No account. Still your data.

This notice describes data handling for the BestInWorld.lol service in Cyprus. Send privacy enquiries and requests to throne@bestinworld.lol. You do not need an account to contact us.

Public listing information

The name, description, website or social handle and image URL you submit, plus category, location, paid amount and reign dates. We use this to deliver the listing you request and record crown history.

Purchase and receipt records

Checkout drafts, amount, payment provider references, purchase and refund status, timestamps and a hashed private access token. A checkout email may also be retained if supplied. We use these records to process purchases, provide receipts, prevent duplicate delivery and handle refunds or disputes. Unpaid checkout drafts can also be stored.

Optional email alert information

Your email, consent timestamp, reign reference, unsubscribe token and delivery status. We use these only to provide the crown-loss alert you request. Your Stripe checkout email does not automatically opt you into this alert.

Activity and security information

A random browser identifier and first/last activity timestamps support visitor and online counts. Request IP addresses are used to derive rate-limit keys; infrastructure providers may also process IP addresses, device/request details and operational logs to deliver and protect the site. A random identifier is pseudonymous, not a guarantee of anonymity.

Listing visibility measurements

Homepage card views and website-link clicks are deduplicated with a daily hashed browser/reign/placement/event key. We retain that key, the reign, placement, event type, payment mode and timestamps for historical receipt reporting, with no automatic expiry currently. Only aggregate counts are shown to the private receipt holder; browser identifiers and event keys are not shared with them. These estimates do not prove unique people, sales or advertising results. See the measurement details.

Messages you send us

Your email, message and any purchase information you choose to supply are used to respond to support, privacy, safety and payment enquiries.

Where data protection law requires a legal basis, we rely on performance of a contract for purchase fulfilment; consent for optional crown-loss email; and legitimate interests in site security, service operation and handling enquiries, subject to your rights. We also retain information when required by legal obligations. Local rules may require additional permission for browser measurement; see cookies and browser storage.

Current and historical crown listings are public. Other visitors can view, copy and share the information in them. Do not submit private addresses, telephone numbers, sensitive information or someone else’s personal content without permission. An optional photo can identify a person just as a name can.

We may announce a paid crown takeover on our X account using the public holder name, category, location, crown amount and a link to the public listing. X processes these public posts under its own privacy policy. Alert email addresses and private receipt links are not included.

We do not publish your alert email, payment provider references or private receipt token in public crown listings. Anyone holding your private receipt link can access the purchase status and related notification preference; keep that link private.

Images supplied by users may load directly from another website. That host can receive request information, including your IP address. Clicking a listing’s external link takes you to a separate service with its own privacy practices.

• X hosts public takeover announcements and processes interaction with those posts under its own privacy policy.
• Apple iCloud Mail provides our support mailbox and processes messages sent to our support address.
• Cloudflare hosts and protects the website and processes network requests.
• Neon provides the PostgreSQL database for listing, purchase, activity and alert records.
• Stripe processes payment information and may use it for its own fraud prevention and regulatory responsibilities. Card numbers and security codes are entered on Stripe’s checkout, not stored in our application database.
• Resend delivers optional crown-loss emails and processes the recipient address, message and delivery information.

These providers can process information outside your country. Data protection rules and any required transfer safeguards depend on the provider, processing location and applicable law. Contact us for information about the arrangements relevant to your data. We do not sell your personal data or use the crown-alert list as a newsletter.

• Listings and reign history remain while we operate those public records, unless removal or restriction is appropriate. Ending a reign does not automatically delete its history.
• Purchase and refund records, including unpaid attempts, are retained to operate receipts, resolve payment problems and meet applicable accounting or legal requirements. We do not currently automatically erase them when checkout expires.
• An alert email remains while that alert is active or being retried. The application clears the recipient address and stored message payload when delivery is accepted, the alert is cancelled, or delivery is marked as permanently failed. Consent, status and delivery references remain. Copies held by an email provider or in backups have their own retention lifecycle.
• The visitor cookie lasts up to one year from its latest refresh. The corresponding first/last-visit database record is currently not automatically removed when the browser cookie expires. Rate-limit counters expire for enforcement after one minute; stale records are periodically cleaned up during traffic.

We assess support messages, security logs and other retained data according to their purpose, ongoing disputes and applicable obligations. To request deletion or ask about a particular record, email us. Clearing browser storage does not itself erase information already held by the service or its providers.

Depending on the law that applies, you can request access, correction, deletion, restriction or a portable copy of your personal data, and object to processing based on legitimate interests. You can withdraw alert consent without affecting processing that took place before withdrawal.

Turn off an alert from its private receipt or use the unsubscribe link in the email. For other requests, contact throne@bestinworld.lol. We may ask for limited information to verify your connection to a purchase or listing. Do not send card security details or private access links.

A listing’s no-edit rule does not remove data protection rights. We may need to keep certain records for legal obligations or disputes, and will explain relevant limitations. You can also complain to the competent data protection authority, including the authority where you live or work where applicable.

Crown purchases are intended for adults aged 18 or over. Do not use listings to expose children’s private information or sensitive personal details. If you believe a listing violates someone’s privacy, report it so we can review it.

We update this notice when the service or its data handling changes. The date above identifies the current version. A new notice does not automatically enrol you in email alerts or create an account.