PRIVACY

THE SHORT VERSION

There are no accounts and no sign-up. We never learn your name, email address, or card number — those go to Paddle, our payment processor, and stay there. What we hold is what you put on the board (which is public by design, forever), your IP address briefly for abuse control, and not much else.

1. WHO IS RESPONSIBLE

roastit.lol is operated by Shamil Bedru, trading as roastit.lol, who decides how and why this data is used and is therefore the data controller. Privacy questions and requests: hello@roastit.lol.

2. WHAT WE COLLECT

Your entry. The roast or clap-back text, the target you named, the amount you paid, and the X handle if you chose to sign it. All of it is published on the board and in share images, permanently — publishing it is the product you paid for.
A payment reference. Paddle’s transaction ID and the amount, so we can match a payment to an entry. Your card details, billing address, and the email on your receipt go to Paddle and never reach our servers.
Your IP address, briefly. Used to rate-limit submissions and deleted within 24 hours. The “online now” counter stores only a salted hash of it, deleted about an hour after your last visit.
Aggregate counters. Clicks on target links and site-wide totals — numbers with nobody attached to them.

That is the whole list. No accounts, no profiles, no advertising identifiers, no precise location, and no marketing email — we have no address to send one to.

3. WHO ELSE PROCESSES IT

Paddle takes your payment as our merchant of record. It receives your email address, card details, and what your browser sends to its checkout, such as your IP address, and handles them under its own privacy policy — as the seller of record, that part is its responsibility, not ours.
Moonshot AI runs the AI referee that screens every submission before payment, and writes the 🤖-tagged roasts when you ask it to. It receives the entry text and the target’s domain — never your IP, handle, or payment details.
Supabase hosts our database, so it stores everything listed in section 2.
Vercel serves the site and sees the request metadata any web host sees, such as your IP address and browser.
Plausible may count page views for us. It is cookieless and stores no personal identifier.
Google serves the little favicon images next to each target. Your browser fetches those from Google’s favicon service directly, which tells Google your IP requested them, like loading any image from a third party.

4. COOKIES

We set none. There is no consent banner because there is nothing to consent to. The one exception happens when you pay: Paddle’s checkout loads its own script, which sets Paddle’s cookies to run the checkout and catch payment fraud, governed by Paddle’s own policy. Fonts are bundled with the site, not fetched from Google, so loading a page tells no one else that you did.

5. HOW LONG WE KEEP IT

Entries and pots: forever. Nothing on the board is ever deleted — that is the product’s core promise. The referee can hide an entry, but hidden is not deleted.
IP addresses: kept for rate limiting for 24 hours, then removed by a daily cleanup — gone within 48 hours at most. The hashed “online now” entries stop counting minutes after you leave and are removed by the same cleanup.
Payment references: as long as payment and tax rules require. Paddle keeps its own transaction records under its own retention.

6. YOUR RIGHTS

You can ask us what we hold about you (usually: an entry and a transaction ID), ask us to correct it, or object to processing. If you signed an entry with your handle and regret it, email us and we will unlink the handle — the roast stays, your name comes off. Requests go to hello@roastit.lol; we may ask you to prove an entry is yours (for example, from the receipt Paddle sent you), because acting on a forged request would be worse than the delay. You can also complain to the data protection authority where you live.

7. NOT FOR KIDS

roastit.lol is for adults. You must be old enough to form a binding contract where you live to pay for anything here, and we do not knowingly collect data from children.

8. CHANGES

When this policy changes materially, we will post the new version here with a new date at the top. With no accounts, this page is the notice.