Privacy Policy: what changed

In short. This site has no accounts and nothing to log in to. It collects personal data when you fill in a form — to make an offer, buy a domain, or refer a buyer — and, with each of those, it records where the request came from. Email we send you about an offer or a purchase records whether it was opened and which links were clicked. Both are for online fraud prevention, both are described below, and both are read by a person. A phone number you choose to leave with an offer is checked once, and is texted about that offer only if you tick the box asking for texts — reply STOP and it is not texted again. The pages also load analytics and advertising scripts from Google thaton seteligible theirstatic own cookiespages, onlywith afterindependent youchoices agreefor analytics and advertising. Buyer and recovery pages do not load those scripts. Everything else on the page works without knowing who you are.

Every field in the four subsections that follow is one you typed yourself, with one exception named where it occurs: what comes back from the phone lookup. The twothree subsections after them describe the onlyother things this site records that you did not type: where a request came from, and whether an email we sent you was opened, and what a text message to you led to.

The offer form collects your first name, your email address, the domain and amount you are offering, and — if you choose to fill them in — your last name, phone number, a message, and a proposed payment plan. We need this to read your offer, reply to it, and negotiate. If you give a phone number, we send it to Telnyx once to check that it is a working number and whether it can receive text messages, and we keep what comes back — the country, for US numbers the city and state, the line type, and the carrier — with your offer. If you also tick the "Text me about this offer at this number" box, we may text that number about your offer: the seller can send you a short message, and a day after we send a reply that bounced or shows no sign of having been opened, we send one automatic text asking you to check your email. Leave the box unticked and the number is never texted; it is only shown to the seller. Texts we send, replies you send, and whether each text was delivered are kept with the offer. Reply STOP to any text and no further texts are sent to that number. Choosing to send the offer through Telegram instead hands the same details to Telegram's own service.

For the four form subsections, the legal basis under the GDPR is the performance of, or steps taken at your request before entering into, a contract — for the sale of a domain name, or, for a referral, the referral commission arrangement described at Refer a buyer [/refer/] (Article 6(1)(b)); a text about your offer is a step in that same negotiation and rests on the same basis. For the request record and, the email engagement record, and the phone lookup result, the basis is our legitimate interest in preventing online fraud and in conducting the negotiation you started (Article 6(1)(f)); you may object to eitherany of them at any time by writing to the address in Section 1, and where your local law requires consent for email tracking, the footer of each email is where we tell you and how to avoid it. Where your local law requires consent for text messages, the offer form says next to the phone field that the number may be texted, and STOP withdraws that consent at any time. For the analytics and advertising described in Section 4, the basis is your consent (Article 6(1)(a)), which you may withdraw at any time.

We do not sell personal data, and we do not share it for cross-context behaviouralbehavioral advertising beyond the advertising cookies described below. No personal data is transferred to anyone not on this list.

TheOptional Google Analytics and Google AdSense scripts load only on eligible static informational pages, after you choose their purposes separately. They do not load on our catalogue, search, domain, referral, checkout or recovery pages. Even on an eligible page, a query string or fragment prevents loading. Analytics measures visits; advertising selects and measures ads. Both may use Google cookies. Declining either purpose leaves the rest of the site itselfworking. Use setsCookie nosettings cookies, andin the trackingfooter imageto inreopen ourthe emailcontrols. setsTurning nothingoff a loaded purpose requires a reload to remove its scripts; the page warns before reloading if it contains entered form data. Finish or copy unsent entries first. Global Privacy Control overrides both purposes to off. An old combined acceptance requires a new choice; an old refusal remains a refusal. The following data is kept in your browser or mail client. The site stores three things in your browser. The first two stay there and are never sent to us: Your colour color-theme choice, and a versioned analytics/advertising preference in host-local local storage, sowith theno siteapplication does not flip between light and dark as you navigate. Your answer to the question below — the word "granted" or "denied" — in local storage, so you are not asked again on every pageexpiry. Change it from "Cookie settings" in the footer, or clearClear this site's data in your browser to beremove asked afreshthem. ThereWe iskeep no server-side consent record of it. Buyer request and recovery state in tab-specific session storage, including request identifiers, whether a request was attempted, serialized form values used to recognize a retry (which can include names, email, phone and transfer account details), and purchase recovery credentials. This protects interrupted purchases and avoids creating a second transaction. The thirdserialized values are not a cryptographic hash. Requests send the necessary values to our endpoint; this state is not yourssent andto isoptional notanalytics aboutor you:advertising vendors. An operator test token, in session storage during staff rehearsals, whichsent existswith onlyrehearsal whilerequests to distinguish tests from real purchases. Session storage can survive reloads and browser session restoration. We do not promise deletion immediately when a membertab ofcloses. staffClear site data to remove it; doing so also removes local recovery information. When storage is rehearsingblocked, arequest purchase.recovery Unlikeand choices may be limited to the twocurrent abovepage. Google itcontrols its cookies and product retention. Cookie expiry and server-side analytics retention are different; some cookie lifetimes may renew with use. Our explicit analytics page address excludes query strings and fragments and its referrer is sentreduced to us — it accompanies the requestsorigin. thatOur rehearsalrestricted makes,page socoverage thealso transaction,avoids thebuyer seller noticeforms and therecovery agreementlinks. itGoogle producesproperty settings, automatic events and advertising consent-management configuration are recordedseparate ascontrols; athis testcustom rather than acted on as a real sale. Itbanner is never set during an ordinary visit, and it identifies the rehearsal, not a visitor. Three third parties set storageclaim of their own: Google AnalyticsCMP 4 measures which pages are read and which domains draw interest. It sets its own cookies and processes a truncated IP address. Google AdSense serves the advertising on some pages and may set cookies or read identifiers to select and measure adscertification. Cloudflare Turnstile checks that anprotected offer,actions direct purchase, or referral is comingcome from a person. It reads browser signals and setsruns independently of optional purposes. Its normal verification response is a shortone-liveduse token, not a cookie. Cloudflare can separately use security cookies; Turnstile's optional pre-clearance token. This onecookie is strictly necessary — without it those forms are open to abuse — so it runs regardless of your analytics choice. Analytics and advertising load only after you agree to them. Until you do, and if you decline, neither script runs and neither sets anything. You can change your mind at any time from the "Cookie settings" link in the footer of every page. If your browser sends a Globaldifferent Privacy Control signal, we treat that as a refusal and never askfeature.

Offers and the correspondence around them are kept while the domain is still for sale and for 24 months after the last message between us, so that a returning buyer's history is intact and so a disputed negotiation can be reconstructed. Records of a completed sale — the agreement, the parties, the amount — are kept for seven years, becauseunder taxour records-retention policy. The applicable legal obligations and contractany lawspecific requirehold itare assessed separately. A referral lead is kept as part of our commercial records — the row is the ledger for whether, and how much, commission is owed on it, so it is not deleted once its window lapses; a sale that syncs late can still be matched against it. We use a lead's contact details to attribute the referral and to reach out to them about the domain(s) named, never for anything unrelated. The request record and, the email engagement record, and, for an offer, the phone lookup result and the text messages described in Section 2 are kept with the offer, purchase, or lead they belong to, under that record's window above, and are deletedincluded within itits disposal review. The access, correction, and erasure rights in Section 6 apply to all of it, whether you are a buyer, a referrer, or the person referred. Analytics dataDisposal is retainedan byoperator-reviewed process, not an automatic timer. Before removing an eligible nonfinancial negotiation we verify that its domains are no longer for sale, the last correspondence date, the absence of financial or commission evidence and any applicable hold. Missing or conflicting evidence keeps the record on hold for review. Linked conversations, financial records and referral ledgers require separate review; we do not delete transaction or duplicate-prevention evidence merely because a request expires. Deletion from active records is distinct from deletion of mailbox, processor, export and backup copies. Those copies have separate disposal and backup expiry processes; restored records must be checked against prior erasure requests. Provider retention and any required longer hold are reviewed when we handle a request. Google retains analytics under theits retentionproduct configuration. Private service-operation accounting uses keyed identifiers, which may still be linkable, to prevent abuse and duplicate operations. Time-window configuredaccounting inhas thatbounded productcleanup; stable duplicate-prevention records need a separate review before disposal. NothingOptional observation collection is keptoff "justuntil ina case"finite, capacity-limited campaign is configured.

Wherever you live, you may ask us to show you the personal data we hold about you, correct it, delete it, or send it to you in a portable form. You may object to processing based on legitimate interests — including the request record and, the email engagement record, and the phone lookup result — and you may withdraw consent to analytics and advertising without giving a reason and without affecting anything you have already done on the site.

Every page and every form is served over HTTPS with HSTS. Offer, purchase, and referral submissions are protected by anti-automation challenges. Access to stored offers, referral leads, request records, and email engagement records, phone lookup results, and text messages is limited to the seller. We do not hold payment credentials, so there is no card data here to lose.