Privacy Notice

NOTICE SCOPE

What this notice covers

This notice explains how Outfast handles personal data when you browse a mission, launch or visit a product, use Community Fuel, use a private management or winner-claim link, contact us, or access administration tools.

Outfast is responsible for the processing described here. Listed product sites, TrendsFast, and other third-party services can be separately responsible for their own processing under their notices.

INPUT TELEMETRY

Data we collect

• Submission data: product URL, normalized destination and domain, product or company name, one-line pitch, favicon or fallback, private contact email, terms acceptance, and information needed to recognize an existing product.
• Mission data: verified visitor and Community Fuel totals, current and historical rank, milestones, activity, mission history, winner state, and prize status.
• Referral and exposure data: mission and product identifiers, allowlisted source placement, timestamps, aggregate campaign-page impressions and outbound clicks, and Today's Radar activity.
• Visitor identity data: a cryptographically random first-party browser identifier held in a cookie and keyed hashes derived for mission uniqueness. The raw browser identifier is not stored in the application database.
• Abuse-prevention data: a coarse keyed hash derived from network address, user-agent and request signals, bot classification, rate-limit state, blocked domains, moderation records, and administrative access records. The application database does not store raw IP addresses.
• Presence data: a random browser identifier, a derived session hash, and recent heartbeat timestamps while the page is visible. Presence is not based on invasive fingerprinting.
• Private workflow data: hashed management, claim, or session-token material, claim status, fulfilment information, report URL if supplied, and correspondence with us.

PROCESSING PURPOSE

Why we use data

We process data to:

• create or reuse products, prevent duplicates, and provide private management access;
• count best-effort unique outbound referrals, calculate ranks, lock winners, finalize missions, and preserve history;
• provide one Community Fuel point per browser per mission and prevent duplicate claims;
• display products, real activity, permanent profiles, share cards, Radar rotation, exposure statistics, badges, and non-private prize status;
• measure honest live presence, impressions, and clicks without inventing unavailable values;
• secure private links, administer Orbit Pack claims, and support genuine TrendsFast fulfilment;
• detect unsafe destinations, bots, manipulation, attacks, and violations of the Rules or Terms; and
• operate, troubleshoot, improve, document, and comply with legal obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement, legitimate interests in operating and securing the race, compliance with legal obligations, and consent where specifically requested.

PUBLIC SIGNAL

What becomes public

Product name, pitch, domain, favicon or initial, verified visitor and Community Fuel totals, current and historical rank, mission activity, exposure statistics, lifetime totals, mission results, winner badge, and non-private prize status may be publicly visible and preserved in permanent product or mission pages.

Contact email, raw or hashed visitor identifiers, coarse network hashes, private claim and management links, token hashes, internal moderation notes, and admin credentials are not intended for public display. Do not put personal or confidential information in a public product name, pitch, or URL.

ATTRIBUTION

Tracked redirects and best-effort metrics

Product visits use an Outfast redirect that resolves a previously approved stored destination, records a best-effort referral, and appends campaign parameters identifying Outfast, the mission, and an allowlisted placement such as leaderboard or Radar. The destination receives those parameters and ordinary request information under its own privacy practices.

Visitor uniqueness is best effort, not perfect person-level identification. We may deduplicate or filter duplicate requests, social previews, search crawlers, uptime bots, headless abuse, and suspicious traffic. Metrics may be delayed or missing, and we never substitute fabricated visitors, Fuel, activity, viewers, winners, testimonials, or reports.

LOCAL SYSTEMS

Cookies and browser storage

Outfast can set a long-lived first-party visitor cookie containing a random identifier. Where compatible, it is HTTP-only, Secure in production, and SameSite=Lax. The server uses a keyed hash before persistence; it does not store the raw identifier or use it to follow you across unrelated sites.

The identifier supports once-per-product referral counting and one Community Fuel claim per UTC mission. Clearing it does not guarantee another count or Fuel point because coarse abuse controls can still apply.

Secure HTTP-only cookies also protect authenticated admin or scoped management sessions. Private management and claim capabilities use high-entropy links or tokens, with hashes stored server-side where designed to do so.

MISSION PARTNERS

Service providers and disclosures

We disclose the minimum relevant data to providers that help operate the service:

• Neon hosts the operational PostgreSQL database.
• Vercel hosts the application and may process request logs, deployment data, and privacy-conscious analytics.
• TrendsFast receives winner and product information needed to fulfil the Orbit Pack when fulfilment is requested or a verified integration is configured.

We may also disclose data to professional advisers, a successor in a business transaction, or authorities and rights-holders where reasonably necessary to comply with law, protect people or the service, investigate abuse, or address infringement. We do not sell personal data or share it for cross-context behavioral advertising.

DATA LIFETIME

How long data remains

Product pages, lifetime statistics, completed mission results, activity records, winner records, and public badges can be retained long term because permanent history is a core feature. Referral and Community Fuel claim records can remain as needed for mission integrity, deduplication, abuse prevention, audit, and aggregate history.

Presence sessions are short-lived and stale heartbeat records are pruned. Aggregate impression and click buckets may remain as product statistics. Expired pending submissions and claim capabilities may be removed or invalidated; fulfilment, moderation, and security records may remain as needed. Hosting logs follow the provider's configured retention.

Removing a product from public view does not necessarily erase records we reasonably need for abuse prevention, disputes, rights, or legal compliance.

ACCESS CONTROL

Security and private links

Measures include keyed identity hashes, transactionally enforced uniqueness, bot and rate-limit controls, server-side validation, restricted admin sessions, destination allowlisting, hashed private tokens, and secrets kept out of browser code.

No system is perfectly secure. Treat management and claim URLs like passwords, do not forward them, and contact us if one is exposed. We will never ask you to email an admin password or a private token.

GLOBAL INFRASTRUCTURE

International processing

Providers may process data in countries other than your own. Where required, safeguards such as adequacy decisions or approved contractual terms are used for restricted transfers. Provider locations and safeguards can change as their infrastructure evolves.

YOUR CONTROLS

Privacy choices and rights

Depending on your location, you may request access, correction, deletion, restriction, objection, or portability, and may withdraw consent. You may also complain to your local data-protection authority. These rights can be limited by security, recordkeeping, fraud-prevention, freedom-of-expression, and other legal requirements.

Send a request to hello@outfast.lol. State the relevant product or mission context, but do not send private tokens. We may need to verify control of the relevant email, product, or private capability. You can clear local identifiers and preferences through your browser's site-data controls.

NOTICE CONTROL

Children, changes, and contact

Outfast is not directed to children. Product submission, management, and prize claims are limited to people at least 18. If you believe a child supplied personal data, contact us.

We may update this notice as the service or law changes. The effective date will be revised, and material changes will be presented reasonably before they apply. Questions, rights requests, and privacy concerns can be sent to hello@outfast.lol.