Effective August 24, 2026

Privacy, plainly.

outmash.lol is designed for participation without a visible public account. We still process limited technical information to operate rounds, prevent abuse, fulfill payments, measure the product, and moderate content.

Information we process

• Firebase anonymous user ID and a signed first-party device cookie.
• Submitted URLs, listing metadata, uploaded images, category choices, reports, and admin changes.
• Round IDs, issued matchups, choices, skips, timing, and abuse-risk signals.
• Coarse network information such as a salted IP/ASN hash and request metadata for rate limiting and fraud prevention.
• Outbound click deduplication records and aggregate public counts.
• Payment identifiers, order amount/status, disputes, pin reservations, campaign delivery settings, and fulfillment data received from Stripe. We do not store full card numbers.
• Google Analytics/Firebase Analytics events such as pages, submissions, rounds, checkout starts, and shares.
• Google account UID, email, verification/provider information, listing claims, and manager edits when a user signs in to claim or manage a listing, or when an authorized administrator signs in.

Why we use it

We use information to provide the leaderboard, advertising placements, and rounds; remember cooldowns; process and reconcile purchases; secure the Service; investigate reports; understand product performance; comply with law; and preserve an auditable point/payment history.

Service providers

Google Firebase and Google Cloud provide hosting, database, authentication, storage, security, logging, and analytics. Stripe provides payment processing and dispute handling. X receives information only when you choose to open a share intent. Destination sites receive ordinary browser information when you choose to visit them.

Retention

Payment, claim, listing-revision, point-ledger, vote, moderation, and admin audit records may be retained as long as needed for the integrity of the leaderboard, accounting, disputes, security, and legal obligations. Short-lived checkout holds, click-deduplication, and raw abuse signals are deleted or aggregated when no longer needed. Public listings remain until removed or the Service ends.

Sharing and sale

We do not sell personal information for money. We disclose information to infrastructure/payment providers, professional advisers, authorities when legally required, and successors in a business transaction. Public listing content, point totals, ranks, activity summaries, and aggregate counters are intentionally public.

Your choices

You can mute music, decline optional X sharing, avoid purchasing, clear first-party browser data, report a listing, or request access/deletion where applicable. Some ledger, fraud, dispute, or legal records cannot be deleted immediately. Email hello@ieslamyoussef.com with enough information to locate the relevant record.

Security and changes

We use restricted server-side writes, signed webhooks, Secret Manager, App Check, idempotent records, safe URL fetching, audit logs, and encryption provided by Google Cloud and Stripe. No system is perfectly secure. Material policy changes will be posted here with a new effective date.