Privacy
Goldseat.lol has no accounts. There is nothing to sign up for and no profile to build, which is also why this page is short: there is no user table, no password, and no personal data submitted on your behalf by anyone.
What is actually stored
This is the whole list, and it is written against the database schema rather than a template — if a field exists on the site, it is on this page.
| What | Why | How long |
|---|---|---|
What you submit The URL or domain name, and optionally a name, tagline, description and category. This is published on the site and is not private — it is the listing. | It is the product. There is no other content on the board without it. | For as long as the listing is up. A free listing never expires. |
A hash of your IP address A SHA-256 digest, used only as a key to count requests per time window. The address itself is never stored and the digest is never read back. | Rate limiting — stopping one person from mass-submitting listings or exhausting the checkout endpoint. | Until the rate-limit window closes, then the record deletes itself. At most an hour or ten minutes. |
Outbound click counts A running total on your listing of how many times someone clicked through to your site. No record of who, from where, or of any individual visit. | It is the public number on your row. It is the only measure of a boost that is not a claim. | For as long as the listing is up. |
Boost and payment records The listing, the amount, the dates, and a reference to the transaction with our payment processor. No card number ever reaches us. | Establishing what a rank was paid for, and handling a refund or chargeback correctly. | While the boost runs, then as a financial record. |
Failed payment attempts The listing, the amount attempted, the processor's error code, and when. Kept so a declined card can be reported as declined rather than as still processing. | Telling you the truth about why a payment did not go through. | 30 days, then deleted automatically. |
Aggregate page analytics Which pages were viewed and when, collected by Google Analytics. | Knowing which pages are read, so effort goes where it is useful. | As configured in the analytics account, which is not set by this site. |
Why the IP hash is a hash
Rate limiting needs a stable key per visitor, and the obvious one is an IP address. But a stored address is a stored address: dump the database and you have a list of who visited. So the address is hashed with SHA-256 and only ever used as a bucket key — it is never read back, never displayed, and never leaves the counter. Someone with the database can already read every listing, which is public anyway; the hash just means the rate-limit collection is not additionally a visitor log. This is tidiness, not anonymity, and it is worth being straight about the difference.
Who else touches your data
- Payment processor. Checkout and card handling happen entirely on the processor's side. They receive the amount and the listing reference; we receive a confirmation. They are the merchant of record for tax and chargebacks, and they hold the card details.
- Database and hosting. The site is hosted on Vercel and stores data in MongoDB Atlas. Both are processors acting on our instructions.
- Google Analytics. Sets its own cookies and has its own privacy policy, which we do not control.
- When you click through. Your product's site sees you from the moment you leave, under its own policy. We count the click and know nothing further.
Your rights
Under GDPR you have the right to access, correct, delete or export your personal data, and to object to processing. In practice there is very little to exercise it over: there is no account holding data about you, and the only personal data we hold is what you chose to put in a listing. To have a listing corrected or removed, write to aryanthakore24@gmail.com. We respond to deletion requests within 30 days. If you are in the EEA and we cannot resolve a complaint with you directly, you may complain to your local supervisory authority.
Children
The site is a business directory and is not directed at children. We do not knowingly collect data from anyone under 13.