Privacy Policy

Effective August 26, 2026. Last updated August 29, 2026.

This policy explains what joyrank (https://joyrank.lol) collects when you browse the board, click a listing, or pay for a placement — and what happens to it afterwards. It sits alongside the Terms of Service.

The short version: we collect very little, we sell nothing, and we run no advertising trackers. The one thing we do keep that identifies a device is your IP address, and only for 7 days. The Service has no accounts and no passwords. The only piece of personal data we genuinely need from you is an email address, and only if you buy a listing.

Who is responsible

The controller for personal data processed through the Service is Zhilong Huang, Ottawa, Ontario, Canada.

Privacy contact: support@joyrank.lol — we reply within 48 hours.

What we collect

If you buy a listing

• Your email address. Required. We use it to send the order confirmation and to warn you the moment someone outbids you. It is stored with your listing and is not shown publicly.
• What you submitted: the destination URL or X handle, the display name, description, category, and bid amount. All of this is public — see below.
• Payment records: the order and checkout identifiers returned by Waffo Pancake, the amount, and the confirmation message Waffo Pancake sends us. That confirmation can include the billing email and country Waffo Pancake holds for you. We keep it as our record that the payment happened.
• Card details never reach us. They are entered on Waffo Pancake’s checkout. We have no access to card numbers, expiry dates, or security codes at any point.

If you only browse

• A random browser token. Your browser generates a random identifier and keeps it in its own local storage under jr_token. We store that token with a “last seen” timestamp so the board can show how many people are here right now and how many have visited in total. It is not linked to your name, your email, or your purchase, and it never leaves this site.
• Your theme choice is saved in your browser under jr_theme. It stays on your device and is never sent to us.
• Page visits. When a page loads we record the path you opened, the page that referred you, a two-letter country code supplied by our host, and your IP address. We use this to see where visitors come from and to spot abuse. These records are deleted automatically after 7 days. They are not linked to your name or your purchase, they are never sold, and they are never used for advertising.
• Clicks on listings. When you follow a listing we record which listing, the time, the referring page, and a two-letter country code supplied by our host. The click itself is not stored with your IP address or your browser token. Click totals are public because they are what a buyer paid for.
• Ordinary server logs. Our hosting provider processes standard request data — IP address, user agent, requested URL — to serve pages and block abuse. We do not build profiles from those logs.

If you try to sign in to the admin area

The admin area at joyrank.lol/admin is for the operator only. Failed sign-in attempts are recorded so that repeated guessing can be blocked. Each record holds a one-way hash of the IP address — never the address itself — plus a timestamp, and it is deleted automatically after 24 hours.

If you email us

We keep the correspondence for as long as we need it to answer you and to hold a record of complaints and takedown notices.

Cookies

joyrank sets no cookies of its own. The preferences above live in your browser’s local storage, not in a cookie, and are never transmitted for advertising.

No analytics or advertising script is loaded on this deployment. If we add one, this page will say so before it goes live.

Why we are allowed to use it

• Performing our contract with you — taking the payment, creating or raising your listing, showing your rank, and emailing you when you are outbid.
• Our legitimate interests — keeping the board honest (bot filtering, rate limiting, duplicate-click suppression), showing aggregate visitor and click counts, diagnosing outages, and defending legal claims. You can object to this at any time; see “Your rights”.
• Legal obligations — keeping tax, accounting, and complaint records for as long as the law requires.

What is public

Rank, amount paid, display name, description, destination link, and click count are public by design. They appear on the board, on the listing page, in the sitemap, and in the share image — search engines and AI crawlers index them. Do not submit a listing if you do not want that information public. Your email address is never shown publicly.

We fetch public metadata (title, description, favicon, preview image) from the destination you submit so visitors can recognise it. That request tells the destination’s server that joyrank.lol asked for the page.

Who else touches this data

We use a small number of providers, each for one job:

• Waffo Pancake — merchant of record and payment processor. It operates the checkout, and it is the party that receives and handles your card details under PCI-DSS; it also handles tax and payment disputes. Card numbers, expiry dates, and security codes are never transmitted to or stored by us. Waffo Pancake is a controller in its own right for the payment; www.waffo.ai.
• Vercel — hosting and edge network. Processes requests and server logs.
• Our database provider — stores listings, payments, clicks, and email addresses.
• Resend — sends the transactional emails only (order confirmation, outbid notification). We send no marketing email.
• Advisers and authorities — if we must disclose something to comply with the law, enforce the Terms, or investigate fraud. If the project is ever transferred, data moves with it and this policy continues to apply until the new operator publishes its own.

We do not sell personal data, and we do not share it for advertising. Some providers operate outside your country. Where a transfer needs a safeguard, we rely on the standard contractual clauses or equivalent mechanism that provider offers.

How long we keep it

• Listings and click history — for as long as the listing is on the board, plus a limited period in backups and historical records after it is removed.
• Email addresses — while the listing is live, then for as long as needed for tax, accounting, and dispute records.
• Payment records — for the statutory retention period that applies to accounting records.
• Browser tokens — until you clear your browser storage. Inactive tokens age out of the online counter automatically.
• Server logs — for the short window our hosting provider retains them.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or export the personal data we hold about you, to object to processing based on legitimate interests, and to withdraw consent where we relied on it. Email support@joyrank.lol and we will act within 48 hours, and in any case within the time the law allows.

Two practical notes:

• We may need enough detail to find your records — usually the listing URL or the email you paid with.
• Deleting a listing removes it from the board. It does not reverse the payment, and it does not remove information that is also published on your own site or X profile.

You may also complain to the data protection authority where you live. If the GDPR applies to you and you are outside our country of establishment, you can complain to your local supervisory authority.

Security

The Service runs over HTTPS. Card data never reaches our systems. The admin area sits behind a password stored only as a scrypt hash, its session cookie is HTTP-only so no script can read it, repeated failed sign-ins are rate limited, and the whole area is excluded from search engines. No system is perfectly secure; if a breach ever affects your data, we will notify you and the relevant authority as required by law.

Children

The Service is for adults and we do not knowingly collect data from anyone under 18. If you believe a minor has used it, contact us and we will delete what we can identify.

Changes

We update this policy when the Service or the law changes. The date at the top is the current version. Material changes are announced here before they take effect.

Terms of Service·Refund & Delivery Policy·Contact·Rules