Privacy notice.

This notice covers outpulled.lol and everything served from it. The site is operated by Unchain Labs LLC of 30 N Gould St Ste R, Sheridan, WY 82801, USA — the data controller — contactable about anything on this page at hello@outpulled.lol.

It covers only this site. Where it names another company — Stripe, Cloudflare, Resend, Neon, Vercel — that company handles the data it receives under its own policy, linked in clause 9.

It sits alongside the Terms of entry and the Rules, which describe how the contest itself works.

Entering means buying a lane. Two things happen: you fill in a short form on this site, and you pay on Stripe's hosted checkout.

What this site stores about you

• Your email address. This is the only personal detail the site holds about an entrant. It is used to send your lane confirmation and to reach you if you win. It is never shown on the board.
• Your listing. The name, link, handle, description and taunt line you supply. These are public by design — they are what appears on your lane.
• Your lane record. Lane number, the price paid, whether the lane is a founder lane, its status, and the times it was created and changed.
• Your manage link. A random 32-character token that is the only credential for editing your listing. It is stored so the link works, is never displayed anywhere public, and is never written to the site's logs.
• A Stripe checkout reference. An identifier for the payment session, so a duplicate webhook cannot charge or activate you twice.

What Stripe handles instead of this site

Card numbers, billing details and any fraud checks Stripe performs happen on Stripe's own hosted page. Card details never reach this site — no card number, expiry, CVC or billing address is stored here, in any form. Your email is passed to Stripe so the checkout page can be pre-filled, which makes Stripe an independent controller of it. See clause 9.

The one email this site sends

Exactly one message exists: the lane confirmation, sent once after payment succeeds. It contains your listing name, lane and season number, the price paid, and your three links — pull link, manage link and battle card. There is no mailing list, no newsletter and no marketing email, so there is nothing to unsubscribe from.

Most people arrive through an entrant's pull link — outpulled.lol/r/some-lane — and never enter anything. Two records are created, and only two.

On arrival

A raw click row is written: which lane you arrived through, the time, and a visitor hash (clause 5). That is the whole row. It happens whether you stay or leave immediately — the difference between raw clicks and counted pulls is published on the board, and hiding one half of it would defeat the point of the site.

A cookie named pref is set holding the short public name of the lane you arrived through, so that a visit counted a few seconds later can be attributed to the right entrant.

After 5 seconds on the board

The page asks Cloudflare Turnstile to confirm you are not a bot, and sends the result to this site. If it passes, a second row — a verified pull — is written with the same three fields. That row is the entrant's score. If it fails, nothing is written and the arrival simply stays a raw click.

The Turnstile check is the one moment a third party is involved in an ordinary visit, and it is the one moment your IP address leaves this site — clause 9 says exactly where it goes.

If you are a social-media link preview

Requests from the crawlers that generate link previews get a preview card and nothing else: no click is logged, no cookie is set, and no row is written.

This list is as load-bearing as the ones above it, and every line is a statement about the code rather than an intention:

• No heatmaps, no session recording, no error-reporting service. Nothing on this site replays what you did on a page or records where your pointer went. Google Analytics is present and is described in clause 8; it is the only measurement code here, and it counts pages rather than watching people.
• No advertising or tracking pixels, no advertising network, no retargeting, no conversion tag, no social tracking script. The one advertisement on this site is a labelled box with a plain link in it.
• No IP address is stored in the database. Not in any table, not in any column. Clause 5 explains what happens to it instead — and is honest about the fact that it is processed, and about where it goes.
• No user-agent string, no referrer and no location are stored. The site does not read a country header and does not do geolocation.
• No fingerprinting beyond the hash in clause 5, and no device or browser profiling.
• No third-party fonts. The typefaces are served from this site's own domain, so loading a page makes no request to a font or CDN provider.
• No account, password or login exists to be breached — the site has no user accounts.
• Nothing is sold. Personal information is not sold, rented, or shared for anyone else's advertising, and never has been.

The contest only works if one person cannot be counted repeatedly for the same lane on the same day. Doing that without keeping a record of who anyone is, is what the visitor hash is for.

How it is made

At the moment of a request the site reads your IP address and your browser's user-agent string from the request itself, joins them with a secret salt held only by the operator and with today's UTC date, and runs the result through SHA-256. The output is 64 hexadecimal characters. That string is stored; the ingredients are not.

Because the date is one of the ingredients, the same visitor produces a different hash tomorrow. Nothing in the database links one day's visits to the next. The hash is only ever compared against other hashes, to answer one question: has this visitor already been counted for this lane today?

What it is honest to call this

This is pseudonymised data, not anonymous data, and this notice will not call it anonymous. Your IP address is processed at the moment of the request, and a value used to tell one visitor apart from another still singles you out — which is what the law treats as identifying, even when nobody can read your address back out of it. The accurate description is: pseudonymised, minimised, and short-lived.

What that means in practice, stated exactly:

• The hash cannot be reversed into an IP address by anyone who only has the hash.
• The operator holds the salt, so the operator could test whether a particular address and browser produce a particular hash for a particular day. That is the honest limit on the claim, and it is why this is pseudonymisation rather than anonymisation.
• It expires as an identifier every UTC midnight, and the raw arrival rows are deleted entirely — clause 11.
• It is never used to build a profile, to target anything, or to recognise you anywhere else. It has exactly one use: the one-count-per-lane-per-day rule.

• To run the contest you entered. Your listing is the product you bought; your email is how you get your links and your prize.
• To make the score mean something. The hash and the Turnstile check exist so that a count is a count of people, not of requests. A leaderboard nobody can trust has no reason to exist.
• To detect and correct fraud, and to be able to answer an entrant who disputes a void — which needs the arrival log to still exist while a dispute is live.
• To meet legal obligations, including tax reporting on a prize.

Where a lawful basis has to be named: processing an entrant's email and listing is necessary to perform the contract you entered into; the visitor hash and the Turnstile check rest on the legitimate interest of running a contest that is not decided by manufactured traffic, which is also the interest of every honest entrant.

Five items, in total, and this list is exhaustive. Three belong to the site itself and two are set by Google Analytics — those two are described in clause 8, which also says how to refuse them.

• pref — cookie, set only when you arrive through a pull link. It holds the short public name of the lane you came through and nothing about you. Flags: HttpOnly (unreadable to page scripts), SameSite=Lax, Secure over HTTPS. It expires after 24 hours. Without it a visit cannot be credited to the entrant who earned it.

• outpulled:beacon — session storage, holding the value 1. It stops the verification check firing twice in one browser tab. It is deleted when you close the tab and never leaves your browser.

• theme — local storage, holding light or dark. It remembers the theme toggle in the header. It never leaves your browser.

Cloudflare Turnstile may set its own storage on its own domain as part of the bot check, and Stripe's checkout page sets its own on Stripe's domain. Those are outside this site's control and are governed by the policies linked in clause 9.

This site uses Google Analytics 4 to count visits — how many people arrive, which pages they read, and roughly where in the world they are. It is used to understand whether the site works, and for nothing else.

Two things are switched off in the site's own configuration: allow_google_signals and allow_ad_personalization_signals. Those are the settings that would let Google join your visit here to a signed-in Google identity across devices, and feed it into advertising profiles. Both are false, and you can confirm it by reading the page source.

What Google receives. The page you are on, the page that sent you, your approximate location derived from your IP address, and general device and browser information. Google Analytics does not log your IP address — it is used in transit to estimate location and then discarded, which is the product's documented default and not something configured here.

What it sets. Two cookies on this site's own domain, in addition to the three in clause 7:

• _ga — a randomly generated identifier for a browser, so a returning visitor is not counted twice. It expires after two years. It contains no name, no email and no account.

• _ga_YK358CG4T0 — holds session state for the same purpose. It expires after two years.

Analytics has nothing to do with the game. Rank is decided by verified pulls counted by this site's own code, described in clauses 3 and 5. Google Analytics does not feed that count, cannot affect it, and does not run on the pull-link redirect or on a battle-card image at all. Blocking it changes nothing about whether your visit counts for the entrant who sent you.

How to refuse it

Any tracker-blocking extension, or a browser that blocks third-party scripts, stops it loading — nothing on this site breaks when it is blocked, and no feature is withheld. Google also publishes an official browser opt-out add-on that applies across every site using Analytics. Clause 10 explains what this site does with a Do Not Track signal.

There is no cookie banner on this site. That is a considered choice rather than an oversight: the operator is a United States business serving a United States audience, where a consent banner is not required for analytics of this kind, and a banner that appears whatever you click is a worse experience than an honest page saying what is set. If this site ever markets to the EU or UK, that reasoning stops holding and a real consent mechanism has to come first — a point clause 16 commits to.

Six companies are involved in running this site. Each is named, with what it receives and why. No one else receives anything, and nothing is sold or shared for anyone's marketing.

Google — analytics

Counts visits. Receives the pages you view, the referring page, and your IP address in transit for an approximate location, which it does not store. It receives no email address and nothing about a lane, a payment or a pull. Clause 8 sets out what is switched off and how to refuse it; Google handles what it receives under the Google privacy policy.

Stripe — payments

Takes the payment. Receives your email address and, on its own page, your card and billing details, which never come back to this site. Stripe is an independent controller of that data and uses it for payment processing and its own fraud prevention under the Stripe privacy policy. This site receives back only a session reference, a payment status and an amount.

Cloudflare Turnstile — telling humans from bots

A Cloudflare script loads on the board page and issues a token. When the verification check runs, this site sends Cloudflare that token together with your IP address so Cloudflare can validate it. That is the one place your IP address is deliberately transmitted off this site. Cloudflare's handling is governed by the Cloudflare Turnstile Privacy Addendum, which supplements Cloudflare's own privacy policy. Cloudflare states that Turnstile data is used for the bot check and not to build advertising profiles.

Resend — the one email

Delivers the lane confirmation. Receives the recipient address and the message, and nothing else — no tracking pixel and no open or click tracking is added by this site. Resend privacy policy.

Neon — the database

Hosts the database in which everything in clauses 2 and 3 is stored. It is a processor: it holds the data on the operator's behalf and does not use it. Neon privacy policy.

Vercel — hosting

Serves the site. Like any web host it necessarily sees the IP address of every request and keeps short-lived operational request logs, outside this site's database and outside its control. Vercel privacy policy.

One related disclosure: if a confirmation email fails to send, the error written to the operator's server log includes the entrant's email address so the operator can resend it by hand. Manage links are deliberately never logged.

Do other parties track you across websites?

This site runs no advertising code and collects nothing itself about your activity on other sites. Three third-party components do execute in your browser and could in principle observe activity across the sites that use them: Google Analytics, Cloudflare's Turnstile script on the board page, and Stripe's checkout page if you buy a lane. The Turnstile and Stripe components are anti-fraud infrastructure and both state that they do not use that data for advertising. Google Analytics is measurement, and the two settings that would feed it into advertising are switched off here — see clause 8. Each is governed by the policy linked above, and the operator has no visibility into and no control over that processing.

Data is stored and processed in the United States.

Some browsers send a Do Not Track signal. There is still no agreed standard for what a site should do in response, and this site does not respond to the signal — the analytics in clause 8 load whether it is sent or not. That is stated plainly rather than dressed up: a browser extension or a content blocker does stop them, and clause 8 says so. Nothing here follows you to another website with or without the signal.

The same applies to a Global Privacy Control signal. It is treated as an opt-out of the sale or sharing of personal information; this site does not sell or share personal information, so honouring it changes nothing about what happens.

If either of those facts ever changes, this clause changes with it and the effective date at the top of the page moves.

• Raw arrival rows — 30 days. The arrival log exists to detect manufactured traffic and to answer a dispute about a void while it is still live. Once a season and its payout window are well behind us it has no purpose, so it is deleted.
• Verified pull rows — for as long as the season record exists. These rows are the score, and a leaderboard that deleted its own results could not be checked. Each still carries only a hash, and that hash stopped identifying anyone at the end of its UTC day.
• Your listing — while it is on the board and in the archive. An archived listing keeps its page and its history but no longer competes.
• Your email address — while your listing exists, and after that for as long as is needed to pay a prize and to keep the tax and payment records the law requires. It is deleted on request once none of those apply.
• Stripe, Resend and Vercel keep their own records for their own legal and operational periods, under their own policies. Deleting something here does not delete it there.

Entrants. Your manage link — sent in the confirmation email — is where you review and change what is public about you. From it you can edit your listing's name, link, description and taunt line at any time, as often as you like.

Some things are deliberately not editable there. Your lane number, the price paid and your pull link's address are fixed, because changing them would rewrite the contest or break links other people have already shared.

The manage page does not currently show or change the email address on file. To see it, correct it, or have it deleted, write to the operator at hello@outpulled.lol from that address. This is stated plainly because a notice that implied a self-service route which does not exist would be worse than one that admits the route is manual.

Visitors. There is honestly nothing to look up. The site holds no name, no address and no identifier that could be matched to you — only a daily hash that the operator cannot connect to a person without being handed the exact IP address and browser that produced it. There is no record to show you and none to correct, which is the intended consequence of collecting so little.

California

This notice is written to comply with the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575 and following), which applies to this site regardless of its size. That is why it names the categories collected and the categories of third party they go to, describes the review process, explains how a change is notified, carries an effective date, and includes the labelled Do Not Track section above.

The CCPA does not currently apply to outpulled, and this notice does not claim otherwise. That law reaches a business only if it meets one of three thresholds: annual gross revenue above $26,625,000, buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving at least half its revenue from selling or sharing personal information. outpulled meets none of them. If it ever meets one, this notice will say so and the corresponding rights will be honoured as rights.

Under California's “Shine the Light” law: personal information is not shared with third parties for their own direct marketing, so there is nothing to request.

Offered voluntarily, to anyone

Whether or not a law requires it, an entrant may ask the operator to show them what is held about them, correct it, or delete it. Write to hello@outpulled.lol. The operator will verify the request comes from the listing's own email address before acting on it, and will explain if something cannot be deleted — for example a payment record the operator is required to keep, or a completed season's result.

Outside the United States

outpulled is offered to entrants in the United States. Prices are in US dollars only, the site is in English only, and it is not marketed to, aimed at, or targeted at people in the European Union or the United Kingdom, whose behaviour it does not monitor. On that basis the operator does not consider the GDPR or UK GDPR to apply.

Being reachable from another country is not the same as being offered there, and that is deliberately not treated as making the site European. If the operator ever markets outpulled in the EU or UK, that changes — and it would bring an obligation to appoint a European representative that the “occasional processing” exemption would not excuse, because a site that logs visits continuously is not processing occasionally.

outpulled is not for children. Entry is limited to adults under the Terms of entry, and the site is not directed at anyone under 13.

The operator does not knowingly collect personal information from a child under 13. If you believe a child has given this site personal information, write to hello@outpulled.lol and it will be deleted.

Everything is served over HTTPS. The salt used for the visitor hash, the database credentials and the payment keys are held as server-side secrets and are never sent to a browser. Manage tokens are generated from 192 bits of cryptographic randomness, are never displayed publicly, and are never written to a log. The operator's admin area is password-protected at the edge.

The honest caveat: no system is perfectly secure, and the operator cannot guarantee that a determined attack will never succeed. What can be said is that the site holds very little worth stealing — no card numbers, no passwords, no addresses, and no IP addresses.

Your manage link is a credential. Anyone who has that URL can edit your listing. Do not post it publicly.

This notice can change — the site can change, and a notice that no longer describes it is worse than no notice. Here is exactly how a change is handled:

1. The effective date at the top of this page is updated whenever any part of it changes. That date is the fastest way to tell whether you are reading something new.
2. A material change is announced on the site — on the public activity feed, before it takes effect. A material change means one that broadens what is collected, adds a purpose, adds a company that receives data, or lengthens a retention period.
3. Entrants with a live lane are emailed where a material change affects them, at the address on the listing.
4. A change never applies backwards to a season already under way. The notice in force for a season is the one published when it opened.

Continuing to use the site after a change takes effect means the new notice applies to you from then on.

Questions about this notice, a request about your own data, or a complaint: hello@outpulled.lol.

The operator answers these directly — there is no ticketing system and no form. If you are not satisfied with the answer you can complain to your state Attorney General or your local data-protection authority.