email address, display name, authentication identifier, and avatar URL.
  • Social profile data — when you feature, bid on, claim, or verify a handle (Instagram, TikTok, YouTube, Twitch, Kick, X, LinkedIn, GitHub, Spotify, Substack, or a Discord server via its public invite link) we store the public handle, profile URL, and public metadata (display name, bio, follower counts, avatar) collected from the platform's public pages.
  • Transaction data — payments are processed by Stripe; we never store complete card numbers or bank details. We store transaction history, amounts, voucher usage, and the payment method type.

B. Data collected automatically

  • Log and usage data — IP addresses (transiently, for security and rate-limiting), browser type, and timestamps.
  • Anonymized click tracking — to count unique profile clicks we store only a one-way cryptographic hash of the visitor's IP combined with a salt that rotates daily and is never persisted. The original IP cannot be reconstructed.
  • Cookies and local storage — only technical ones: interface language, theme, cart contents, and the Firebase session. No advertising or profiling cookies are used, so no cookie banner is required.

3. How we use your information

To operate the ranking directory (bids, leaderboards, activity ticker); to manage accounts and vouchers; to process ownership verifications and disputes; to deliver web push notifications and transactional emails you have opted into or that relate to your account activity (outbid alerts, receipts, voucher expiry); to prevent fraud and abuse; and to comply with legal, tax, and accounting obligations.

4. Legal bases (GDPR)

Where the GDPR applies: performance of a contract (bids, account management), legitimate interest (security, fraud prevention, anonymized analytics), consent (web push notifications), and legal obligation (accounting records).

5. Third-party processors

We share data only with providers needed to operate the Service: Firebase / Google LLC (authentication), Stripe (payments), Neon Inc. (PostgreSQL database and API hosting — region AWS us-east-2, USA), Netlify (web hosting and CDN), and our transactional email provider (SMTP). Where these providers process data outside the EEA (in particular Neon/AWS in the United States), transfers are covered by Standard Contractual Clauses and equivalent safeguards. Public social metrics are fetched directly from the respective platforms' public endpoints; no personal data of yours is sent to those platforms. We do not sell, rent, or trade personal information.

6. Data retention & security

  • Click-tracking hashes are deleted after 90 days; activity-ticker entries after 90 days.
  • On account deletion your profile is anonymized immediately (email, name, and identifiers removed); bid and payment records are retained in anonymized form as required by accounting and tax law.
  • Verification codes expire automatically and are single-use.
  • We protect data with TLS encryption, salted hashing, least-privilege database access, and audit logging of administrative actions.

7. Your rights

Under applicable laws (including the GDPR) you may access, correct, or update your data; request erasure ("right to be forgotten" — available in-app via account deletion); object to or restrict processing; withdraw push-notification consent at any time from your browser or the settings page; and lodge a complaint with your supervisory authority. Contact: privacy@flexrank.net.

8. Changes

We may update this policy at any time; changes are posted on this page with an updated date. Material changes are announced in-app.

9. Contact

privacy@flexrank.net · support@flexrank.net