Outspend has no user accounts. We collect what is reasonably needed to run a payment race, publish placement creative, measure real usage, prevent abuse, and meet legal obligations.
Effective August 23, 2026
1. Information you provide
- Creative: the name or company, destination URL, tagline, and theme you submit.
- Purchase context: the amount, currency, attempt identifiers, page version, timestamps, payment status, and limited dispute or support correspondence.
- Optional AI input: the name, draft tagline, and chosen tone sent when you press AI Remix.
Published creative is intentionally public while its placement is live and may appear in a modest takeover history or operational record afterward. If you arm a Crowd Coup, its name, company, tagline, theme, amount, and power status become public during the rally before any payment is captured, including if the coup never wins.
2. Payment information
New card payments are disabled at launch. If a card rail is deliberately enabled later, its configured hosted payment provider processes card and payment-method details; Outspend does not intentionally receive or store complete card numbers or card security codes. Historical card-provider identifiers and status data may remain while needed for reconciliation.
The x402 flow uses the real digital asset, production network, token contract, and receiver shown during checkout. Your wallet supplies a public address and signed one-time authorization for the exact displayed amount. To prevent replay and recover safely from a crash, the Durable Object temporarily journals the signed payment payload, exact server requirements, payer, nonce, hashes, expiry, and settlement status. The active signed payload is never intentionally placed in browser storage, public state, admin output, Analytics Engine, logs, or traces, and is cleared after a terminal win or loss. The browser temporarily stores an attempt identifier, authorization expiry, random status capability, and non-secret public payment profile so it can recover safely after a reload; the server stores only the status capability's hash.
The production facilitator identified in the purchase flow receives the signed authorization and payment requirements to verify and submit only the server-selected winner for settlement. It may apply its own security, abuse, legal-compliance, or verification controls and may reject a payment. A production-network settlement is a public, irreversible transaction with real financial value. Non-secret payment hashes, the public payer, recipient, amount, network, token contract, and transaction receipt may be retained for race reconciliation, accounting, fraud prevention, and legal compliance. Never send us, the facilitator, Cloudflare, support, or anyone claiming to help with Outspend a wallet seed phrase, private key, or secret recovery information.
3. Information collected automatically
When you visit or interact, Cloudflare and Outspend may process IP address, approximate location derived from IP, device and browser information, request headers, referring page, timestamps, route, response status, latency, diagnostic traces, security signals, and identifiers used to limit abuse.
Documented agent requests may include bounded, operator-supplied agent and source labels. We use those labels to distinguish machine and human funnels and to diagnose compatibility; they are claims made by the caller, not verified identities. Agent routes use a keyed or cryptographic pseudonymous network identifier for short-window rate limiting and do not write the raw address, wallet signature, creative, destination query, status capability, or full user-agent string to product analytics. Cloudflare may still process ordinary request data for delivery, security, logs, and tracing.
When enabled, Cloudflare Web Analytics measures page views and site performance, including visited and referring URLs, browser and device attributes, timing data, and Core Web Vitals. Cloudflare states that its Web Analytics beacon does not use cookies or local storage; it processes IP addresses transiently to derive coarse location and then discards them.
When you support a Crowd Coup, we use Turnstile verification and a random first-party browser identifier to limit duplicate and automated support without creating an account. The server stores a keyed pseudonymous browser-or-device hash, using a Turnstile ephemeral identifier when that feature is available and otherwise the first-party identifier. It separately stores a keyed network hash derived from the connecting IPv4 address or IPv6 /64 so it can enforce a modest per-coup network cap. Raw browser identifiers and network addresses are not written to the Crowd Coup ledger. These measures reduce abuse but do not prove that every accepted browser represents a distinct person.
We record product events such as visits, takeover and Crowd Coup opens, coup arming, verified support, quorum and outcome events, shares, payment attempts, settlements, Live Crayon War joins, switches and erasures, attributed arrivals, missing compatible-wallet signals, agent discovery and quote requests, agent challenge and outcome signals, rate-limit events, and outbound clicks. For launch measurement, a compact first-party label may contain bounded campaign source, medium, campaign, and content values plus only the original referring hostname. First touch is retained in session storage for that browser session. If the visit starts a payment attempt, the same minimized label may be copied to that attempt and included as an aggregate campaign dimension on settlement or capture telemetry; it then follows the payment attempt's retention period, up to 550 days for a captured or refunded attempt. The label does not include the full landing query, full referring URL, referrer path, referrer query, IP address, wallet address, or payment signature. Campaign parameters must not contain personal data or secrets. The label is client-reported context and never determines price, proves settlement, or establishes ownership. Browser-reported visits, opens, shares, arrivals, wallet-availability signals, and caller-reported agent labels are not authoritative unique-human or financial counts. Only confirmed settlement and placement records support financial metrics. Public Crayon War counts are derived from ephemeral main-page browser connections; they are not presented as counts of unique people, and participation is not stored in the placement ledger. Stored payment and placement transitions support aggregate metrics including shortest and longest reigns, largest amount, remaining time displaced, persistent page holders, and rivalries. We do not fabricate engagement metrics.
4. How we use information
- to calculate the live price and resolve takeover attempts atomically;
- to authorize, capture, cancel, reconcile, and support payments;
- to verify Crowd Coup support, enforce one accepted support action per browser identifier and coup, calculate quorum, and resolve a coup against the live page version;
- to display creative, derive a small safe visual profile from bounded public destination HTML/CSS after a win, and route outbound visitors to the stored destination;
- to prevent bots, payment abuse, phishing, malware, and prohibited content;
- to operate logs, tracing, reliability monitoring, debugging, aggregate analytics, and moderation;
- to provide optional AI Remix and post-takeover commentary;
- to enforce the Rules and Terms and comply with legal obligations.
5. Providers
Outspend is built on Cloudflare Workers, static assets, Durable Objects, Durable Object SQLite storage, Analytics Engine, Logs and Tracing, Turnstile, Workers AI, and AI Gateway. Cloudflare processes service, security, telemetry, and optional AI data on our behalf under its applicable terms. The production facilitator identified during checkout processes signed payment data and public wallet addresses to verify and submit settlements. Infrastructure and RPC providers for the displayed network supply public transaction records used for reconciliation.
New card payments are disabled at launch. A configured card provider processes card payments and related fraud information under its privacy terms only for historical reconciliation or if that rail is deliberately enabled later. No card interface is loaded by the wallet flow. Turnstile is loaded when needed to protect an interaction from abuse. Avoiding those interactions avoids those feature-specific requests, although ordinary Cloudflare security processing may still apply to visits.
We may also disclose information to professional advisers, authorities, payment networks, or affected parties when reasonably necessary to comply with law, investigate fraud or safety issues, enforce agreements, or protect rights. We do not sell personal information for money.
6. AI data
AI is currently disabled and is never part of the authoritative payment or placement path. If it is deliberately enabled later and you request a remix, the text and tone needed for that request are routed to Workers AI through AI Gateway. Successful takeovers may send limited public placement facts, such as names, amount, and timing, to create short commentary. A deterministic non-AI fallback is used when AI is unavailable. Do not put confidential or sensitive personal information in a tagline or AI prompt.
7. Retention
Current placement data lasts as needed to operate the live page. We retain a modest takeover and payment-attempt history for race integrity, support, moderation, accounting, dispute handling, fraud prevention, and legal compliance. An unsettled x402 credential is retained only while needed to finish or reconcile that exact attempt, then the signed payload is cleared; public blockchain records remain independently public. Security logs and aggregate analytics are retained according to operational and provider settings. We aim to keep identifiable data no longer than reasonably needed for these purposes.
Rows used to deduplicate and rate-limit Crowd Coup support, including keyed pseudonymous browser-or-device and network hashes, are retained for the active coup and a short operational period afterward, then deleted. Aggregate coup analytics may remain without the per-coup supporter rows.
8. Cookies and local storage
Outspend does not need an advertising profile or account cookie. A future configured card provider and Turnstile may use cookies or similar storage for payment, fraud prevention, and challenge integrity. The site may use browser or session storage for a random first-party identifier used to deduplicate Crowd Coup support, to recover the same card or x402 attempt without creating or signing a duplicate, to remember a Live Crayon War side for the current page version, and to retain the bounded first-touch launch label and deduplicate selected client signals for the current browser session. A connected wallet may also expose its public address to the page at your request. The first-party support identifier and launch label are not Outspend accounts or financial records.
9. Security and international processing
We use constrained rendering, server-side validation, HTTPS, protected administration, verified payment webhooks where applicable, authorization-before-capture where a card rail is enabled, signed-payment verification, one-winner settlement locks, on-chain receipt checks, idempotency, and Cloudflare security controls. No online service can guarantee absolute security. Providers may process information in countries other than yours, subject to their contractual and legal transfer safeguards.
10. Your choices and rights
You can browse without purchasing, decline to support a Crowd Coup, avoid AI Remix, and avoid following page-holder links. Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing, or to complain to a privacy regulator. Some transaction and security records must be retained even after a request.
11. Contact
For a privacy request or question, email privacy@outspend.app. Include enough context to locate the relevant record, but never send complete card details, a wallet seed phrase, or a private key. We may need to verify that a request relates to you before acting on it.