Privacy Policy

Effective 31 August 2026. Last updated 31 August 2026.

This board lists people, so this page matters more than most privacy policies. The short version: we hold very little, we never sell anything, and if you are on the board and want off, you get off.

Who is responsible

The controller for personal data processed through xbrag.lol is Rajan Lakhani, an individual in the United Kingdom. Contact: see the Rules page

What we hold

If you pay for a listing

• The X handle you submitted, the amount you paid, the line you wrote, and the time.
• The Stripe Checkout session ID, so a repeated webhook cannot charge or list you twice.
• We never see or store your card number. Stripe handles the payment and holds your payment details under its own privacy notice. Your name and email, if you give them to Stripe, stay with Stripe.

If you are listed by somebody else

We hold your public X handle, the profile picture X serves publicly for it, the amount the person paid, and whatever line they wrote. We do not hold your bio, your follower count, your email, or anything X does not publish openly — we could not get those without an API key and we do not have one.

If you just visit

• A random per-tab ID that exists for one browsing session and is compared only against other IDs in the same minute, so we can count people rather than page renders.
• A count of visits and of clicks per listing. We deliberately count these from our own page script rather than from the redirect, so bots and link scanners are not counted.
• Coarse, aggregated request data used to filter obvious bot and datacentre traffic.
• No advertising cookies, no third-party analytics, no tracking across other sites. The only cookie we ever set is one you opt into by visiting /?me=1, which excludes your own visits from our counts.

Why we are allowed to hold it

Where UK or EU data protection law applies, our lawful bases are: contract, for everything needed to take your payment and put your listing on the board; and legitimate interests, for running a public leaderboard, counting traffic honestly, preventing fraud and abuse, and keeping records of takedowns in case one is disputed. Where we rely on legitimate interests you can object — see below.

Who we share it with

Only the services that make the site work:

• Stripe — payments.
• Netlify — hosting and storage.
• Cloudflare — DNS.
• unavatar.io — fetching the public X profile picture. We proxy and cache it so your browser never talks to them directly and your IP address is never passed on.

We do not sell personal data and we do not share it for advertising.

How long we keep it

The board is permanent, so a listing stays until it is removed. When a listing is taken down we keep a copy of what was published, along with the takedown, so we can show what happened if the removal is later disputed. Traffic counts are aggregated and are not tied to a person.

Your rights

Where UK, EU or similar law applies, you may ask us to access, correct, delete or export personal data we hold about you, to restrict or object to processing, and to withdraw consent where we relied on it. We answer within one month.

Appearing on this board does not make your X profile private, and being listed is not something you agreed to. If somebody put you here, you can ask us to remove the listing and we will — we do not require proof beyond the account itself. That is a right, not a favour, and using it costs you nothing.

You can also complain to your data protection regulator. In the UK that is the Information Commissioner's Office.

Children

The site is not for anyone under 18 and we do not knowingly collect data from children. If a listing concerns a child, tell us and we will remove it and delete what we can identify.

Security

Payments run through Stripe and never touch our servers. Data is held in Netlify's storage. No system is perfectly secure, but there is very little here to lose: no passwords, no accounts, no card numbers.

Changes

If we change this policy materially we will update the date at the top of this page.

← Back to the board