Privacy Policy

Effective 5 September 2026. Last updated 5 September 2026.

This board lists people, so this page matters more than most privacy policies. The short version: we hold very little, we never sell anything, and if you are on the board and want off, you get off.

Who is responsible

The controller for personal data processed through xbrag.lol is Rajan Lakhani, an individual in Hermosa Beach, California, United States. Contact: takedown@xbrag.lol

What we hold

If you donate to get a listing

• The X handle you submitted, the charity you picked, the amount, the line you wrote, and the time.
• A random donation ID we generate and give to every.org, so that a repeated notification cannot list you twice, and every.org's own reference for the charge once they confirm it.
• We never see or store your card number. The donation is taken by every.org and their payment processor under every.org's own privacy notice. Your name, your email address and your payment details are given to every.org, not to us.
• What every.org sends back to us: their notification includes the donor's first name, last name and email address alongside the amount. We do not store the donor name or email. We read the amount and the reference and discard the rest. A leaderboard does not need to know who you are, and donor identities we have no use for are the kind of data that only ever becomes a liability.

If you are listed by somebody else

We hold your public X handle, the profile picture X serves publicly for it, the amount that was donated against it, the charity it went to, and whatever line they wrote. We do not hold your bio, your follower count, your email, or anything X does not publish openly. We could not get those without an API key, and we do not have one.

If you just visit

• A random per-tab ID, kept in your browser's session storage. It lives for one browsing session and is only ever compared with other IDs in the same minute, so we can count people rather than page renders. It identifies nothing about you.
• A timestamp of your last visit, kept in your browser's local storage. It is how we avoid counting the same person twice when they open a second tab or reload the page, and it is a number and nothing else. It stays on your device; we never read it back off you.
• A count of visits and of clicks per listing. We deliberately count these from our own page script rather than from the redirect, so bots and link scanners are not counted.
• Coarse, aggregated request data used to filter obvious bot and datacentre traffic.
• The site that linked you here, by host only, for example x.com, so we can see which places send people to the board. Never the full address of the page you came from, so this is not a record of what you were reading. A visit with no referring site is counted as “direct”.
• A count of visitors per day, so the board can show a traffic chart. A number, attached to nobody.
• No advertising cookies, no third-party analytics, and no tracking of you across other sites. The only cookie we set is one you opt into by visiting /?me=1, which excludes your own visits from our counts. Everything else above is browser storage on your own device, listed here because it is stored there, not because it identifies you.

Why we hold it

We hold it to put your listing on the board, to confirm that a donation we were told about is one we actually issued, to count traffic honestly, to prevent fraud and abuse, and to keep a record of takedowns in case one is later disputed. We do not hold it to take your money. We never take your money.

If you are in the UK or the EU, those purposes map to two lawful bases under the GDPR: contract, for everything needed to list you, and legitimate interests, for the rest. Where we rely on legitimate interests you can object. See below.

Who we share it with

Only the services that make the site work:

• every.org: takes the donation, is the recipient of the funds, sends your receipt, and grants the money on to the charity. Their privacy notice covers what you give them.
• Stripe: only if the site ever charges a fee of its own, and for the voluntary tip in the footer. Not used for donations.
• Netlify: hosting, and the traffic counters.
• Neon: the Postgres database the board itself is stored in (listings, amounts, and the record of anything taken down).
• Cloudflare: DNS.
• unavatar.io: fetching the public X profile picture. We proxy and cache it so your browser never talks to them directly and your IP address is never passed on.

We do not sell personal data and we do not share it for advertising.

How long we keep it

The board is permanent, so a listing stays until it is removed. When a listing is taken down we keep a copy of what was published, along with the takedown, so we can show what happened if the removal is later disputed. Traffic counts are aggregated and are not tied to a person.

Your rights

Whoever and wherever you are, you can ask us to show you what we hold, correct it, or delete it. We do not gate that behind a residency check. It is simpler to just honour it. We answer within thirty days.

If you are a California resident, the CCPA and CPRA give you those rights explicitly, plus the right to know what we collect and why, and the right to opt out of sale or sharing. We do not sell or share personal information, and we never have, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights.

If you are in the UK or the EU, the GDPR additionally lets you ask us to export your data or to restrict or object to processing, and to withdraw consent where we relied on it.

Appearing on this board does not make your X profile private, and being listed is not something you agreed to. If somebody put you here, you can ask us to remove the listing and we will, and we do not require proof beyond the account itself. That is a right, not a favour, and using it costs you nothing.

You can also complain to a regulator. In California that is the California Privacy Protection Agency or the state Attorney General; in the UK it is the Information Commissioner's Office; in the EU it is your national supervisory authority.

Children

The site is not for anyone under 18 and we do not knowingly collect data from children. If a listing concerns a child, tell us and we will remove it and delete what we can identify.

Security

Donations run through every.org and never touch our servers. The board is held in a Neon Postgres database; traffic counts are held in Netlify's storage. No system is perfectly secure, but there is very little here to lose: no passwords, no accounts, no card numbers.

Changes

If we change this policy materially we will update the date at the top of this page.

← Back to the board