parkbid.lol

parkbid sets no cookies, shows no ads, and never stores your IP address. It does keep a one-way, daily-rotating hash of it purely to stop abuse — section 3 explains exactly what that is and is not. We also use a privacy-focused analytics provider, in its cookieless mode, to see how many people visit and roughly where from; section 5 covers that. The rest of this page explains what we hold.

1. Who is responsible

the operator of parkbid.lol is the data controller for parkbid.lol. For anything in this policy, including a request to see or delete your data, write to hello@parkbid.lol.

2. What we collect

When you park a vehicle. Your email address, and the listing details you type in: the vehicle name, licence plate, tagline, colour, vehicle type and the link you want your vehicle to point at.

When you pay. A record of the payment: our own reference, the amount, the bay, the identifiers Dodo Payments gives us for the checkout and the payment, and whether it succeeded. We also keep a copy of the listing details submitted with that payment, so a payment can be matched to what it bought. Your card details never reach us — they are entered on Dodo’s checkout page and we never see or store them.

When you visit. A random identifier that your browser generates and keeps in its own local storage, plus the time we last saw it and a count of page views. That is what the “live now” and “visitors” numbers on the site are counting.

3. What we deliberately do not collect

Our own database holds no IP addresses in readable form and no user agents. We do not fingerprint your device or browser, we set no cookies, we run no advertising, and we share nothing with ad networks. Our analytics provider does see your IP address and user agent in order to count you; what it does with them is described in section 5.

The one exception, in full. Anyone can pay to park here without an account, so the endpoints that accept a bid or count a visit are open to the internet. To stop one script placing endless orders or inflating the public visitor numbers, we keep a counter against a hash of the address a request came from. The hash is salted with a value that changes every day, which means it cannot be reversed into an address, cannot be compared with anyone else’s records, and cannot be linked to the same visitor from one day to the next. What is stored amounts to “some caller, today, this many requests”. These counters are deleted after two days. We do not use them to build a profile, and we could not if we wanted to.

The visitor identifier is a random value with no meaning outside this site. It is not derived from anything about you or your device, it is not linked to your listing or your payment, and it cannot be used to recognise you anywhere else. Clearing your browser storage deletes it, and your browser makes a new one on your next visit, which we count as a new visitor.

4. Cookies

parkbid sets no cookies, and neither does our analytics provider — we run it in its cookieless mode specifically so that it does not. This is why you are not being asked to dismiss a cookie banner.

Our own visitor counter uses your browser’s local storage, which is not a cookie and is not sent to us with every request — we only receive the identifier when the page reports that it is still open.

When you go to Dodo’s checkout page you are on their site, and their cookies and privacy policy apply there.

5. Analytics

We use DataFast to understand how many people visit, which pages they look at, roughly which country they are in, and which site sent them. We run the cookieless version, which means:

• no cookies are set on your device, and no long-lived identifier follows you;
• DataFast’s servers see your IP address and user agent, as any web server does, and turn them into a hashed identifier together with a salt that changes roughly every 24 hours;
• because that salt rotates, you are not linked from one day to the next — the same person visiting on Monday and Wednesday is not recognisable as one person;
• we receive counts and country-level summaries, not a profile of you.

We chose this mode knowing it gives us less accurate data than the cookie-based alternative. The trade is deliberate.

6. Why we hold it

• Your listing details — to show your vehicle in the lot. This is necessary to provide what you paid for.
• Your email address — to send your receipt, to tell you when you have been outbid and towed, and to contact you about your listing. This is necessary to provide the service, and the tow notice is a core part of it.
• Payment records — to take payment, to prevent the same payment being processed twice, and to meet accounting and tax obligations.
• The visitor counter — to display how busy the lot is. Our legitimate interest is knowing whether anyone is here, which is why it is a count and not a profile.

7. What is public

Your vehicle name, plate, tagline, colour, vehicle type, link, which bay you are in, how much you have paid in total, and whether you have been outbid are all shown publicly on the site for as long as your vehicle is in the lot. Do not put anything in those fields you would not want on a public page.

Your email address is never shown publicly and is not given to other users.

8. Who we share it with

We use a small number of providers, and only for the jobs listed here:

• Dodo Payments — takes payments as merchant of record and handles tax. They receive your email and the amount.
• Resend — sends the receipt and tow emails. They receive your email address and the contents of those messages.
• Supabase — hosts the database everything above is stored in.
• DataFast — counts visits, as described in section 5. Their servers see your IP address and user agent and turn them into a rotating hashed identifier; we see only the resulting counts.
• Vercel — hosts and serves the site. Like any web host, their servers process requests, which involves your IP address in transit. We do not receive it, store it, or log it.

We do not sell your data, and we do not share it with anyone else except where the law requires it.

9. Where your data goes

Our providers operate internationally, so your data may be processed outside the UK and EEA. Where that happens, transfers rely on the safeguards those providers have in place, such as standard contractual clauses.

10. How long we keep it

• Listing details — while your vehicle is in the lot, and afterwards as part of the lot’s history, so records of who parked where stay accurate.
• Payment records — for as long as tax and accounting rules require, typically six years.
• Visitor counter entries — these are a running tally and are not tied to you; the identifier itself lives in your browser until you clear it.

11. Your rights

If you are in the UK or EEA you have the right to see the personal data we hold about you, correct it, ask us to delete it, object to or restrict how we use it, and receive it in a portable form. Email hello@parkbid.lol and we will respond within one month.

There are two limits worth stating honestly. We may keep payment records we are legally required to keep, even after a deletion request. And removing a listing removes it from the lot going forward, but screenshots, archives and stats already published elsewhere are outside our control.

You also have the right to complain to a data protection regulator — in the UK, the Information Commissioner’s Office.

12. Children

parkbid is not for under-18s. We do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

13. Changes

If this policy changes, the date at the top changes with it. If a change materially affects what we do with data you have already given us, we will email you.

See also our terms and conditions.