Short version: your listing is public, your visits are counted anonymously, and your card data never touches us.
Last updated: September 26, 2026
What we collect
Listing details you submit when you claim a rank: display name, link, tagline, description, category, and listing type. These are public by design. That is the product.
Bid records: amounts, timestamps, and Stripe session references. Bid totals appear on the public board.
Account details, when you sign in: the name, email address, and profile photo your sign-in provider shares with us. We never store passwords.
Aggregate visitor stats: we hash visitor IP addresses (SHA-256 with a server secret) and keep only the hash plus a timestamp. Raw IP addresses are never stored.
Cookies and local storage
Your theme preference is stored only in your own browser. It never leaves your device.
Session cookies keep you signed in to admin or account areas. They are httpOnly, not used for advertising, and not shared with third parties.
We do not use third-party analytics scripts or advertising trackers.
What we never do
We never sell your data.
We never see or store your card details. All payments are processed by Stripe, and their handling of payment data is governed by Stripe’s own privacy policy.
We do not build advertising profiles or track you across other sites.
How data is used
Listing details and bid totals power the public board.
Hashed visit records are used only for aggregate counts like visitors today and currently online.
Daily winners are archived in the Hall of Fame with the winning name, total, and date.
Account details are used only to operate your account: sign-in, your listings, and your dashboards.
Data retention
Hashed visit records older than 2 days are deleted automatically.
Listings and bid records are kept as the public record of the board, including the Hall of Fame archive.
Account details are kept while your account exists and removed when you delete it or ask us to.
Security
IP addresses are hashed before storage, session cookies are httpOnly, payment webhooks are signature-verified, and public endpoints are rate-limited. No system is perfect, but we keep the sensitive surface small on purpose.
Children
Maxx Rank is for people 18 and older. We do not knowingly collect data from children, and we will delete it if we learn it was provided.
Changes to this policy
We may update this policy as the service evolves. Material changes will be noted on the site, and continued use after a change means you accept the updated policy.