Privacy Policy
In effect from 21 August 2026
This page describes exactly what worldsbiggestdick.lol collects, why it is collected, who else sees it, and how long it is kept. It describes what the software actually does rather than the widest set of things a policy could permit.
The short version
The site sets no cookies. It runs no analytics, no advertising tags and no third-party scripts of any kind. Fonts are served from this domain, not from Google. Your IP address is never written to the database — visitors are counted by a salted, truncated hash instead.
The two things that are genuinely personal are the ones you choose to make public: the account you list, and the fact that money was paid for it. A listing is a public statement by design; that is the entire product.
What is collected, and why
- The account you list. The X handle or URL you submit, reduced to a canonical form so the same account cannot hold two listings. Also the title, description and image that our server reads from the page you submitted, so the board has something to show. This is public the moment a payment settles.
- The bid. The amount, what was actually charged, the currency, timestamps, and the payment provider’s own references for the checkout. Needed to place the rank, and kept afterwards as a financial record.
- Your email address, if you give one. It is passed straight to the payment provider so they can send you a receipt. We do not store it ourselves — there is no column for it — and we do not send marketing.
- A visitor hash. A SHA-256 of your IP address and browser user-agent, mixed with a secret salt and truncated to 32 characters. It is enough to count you once, to attribute a click, and to rate-limit abuse. It is not enough to identify you, it cannot be reversed into your IP, and it changes if the salt is rotated. The IP itself is used in memory to compute the hash and then discarded.
- Clicks on a listing. Which listing, the visitor hash, the referring page your browser reported, and a two-letter country code from our CDN. This is what produces the click counter next to a listing.
- Your approximate country. A two-letter code supplied by the CDN, used to decide whether to show a rupee figure beside the dollar price. Not stored except on a click row.
Payment details
Payments are handled by Dodo Payments, which acts as the merchant of record. You enter your card, UPI or wallet details on their hosted page. Full card numbers, CVVs and UPI credentials never reach this site’s servers and are never stored by us.
When a payment completes, Dodo sends us a signed receipt and we store that receipt in full, unchanged, as the audit record for the money. Being honest about what that receipt contains: your name and email as given to Dodo, the billing city, state, postcode and country you entered, the last four digits of the card, the card network and its issuing country, and the payment method used. We keep it so that a rank can be reconciled against a real payment months later, and so a disputed charge can be answered.
How long it is kept
- Listings
- For as long as the listing is on the board. Removing a listing from public view keeps the underlying bid record, because the payment behind it still happened.
- Bids and payment receipts
- Eight years from the end of the financial year they fall in, which is what Indian tax and company-law record-keeping requires of us. These are accounting records and are not deleted on request.
- Visitor presence
- Deleted automatically two hours after your last visit. Nothing about a visit survives the same day.
- Rate-limit counters
- Pruned on a schedule once their window has expired. Hours, not days.
- Click rows
- Retained while the listing exists, as the basis of its public click count. They hold a visitor hash, never an identity.
Who else sees it
Nothing is sold, rented, or shared with advertisers or data brokers. There is no advertising on this site and no plan to add any.
- Dodo Payments — to take the payment, issue your receipt and handle any refund or dispute. They are the merchant of record and process your payment details under their own privacy policy.
- Our hosting and database providers — because the application and its database have to run somewhere. They act on our instructions and do not use the data for their own purposes.
- Anybody at all, for a listing. A listing and its amount are public. That is the point of the board, and it is not something we can undo for you selectively.
- A court or a regulator, where we are legally required to disclose something.
Your rights
Under India’s Digital Personal Data Protection Act, 2023, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to erase it, withdraw a consent you previously gave, nominate someone to exercise these rights if you cannot, and complain about how we have handled any of that.
Write to support@worldsbiggestdick.lol and say which of those you want. We will acknowledge within 3 working days. We may ask you to prove control of the account or the payment in question — otherwise anyone could ask us to delete somebody else’s listing.
Two honest limits. We cannot erase a payment record we are legally required to retain, so an erasure request removes the listing from public view rather than the accounting trail behind it. And we cannot identify you from a visitor hash, so we cannot find, show or delete “your” browsing rows on request — that is a consequence of not storing your IP, and on balance we think it is the right trade.
Security
Payment credentials never touch our servers. Visitor identity is hashed with a secret salt before it is written. Payment webhooks are rejected unless they carry a valid signature over the exact bytes sent, and a delivery more than five minutes old is refused so a captured one cannot be replayed. Application logs strip tokens, secrets, authorisation headers and IP-shaped values before anything is written out. Requests our server makes to a URL you submitted are checked so they cannot be pointed at private or internal addresses.
None of that makes a breach impossible. If one happens and affects you, we will tell you and the Data Protection Board as the DPDP Act requires.
Age
This site is for adults. You must be 18 or older to bid, as set out in the Terms of Service. We do not knowingly collect anything from children. If you believe a child has used the site, write to support@worldsbiggestdick.lol and we will remove the listing and the record behind it.
Changes
If this policy changes, the date at the top of the page changes with it. A change that materially affects what we collect or who we share it with will be announced on the site before it takes effect. Continuing to use the site after that is how you accept it.
Who to contact
The operator of worldsbiggestdick.lol is the data fiduciary responsible for this site.
Privacy requests, data-protection questions and complaints all go to support@worldsbiggestdick.lol. Put “complaint” in the subject if that is what it is, and it will be treated as one rather than as a support ticket. If we cannot resolve it between us, you may take it to the Data Protection Board of India. More on what to include is on the contact page.