Information we use
We use account details supplied through Google sign-in or email registration, submitted advertiser content, moderation records and payment identifiers to operate accounts, review advertisements and reconcile purchases. Email registration requires address verification; passwords are stored as secure hashes. Published advertisements include the approved brand information and destination. Do not submit confidential information in public advertisement fields.
Payment, email and hosting providers
Stripe handles payment details on its hosted checkout. Rank Board does not receive or store full card numbers or card security codes. Google supplies Google sign-in identity; Resend sends requested verification and password recovery emails. Supabase and Railway provide database and hosting services. Account, moderation and financial access is restricted to the required service and authorized staff.
Cookies and referral attribution
Essential cookies maintain sign-in and protect account actions. A signed security cookie contains a random identifier, lasts up to 24 hours and separates browser request limits to help prevent abuse. If you choose a referral link, a separate signed attribution cookie can record that contact for up to 30 days. A referral must be assigned at original registration; it cannot be added retroactively to an existing buyer. We do not use referral attribution to change ad placement.
Uploaded brand logos
Uploaded logos are converted to a normalized image before storage. Original filenames and embedded image metadata are discarded. Draft logos are private to their owner and authorized reviewers. An approved logo becomes publicly available with its eligible advertising campaign. Saved logos and submitted revisions are retained to preserve review and campaign history; contact support for a removal request.
Site activity
When site activity measurement is enabled, a random browser-tab identifier records visits and recent active sessions. It is not linked to your account, email or IP address. We do not record referrers or full browsing URLs for these counters. Active sessions cover the last 90 seconds; visits today use UTC and are not unique people. Temporary deduplication records expire after 48 hours and daily totals after 30 days; expired records are removed during subsequent cleanup. Counters are hidden when measurements are unavailable.
Requests and retention
Contact support@kepolyn.com to request access, correction or deletion of account information. Public content can be withdrawn through support. Financial, security and dispute records may need to be retained for applicable obligations and resolved claims; withdrawing a public ad does not erase its payment history.