Privacy Policy

The controller for personal data processed through the Service is Enkii, based in France.

Email: info@enkii.fr.

We keep the Service lean. We collect only what is needed to operate the board, process payments, prevent abuse, and understand traffic.

Listing-ownership cookie — rw_owner_<listing-id>: proof of ownership of a listing without an account, letting the owner re-bid or manage the listing. One is created per listing you own. Duration: 2 years. Strictly necessary. Attributes: HttpOnly, Secure, SameSite=Lax.

Admin authentication cookie — sb-pkaihdzglvkwnzkhnhua-auth-token (may split into .0, .1): set by Supabase Auth, for administrators only. Keeps the admin session signed in on the /admin panel. A normal visitor never receives this cookie. Duration: session + automatic renewal (Supabase default, ~1 week renewable). Strictly necessary. Attributes: HttpOnly, Secure, SameSite=Lax.

Language cookie — NEXT_LOCALE: set by the framework (next-intl), remembers the chosen language. Duration: browser session. Functional. Attribute: SameSite=Lax (not HttpOnly).

Local storage (localStorage — not cookies, disclosed for transparency): rankwar.theme (light/dark theme preference) and rankwar.lang (language preference).

Checkout and listing data: the URL or profile you submit, the chosen category, the amount paid, and the name, short description, and logo we display publicly for that listing. Stripe payment-confirmation identifiers are stored to link the payment to the position.

Payment data: card details and billing identity are collected by Stripe, not by us. Stripe may send us confirmation that you paid and the amount. See Stripe's own privacy notice.

Clicks: when you visit a listing from the board, we may record the listing, the time, and a hash of the visitor's IP, stored on the server, deduplicated per day. The hash is for rate limiting and reducing fake clicks, not to build a profile about you. This count does not use cookies.

Rate limiting: by IP, through Upstash Redis, without using cookies.

Messages you send us: if you email a notice, category correction, or privacy request, we keep that correspondence as needed to respond and keep a legal record.

• Advertising, remarketing, or third-party tracking cookies — none.
• Third-party analytics with cookies — none.
• Stripe sets its own cookies only on its hosted page (checkout.stripe.com), governed by Stripe's policy. There are no Stripe scripts or cookies on the rankwar.net domain.

We use GoatCounter (goatcounter.com), a cookieless analytics service with no personal-data collection. It is GDPR-compliant and adds no cookie to the list above. We provide a public statistics page, accessible without a login.

• Contract: to process payments, create or raise a listing, show the position, and provide the Service you requested.
• Legitimate interests: to keep the board fair (rate limiting, bot filtering), display public listing metadata, measure visits, fix failures, and defend legal claims. You may object to processing based on legitimate interests, as described below.
• Legal obligation: to keep tax, accounting, and complaint records where the law requires it.

Position, amount paid, names, images, descriptions, and destination links on the board are public. Anyone can see them, including search engines. Do not list a destination if you do not want that information shown. We obtain public metadata from the site or profile you submit so visitors recognise the listing. That fetch may reveal to the destination that rankwar.net requested the page.

• Stripe — checkout and payment confirmation.
• GoatCounter — cookieless analytics and the public statistics page.
• Vercel — hosting and infrastructure.
• Supabase — database and admin authentication.
• Upstash Redis — rate limiting.
• Professional advisers, authorities, or a buyer of the Service, if we have to share data to comply with the law, enforce the Terms, or transfer the project.

We do not sell your personal data. Some providers may be outside the European Economic Area. Where we rely on them, we use appropriate safeguards, such as standard contractual clauses or an equivalent mechanism provided by those providers.

• The listing-ownership cookie lasts up to 2 years, or until you clear your cookies.
• Public listings remain while they are on the board, and may remain in backups or activity history for a limited period after removal.
• Payment identifiers and amounts are kept as long as needed for accounting, tax, fraud, and dispute resolution.
• Click records and IP hashes are kept only as long as useful for rate limiting, abuse prevention, and aggregate counts.

If the GDPR or a similar law applies to you, you can ask us to access, correct, delete, or export personal data we hold about you, to restrict or object to certain processing, and to withdraw consent where processing was based on consent. You can also lodge a complaint with a supervisory authority, including the CNIL in France, or in your country of residence.

Email info@enkii.fr. We may need enough information to find your data. Public listing content that is also on your own site or profile does not become private just by appearing on the board; you can ask us to remove the listing.

The Service is for adults. We do not knowingly collect personal data from minors. If you believe a minor used the Service, contact us and we will delete the data we can identify.

We may update this policy when the Service or the law changes. The date at the top of this page is the current version. If a change is material, we will post the updated policy here.