Outspend has no user accounts. We collect what is reasonably needed to run a payment race, publish owner creative, measure real usage, prevent abuse, and meet legal obligations.
Effective August 21, 2026
1. Information you provide
- Creative: the name or company, destination URL, tagline, and theme you submit.
- Purchase context: the amount, currency, attempt identifiers, ownership version, timestamps, payment status, and limited dispute or support correspondence.
- Optional AI input: the name, draft tagline, and chosen tone sent when you press AI Remix.
Published creative is intentionally public while it owns the page and may appear in a modest takeover history or operational record afterward. If you arm a Crowd Coup, its name, company, tagline, theme, amount, and power status become public during the rally before any payment is captured, including if the coup never wins.
2. Payment information
New Stripe card payments are disabled at launch. If that rail is enabled later, Stripe processes card and payment-method details through its hosted Payment Element; Outspend does not intentionally receive or store complete card numbers or card security codes. Historical payment identifiers and status data may remain while needed for reconciliation.
The x402 flow uses the real digital asset, production network, token contract, and receiver shown during checkout. Your wallet supplies a public address and signed one-time authorization for the exact displayed amount. To prevent replay and recover safely from a crash, the Durable Object temporarily journals the signed payment payload, exact server requirements, payer, nonce, hashes, expiry, and settlement status. The active signed payload is never intentionally placed in browser storage, public state, admin output, Analytics Engine, logs, or traces, and is cleared after a terminal win or loss. The browser temporarily stores an attempt identifier, authorization expiry, random status capability, and non-secret public payment profile so it can recover safely after a reload; the server stores only the status capability's hash.
The production facilitator identified in the purchase flow receives the signed authorization and payment requirements to verify and submit only the server-selected winner for settlement. It may apply its own security, abuse, legal-compliance, or verification controls and may reject a payment. A production-network settlement is a public, irreversible transaction with real financial value. Non-secret payment hashes, the public payer, recipient, amount, network, token contract, and transaction receipt may be retained for race reconciliation, accounting, fraud prevention, and legal compliance. Never send us, the facilitator, Cloudflare, support, or anyone claiming to help with Outspend a wallet seed phrase, private key, or secret recovery information.
3. Information collected automatically
When you visit or interact, Cloudflare and Outspend may process IP address, approximate location derived from IP, device and browser information, request headers, referring page, timestamps, route, response status, latency, diagnostic traces, security signals, and identifiers used to limit abuse.
When enabled, Cloudflare Web Analytics measures page views and site performance, including visited and referring URLs, browser and device attributes, timing data, and Core Web Vitals. Cloudflare states that its Web Analytics beacon does not use cookies or local storage; it processes IP addresses transiently to derive coarse location and then discards them.
When you support a Crowd Coup, we use Turnstile verification and a random first-party browser identifier to limit duplicate and automated support without creating an account. The server stores a keyed pseudonymous browser-or-device hash, using a Turnstile ephemeral identifier when that feature is available and otherwise the first-party identifier. It separately stores a keyed network hash derived from the connecting IPv4 address or IPv6 /64 so it can enforce a modest per-coup network cap. Raw browser identifiers and network addresses are not written to the Crowd Coup ledger. These measures reduce abuse but do not prove that every accepted browser represents a distinct person.
We record product events such as visits, takeover and Crowd Coup opens, coup arming, verified support, quorum and outcome events, shares, payment attempts, settlements, live raid joins, attributed arrivals, and outbound clicks. Browser-reported opens, shares, and arrivals are labeled as client signals and are not authoritative unique-human counts. The public Raid Mode count is derived from ephemeral main-page browser connections; it is not presented as a count of unique people, and raid participation is not stored in the ownership ledger. Stored payment and ownership transitions support aggregate metrics including shortest and longest reigns, largest amount, remaining time displaced, persistent owners, and rivalries. We do not fabricate engagement metrics.
4. How we use information
- to calculate the live price and resolve takeover attempts atomically;
- to authorize, capture, cancel, reconcile, and support payments;
- to verify Crowd Coup support, enforce one accepted support action per browser identifier and coup, calculate quorum, and resolve a coup against the live ownership version;
- to display creative, derive a small safe visual profile from bounded public destination HTML/CSS after a win, and route outbound visitors to the stored destination;
- to prevent bots, payment abuse, phishing, malware, and prohibited content;
- to operate logs, tracing, reliability monitoring, debugging, aggregate analytics, and moderation;
- to provide optional AI Remix and post-takeover commentary;
- to enforce the Rules and Terms and comply with legal obligations.
5. Providers
Outspend is built on Cloudflare Workers, static assets, Durable Objects, Durable Object SQLite storage, Analytics Engine, Logs and Tracing, Turnstile, Workers AI, and AI Gateway. Cloudflare processes service, security, telemetry, and optional AI data on our behalf under its applicable terms. The production facilitator identified during checkout processes signed payment data and public wallet addresses to verify and submit settlements. Infrastructure and RPC providers for the displayed network supply public transaction records used for reconciliation.
New Stripe card payments are disabled at launch. Stripe processes card payments and related fraud information under its privacy terms only for historical reconciliation or if the card rail is deliberately enabled later. Its payment interface is not loaded by the wallet flow. Turnstile is loaded when needed to protect an interaction from abuse. Avoiding those interactions avoids those feature-specific requests, although ordinary Cloudflare security processing may still apply to visits.
We may also disclose information to professional advisers, authorities, payment networks, or affected parties when reasonably necessary to comply with law, investigate fraud or safety issues, enforce agreements, or protect rights. We do not sell personal information for money.
6. AI data
AI is disabled at launch and is never part of the authoritative payment or ownership path. If it is enabled later and you request a remix, the text and tone needed for that request are routed to Workers AI through AI Gateway. Successful takeovers may send limited ownership facts, such as public names, amount, and timing, to create short commentary. A deterministic non-AI fallback is used when AI is unavailable. Do not put confidential or sensitive personal information in a tagline or AI prompt.
7. Retention
Current ownership data lasts as needed to operate the live page. We retain a modest takeover and payment-attempt history for race integrity, support, moderation, accounting, dispute handling, fraud prevention, and legal compliance. An unsettled x402 credential is retained only while needed to finish or reconcile that exact attempt, then the signed payload is cleared; public blockchain records remain independently public. Security logs and aggregate analytics are retained according to operational and provider settings. We aim to keep identifiable data no longer than reasonably needed for these purposes.
Rows used to deduplicate and rate-limit Crowd Coup support, including keyed pseudonymous browser-or-device and network hashes, are retained for the active coup and a short operational period afterward, then deleted. Aggregate coup analytics may remain without the per-coup supporter rows.
8. Cookies and local storage
Outspend does not need an advertising profile or account cookie. Stripe and Turnstile may use cookies or similar storage for payment, fraud prevention, and challenge integrity. The site may use browser or session storage for a random first-party identifier used to deduplicate Crowd Coup support, to recover the same card or x402 attempt without creating or signing a duplicate, and to remember a Raid Mode join for the current ownership version. A connected wallet may also expose its public address to the page at your request. The first-party support identifier is not an Outspend account or an advertising identifier.
9. Security and international processing
We use constrained rendering, server-side validation, HTTPS, protected administration, verified payment webhooks, authorization-before-capture, signed-payment verification, one-winner settlement locks, on-chain receipt checks, idempotency, and Cloudflare security controls. No online service can guarantee absolute security. Providers may process information in countries other than yours, subject to their contractual and legal transfer safeguards.
10. Your choices and rights
You can browse without purchasing, decline to support a Crowd Coup, avoid AI Remix, and avoid following owner links. Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing, or to complain to a privacy regulator. Some transaction and security records must be retained even after a request.
11. Contact
For a privacy request or question, email privacy@outspend.app. Include enough context to locate the relevant record, but never send complete card details, a wallet seed phrase, or a private key. We may need to verify that a request relates to you before acting on it.