Privacy Policy

Effective September 11, 2026. Plain description of what soyouwannabeacreator.com collects, why, who it passes through, how it's protected, and how long it's kept — no ad networks, no data resale.

What we collect

Account data, if you sign inSigning in with Google is optional — bidding works anonymously. If you do sign in, we receive your email, name, and profile picture from that provider. The plain “Sign in with Google” button requests nothing beyond that.

Creator verification data & Google API Services

Only if you choose “Verify with YouTube”, we additionally request read-only access to your YouTube channel (youtube.readonly). We use it to read your channel name, channel avatar, and subscriber count, and to confirm you own the channel you are listing. That channel information is displayed publicly on your creator profile card. We never post, comment, or change anything on your channel, and we request no write access of any kind.

The access token Google issues for this is held on our servers only. It is never sent to your browser, shown to other users, or passed to any third party.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used for advertising, never sold or transferred to data brokers or information resellers, never used to determine credit-worthiness or for lending purposes, and never used to train AI or machine-learning models. No human reads it except with your consent, where needed to investigate security issues or abuse, or where the law requires it.

You can revoke our application's access to your YouTube data at any time via your Google Security Settings page.

By using our service, you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy.

Bid and payment recordsEvery bid — amount, the listing it was for, when it happened, and the payment processor's reference for it — is kept permanently as the audit trail for a real-money product. We never see or store your card number: payments are processed entirely by Dodo Payments, acting as the merchant of record.

Anonymous site usageThe “online now” and “visitors since launch” counters on the site are driven by a random, non-identifying id stored in a cookie — no name, email, or account is attached to it. Your IP address is checked transiently against a rate limit when you place a bid or open the live-activity feed, to stop spam and abuse; it is not retained afterward.

Cookies we set

Cookie	Purpose	Lifetime
session	Keeps you signed in, if you signed in	Until you sign out, or 30 days unused
referral_code	Credits whoever referred you if you sign up	30 days
svid	Anonymous id behind the visitor counters above	~400 days

All three are set server-side and inaccessible to page scripts. None of them are used for advertising, and we do not run any third-party ad or tracking scripts on this site.

Who your data passes through

We do not sell or rent your data, and we do not transfer or disclose it to third parties for any purpose other than the ones below. It is shared only with the vendors that make the service work, each for its own narrow purpose:

Dodo PaymentsProcesses every payment as merchant of record. They see your payment details; we do not.

GoogleOnly if you choose to sign in — for authentication and the creator-verification data described above.

ResendDelivers the outbid-notice email, if your listing gets outbid and you gave us an email address to send it to.

Neon, Upstash, VercelDatabase, rate-limiting/caching, and hosting infrastructure. They store or process data on our behalf; they do not use it for anything of their own.

How we protect your data

Security procedures are in place to protect the confidentiality of your data, including the Google user data described above:

Encryption in transitThe site is served only over HTTPS. Connections from our servers to Google's APIs, to our database, and to every vendor above are encrypted with TLS.

Encryption at restOur database, hosted on Neon Postgres, is encrypted at rest — including the account records and Google access tokens stored in it.

Restricted accessDatabase and API credentials are kept in our hosting provider's encrypted environment configuration, never in source code. Only the site operator can access production data; no other user can, and no vendor uses it for its own purposes.

Google access tokensUsed only on our servers, only to read your channel's stats when you verify or re-sync. Never exposed to browsers, other users, or third parties. Revoking access in your Google account invalidates them immediately.

Minimal access, minimal dataWe request read-only scopes only — never permission to change anything on your accounts. Card details never reach our servers, and IP addresses are used only transiently for rate limiting. Session cookies are server-set and unreadable by page scripts.

If something goes wrongIf a security incident affects your personal data, we will notify affected users by email without undue delay.

How long we keep it

Account data, Google access tokens, and creator verification data are kept only while your account exists, for as long as needed to run the service you signed up for. When you ask us to delete your account, they are deleted within 30 days.
Revoking Google access stops any further reads of your YouTube data straight away. Channel details already shown on a public listing stay until you ask us to remove them.
Bid and payment records are kept permanently, as described above and below.
IP addresses are not retained. Cookie lifetimes are listed in the cookie table above.

Access, correction, and deletion

You can ask what data we hold about you, ask us to correct it, or ask us to delete your account data, including any Google user data we hold. Bid and payment records are kept regardless of a deletion request — they are the audit trail for money that already changed hands and cannot be selectively erased without breaking that trail for everyone else on the board.

If you are in the EU/EEA: we rely on contract (to run the leaderboard you asked to use), legitimate interest (fraud and abuse prevention), and consent (the outbid-notice email) as our legal bases for processing, and you may lodge a complaint with your local data protection supervisory authority. If you are a creator (or an authorized representative) named in a listing you did not submit yourself and want it taken down, the same contact below applies — see also the unauthorized-listings section of the Terms.

Reach us at priyanshurawat2104@gmail.com for any of the above.

This policy may be updated as the product changes. If we change how we use Google user data, we will update this page and notify affected users before the change applies. See also our Terms of Service and bidding rules.