Most privacy policies describe intentions. This is a list of what the database holds, which is a different kind of document, because a column that does not exist cannot be misused, cannot leak and cannot be handed to anybody.
Here is the whole thing.
If you are reading the board
Nothing about you is stored. Not a row, not an identifier, not a session.
What happens when you load a page is that a handful of integers go up by one: a total for the day, and separate tallies for device type, operating system, browser, browser major version, referring host and country when the edge supplies it.
Each of those is its own counter. They are not stored together and there is no key joining them, so the board can answer "how many views came from mobile" and can never answer "which views". There is no "Firefox user from Germany at 14:00" anywhere, because the three counters do not know about each other.
There is no cookie, no local storage, no fingerprinting script and no consent banner, because there is nothing to consent to.
If you click a listing
The click goes through a redirect on this server so the board can count it. The counter goes up by one. The destination receives your request with the referrer set to this board's domain and nothing else: not the page you were reading, not a query string, not an identifier.
That is deliberate. A listing should be able to see this board in its own analytics, because that is how they judge whether the rank was worth it. Which page you happened to be on when you left is yours.
If you place a bid
This is where the most is recorded, and it is still short.
- The link you are listing, its name, its description, its category, and any
profile links you supplied. All of it is public, because it is the listing.
- The amount, which is public, because the amount is the rank.
- A Monero subaddress generated for that invoice alone.
- A SHA-256 hash of your claim token. Not the token. The hash cannot be
reversed into it, which is why a seized database cannot be used to take over a listing, and also why nobody here can recover a lost token for you.
- Timestamps for when the invoice was created and when it settled.
What is not recorded: no name, no email address, no billing address, no card, no IP address against the payment, no country, no device. Monero carries no sender, so the board does not know who paid even in the weakest sense of the word. There is no user table, because there are no users.
The two things that are kept briefly
Being complete means including the awkward parts.
A rate limiter. Creating an invoice reserves a subaddress, so the endpoint is rate limited. It hashes the client address under a salt that rotates in memory and holds it for the length of the window. It is never written to disk and never associated with a listing or a payment.
The reverse proxy in front of the clearnet site. Cloudflare terminates TLS there, keeps its own logs and answers its own legal orders. Nothing on this page reaches into them, and no promise of ours can speak for them. The onion service reaches the same board without passing through them at all, which is exactly why it exists.
What that means when somebody asks for data
An account that was never created cannot be handed over. That is a stronger guarantee than any sentence on this page, because it does not depend on us keeping a promise or on anybody being brave.
The canary says whether anything has been asked for, renewed monthly, signed with a key that is not on this server. The privacy page is the formal version of this post. Neither of them is worth much on its own; what makes them checkable is that the list of what exists is short enough to read in one sitting, which is what you just did.