Privacy Policy
How Blowup handles your data
Effective date: August 31, 2026 · blowup.lol
1. Who’s responsible
Blowup (blowup.lol) is operated by an individual based in India — not a registered company or registered entity of any kind at this stage. “We”, “us”, and “our” throughout this policy refer to that individual operator.
If you have any questions about this policy or about how your data is handled, you can reach us at the contact details in Section 8.
2. What we collect
Everything below reflects our actual architecture. We describe each piece of data, where it goes, and — crucially — what we deliberately choose not to store.
Click deduplication (session hashing)
When someone clicks through to a YouTube creator via Blowup, we count that click uniquely — one counted click per viewer per creator campaign, per day. To do this without identifying individuals, we compute a session hash: a one-way HMAC of your IP address, your browser’s user-agent string, and a daily salt that rotates every 24 hours.
Privacy-by-design detail
We store only the resulting hash — a pseudonymous fingerprint — never the raw IP address itself. The daily salt means hashes computed yesterday cannot be linked to hashes computed today. Once the salt rotates, the original inputs are unrecoverable from what we stored.
The session hash is stored in our database alongside the click record. It is used solely to prevent duplicate click counting; it is never used for advertising, cross-site tracking, or profiling.
Checkout and bid data
When you submit a bid through the claim form or the board, we collect and store:
- Your YouTube channel handle or channel URL
- The category you are bidding in (Tech, Gaming, or Education)
- Your bid amount
- YouTube channel metadata resolved via the YouTube Data API: channel ID (
UC…), display handle, channel name, avatar URL, and subscriber count. This is fetched from YouTube’s public API and cached for 24 hours. - Internal identifiers linking your bid to the current week’s season and your campaign record
- Payment confirmation identifiers provided by Dodo Payments after a successful payment
Payment data
Payments are processed directly by Dodo Payments. We do not collect, see, or store your card number, bank details, or any raw payment credentials. Dodo Payments handles the checkout page, payment processing, and PCI compliance on our behalf.
What we receive from Dodo Payments after a successful payment: a checkout session ID and a payment ID, used only for idempotency (ensuring the same payment cannot credit a bid twice) and for audit records. Dodo Payments separately collects the email address you provide at checkout — that email goes to Dodo Payments, not to us, and is subject to Dodo Payments’ own privacy policy.
Analytics and error tracking
At the time of writing, Blowup does not use any third-party analytics service (no PostHog, no Google Analytics, no Plausible, or equivalent). We do not currently use a third-party error tracking service (no Sentry or equivalent). If this changes, this policy will be updated before any such service is deployed.
Vercel, our hosting provider, may log standard request metadata (including IP addresses and user-agent strings) for operational purposes at the infrastructure level. This is governed by Vercel’s privacy policy.
3. Cookies
Blowup does not set any first-party cookies. The site is fully anonymous — there is no login, no user account, and no session token stored in your browser.
Dodo Payments sets cookies during the Dodo-hosted checkout flow (on Dodo’s own domain, not on blowup.lol). These are Dodo’s cookies, governed by Dodo’s privacy policy. Once you return to blowup.lol after checkout, no payment provider cookies persist on our domain.
Your browser may cache standard HTTP assets (fonts, page resources) per normal web behaviour, but this is not tracking.
4. Why we use this data
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Handle, channel metadata, bid amount, category | Running the bid, computing your score and rank, displaying your listing on the public leaderboard | Contract performance — you submit this data specifically to participate |
| Dodo payment identifiers | Confirming payment, preventing duplicate credits, maintaining financial audit records | Contract performance; legal obligation (financial record-keeping) |
| Session hash | Counting unique clicks on creator listings fairly and preventing click inflation | Legitimate interest — fair operation of the ranking system, which all participants rely on |
| YouTube channel metadata | Verifying the channel exists, resolving the public handle and avatar used on the leaderboard | Contract performance |
| Referrer URL | Understanding traffic origin (stored as a nullable field, not required) | Legitimate interest — traffic source visibility for the operator |
5. Public listing data
Participation in Blowup is an act of public competition. By placing a bid, you agree that the following data about your listing will be displayed publicly on the leaderboard — to anyone who visits the site, without any login requirement:
- Your YouTube handle and channel name
- Your avatar (as resolved from the YouTube Data API)
- Your current rank and score in the category
- Your cumulative bid total for the current season (in dollars)
- Your unique click count for the current season
- Your rank history and season results, which are retained permanently as part of the public leaderboard archive
If you do not want this information to be public, do not place a bid. There is no private participation mode.
6. Who we share data with
We use a small number of third-party services to operate Blowup. These are the only vendors who receive any of your data:
| Vendor | Role | Data they receive |
|---|---|---|
| Dodo Payments | Payment processing | All data you enter on the Dodo-hosted checkout page (card details, email). We do not see this data; Dodo processes it directly and returns payment confirmation to us. |
| Neon | Postgres database hosting | All structured data we store: creator records, bids, campaigns, click hashes, season data. Neon hosts our database; they do not access or use this data independently of providing the database service. |
| Upstash | Redis (leaderboard cache & rate limiting) | Leaderboard scores, season pointers, click deduplication keys (session hash + campaign ID), rate-limit buckets, visitor counters. These are operational projections of the main database, not personal data in isolation. Upstash does not access or use this data independently. |
| Vercel | Application hosting & CDN | All HTTP requests to blowup.lol pass through Vercel’s infrastructure. Vercel logs standard request data (IP address, headers, timestamps) at the infrastructure level per their own data processing terms. |
| Google (YouTube Data API) | Creator metadata resolution | When you submit a channel handle, we query YouTube’s public Data API with that handle to resolve channel metadata. The handle is sent to Google’s API. This is public YouTube data; we do not send any personal information beyond the handle you provided. |
| Inngest | Background job scheduling | Inngest orchestrates our background jobs (weekly season rollover, leaderboard reconciliation, creator enrichment). These jobs read and write our own database; Inngest receives job event payloads containing internal identifiers (season IDs, creator IDs) but not personal data. |
We do not sell your data. We do not share your data with advertisers, data brokers, or any party not listed above.
7. Data retention
| Data type | Retention |
|---|---|
| Creator profiles | Retained indefinitely — they form the public leaderboard archive. YouTube metadata is refreshed from the YouTube API periodically; the stored record may lag the live channel by up to 24 hours. |
| Season results and bid history | Retained permanently. Season results are the historical record of competition outcomes and are immutable by design. |
| Bid records (incl. Dodo session/payment IDs) | Retained indefinitely for financial audit purposes. |
| Click records | Stored in the database. The click deduplication key in Redis (session hash + campaign ID) expires automatically after 24 hours. The underlying click row in Postgres is retained. |
| Leaderboard Redis cache | Active leaderboard keys expire 35 days after the season ends. This is a cache — the source of truth is Postgres and is unaffected by cache expiry. |
| Dodo-side payment data | Governed by Dodo’s data retention policy, not ours. |
If you want us to delete data associated with your YouTube handle, see Section 8. Note that publicly visible season results may be retained even after deletion of other records, as they constitute a historical record of the competition.
8. Your rights
If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data protection rights, you have the following rights regarding your personal data:
- Access — you can ask us what data we hold about your YouTube handle.
- Rectification — you can ask us to correct inaccurate information.
- Erasure — you can ask us to delete your data, subject to our legal obligations (we may need to retain financial records).
- Restriction — you can ask us to restrict processing of your data while a dispute is resolved.
- Portability — you can ask us to provide your data in a structured, machine-readable format.
- Objection — you can object to processing based on legitimate interest. In practice this effectively means requesting removal from the service.
- Withdraw consent — where processing relies on consent, you can withdraw it. Note that most of our processing is based on contract or legitimate interest, not consent.
Because there is no account or login, we identify data associated with you by your YouTube channel handle or channel ID. Please include these in any request so we can locate your records accurately.
To exercise any of these rights, contact us:
Blowup
Individual operator, India
Email: varshith@blowup.lol
We will respond to valid requests within 30 days. Requests that require significant effort may take up to 90 days with notice.
You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data in accordance with applicable law.
9. Children’s privacy
Blowup is intended for adults and for YouTube creators who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has submitted data through Blowup, please contact us at varshith@blowup.lol and we will delete those records.
10. Changes to this policy
We will update this policy if our data practices change — particularly before introducing any new analytics or error tracking service, or any new vendor. The effective date at the top of this page will reflect the date of the most recent update.
For material changes that affect data already collected, we will make a reasonable effort to notify affected users where we have a means to do so (for example, via an announcement at the top of the site).