Privacy Policy: what changed
AI summary
AI-written reading aid: changes between these versions. The linked published versions are the authoritative text.
- Adds referrals, request-location and email-engagement fraud records read by a person, and an optional phone lookup with tick-box texting and STOP.
- Replaces the single consent banner with separate analytics and advertising choices, limited to eligible static pages and blocked by query strings; an old combined acceptance requires a new choice.
- Details browser storage, including tab-specific buyer request and recovery state that can include names, email, phone and transfer details.
- Adds GoDaddy and public blockchain visibility to the recipients, noting Gram payments stay publicly visible.
- Keeps the offer and sale retention windows but adds operator-reviewed disposal, hold checks, and separate review of backups, mailbox and processor copies.
Wording changes
Removed text is struck through; added text is underlined.
Unchanged paragraphs are omitted. Link destinations appear in brackets.
In short. This site has no accounts and nothing to log in to. It collects personal data in exactly one place — the formswhen you fill in a form — to make an offer or, buy a domain, or refer a buyer — and, with each of those, it records where the request came from. Email we send you about an offer or a purchase records whether it was opened and which links were clicked. Both are for online fraud prevention, both are described below, and both are read by a person. A phone number you choose to leave with an offer is checked once, and is texted about that offer only if you tick the box asking for texts — reply STOP and it loadsis not texted again. The pages also load analytics and advertising scripts from Google thaton seteligible theirstatic ownpages, cookieswith independent choices for analytics and advertising. Buyer and recovery pages do not load those scripts. Everything else on the page works without knowing who you are.
Every field belowin the four subsections that follow is one you typed yourself, with one exception named where it occurs: what comes back from the phone lookup. NothingThe onthree subsections after them describe the other things this listsite isrecords inferredthat you did not type: where a request came from, boughtwhether an email we sent you was opened, orand collectedwhat ina thetext backgroundmessage to you led to.
The offer form collects your first name, your email address, the domain and amount you are offering, and — if you choose to fill them in — your last name, phone number, a message, and a proposed payment plan. We need this to read your offer, reply to it, and negotiate. If you give a phone number, we send it to Telnyx once to check that it is a working number and whether it can receive text messages, and we keep what comes back — the country, for US numbers the city and state, the line type, and the carrier — with your offer. If you also tick the "Text me about this offer at this number" box, we may text that number about your offer: the seller can send you a short message, and a day after we send a reply that bounced or shows no sign of having been opened, we send one automatic text asking you to check your email. Leave the box unticked and the number is never texted; it is only shown to the seller. Texts we send, replies you send, and whether each text was delivered are kept with the offer. Reply STOP to any text and no further texts are sent to that number. Choosing to send the offer through Telegram instead hands the same details to Telegram's own service.
Referring a buyer
The referral form collects your name and email address, the domain(s) you are referring, and — about the person you are recommending — their email address and whatever else you choose to add: their name, company, and a short message about how you know them. We use this to attribute a referral commission if that person completes a purchase of one of the domains you named, within the program's window, and so we can reach out to them about those domains — that follow-up is the point of a referral introduction. Registering a lead does not add them to any marketing list, and submitting the form does not itself send them anything; the message it sends is to us, so we can decide whether and how to follow up. We never use a lead's details for anything unrelated to the domain(s) you named. By submitting the form you confirm that they are happy for us to contact them about those domains. See Refer a buyer [/refer/] for the full program terms.
What we record about the request
When you submit any of the forms above, or open a checkout, we store — alongside what you typed — the IP address the request came from and the country, region, city, and network operator that Cloudflare, which serves this site, derives from it. We use this for online fraud prevention: to assess whether a submission is genuine before acting on it. It is shown to the seller next to the submission, it is never used to decide automatically — a person reads it, and every offer is answered by a person. It is never used for advertising. It reaches only the seller — by email and, for offers, through the seller's private Telegram chat (see Telegram in Section 3) — and no one else in Section 3 besides Cloudflare, which produced it. Offers sent through Telegram carry no such record; Telegram does not pass an address to us.
Email engagement
Email we send you about your offer or purchase — a counter, a message from the seller, a payment prompt, a thank-you code — contains a tracking image and tracked links. When your mail client loads the image, or you follow a link, we record the time, the IP address, and the same derived location as above. We use this for online fraud prevention and to know whether a counter or a payment prompt actually reached you, so a stalled negotiation can be followed up rather than assumed dead. Every such email says so in its footer. Reading the plain-text version, or blocking remote images, prevents the open from being recorded while the email still works; the links still work either way, and following one is recorded. Many mail providers load images through their own servers, in which case the location recorded is theirs, not yours, and we mark it as such.
Text messages
We text only a number whose owner ticked the "Text me about this offer" box on the offer form; the box is unticked unless you tick it, and giving a phone number is not, by itself, agreeing to texts. Message frequency may vary: expect at most a few texts per offer, each about that offer and nothing else. A text from us never contains a link — it tells you a reply is waiting in your email, or carries the seller's own words, and nothing else. The automatic text is sent at most once per offer, a day after we send the newest reply we emailed you — a counter, or a message from the seller — and only if that reply bounced or shows no sign of having been opened (an email client that fetches images on your behalf counts as a sign), and not at all if the seller has already texted you or you have already texted us. A number the check reports as a landline, a toll-free number, or a line of unknown type is never texted; it is simply shown to the seller as such. Each text you send us, including STOP or START, and each delivery receipt Telnyx returns, is kept with the offer. STOP is honored twice over: Telnyx blocks the number at once, and we record it and send nothing further. Reply HELP for help, or write to the address in Section 1. Message and data rates may apply.
For everythingthe infour thisform sectionsubsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. For the request record, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to any of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For the analytics and advertising described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time.
Cloudflare — serves every page, delivers our email, and runs the security checks in front of them. Processes your IP address and request metadata as part of delivering the site, and derives from the address the country, region, city, and network operator we store, as described in Section 2.
Telnyx — verifies phone numbers and sends and receives our text messages. Receives the phone number you typed, the text of what we send and what you reply, and nothing else.
GoDaddy — the account details needed to transfer a directly purchased domain to your registrar account.
Public blockchain services — if you choose Gram, deposit addresses and payment transactions are visible on the public network; deleting our private records does not erase that public history.
Telegram — onlyin two ways. The seller reads and answers offers from a private Telegram chat, so the details you type into the offer form and the request record described in Section 2 are delivered to the seller through Telegram's service, under Telegram's own privacy policy. And if you choose the "Send in Telegram" button, which is— a deliberate act on your part — your conversation with the seller runs there too.
We do not sell personal data, and we do not share it for cross-context behaviouralbehavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyone not on this list.
Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, becauseunder taxour records-retention policy. The applicable legal obligations and contractany lawspecific requirehold itare assessed separately. AnalyticsA datareferral is retained by Google under the retention window configured in that product. Nothinglead is kept "justas part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record, the email engagement record, and, for an offer, the phone lookup result and the text messages described in case"Section 2 are kept with the offer, purchase, or lead they belong to, under that record's window above, and are included in its disposal review. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred. Disposal is an operator-reviewed process, not an automatic timer. Before removing an eligible nonfinancial negotiation we verify that its domains are no longer for sale, the last correspondence date, the absence of financial or commission evidence and any applicable hold. Missing or conflicting evidence keeps the record on hold for review. Linked conversations, financial records and referral ledgers require separate review; we do not delete transaction or duplicate-prevention evidence merely because a request expires. Deletion from active records is distinct from deletion of mailbox, processor, export and backup copies. Those copies have separate disposal and backup expiry processes; restored records must be checked against prior erasure requests. Provider retention and any required longer hold are reviewed when we handle a request. Google retains analytics under its product configuration. Private service-operation accounting uses keyed identifiers, which may still be linkable, to prevent abuse and duplicate operations. Time-window accounting has bounded cleanup; stable duplicate-prevention records need a separate review before disposal. Optional observation collection is off until a finite, capacity-limited campaign is configured.
Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it, or send it to you in a portable form. You may object to processing based on legitimate interests — including the request record, the email engagement record, and the phone lookup result — and you may withdraw consent to analytics and advertising without giving a reason and without affecting anything you have already done on the site.
Every page and every form is served over HTTPS with HSTS. Offer, purchase, and purchasereferral submissions are rateprotected by anti-limitedautomation and challenge-protectedchallenges. Access to stored offers, referral leads, request records, email engagement records, phone lookup results, and text messages is limited to the seller. We do not hold payment credentials, so there is no card data here to lose.
All effective dates are stated in Coordinated Universal Time (UTC).