Privacy Policy
What we collect, why, and who sees it. We do not sell your personal information. We use basic analytics to publish the listing statistics advertisers are buying and to improve the site.
The Board opens on 3 September 2026. Until then the only thing being sold is a reservation: a position in the opening order, charged when you reserve. Sabotage, protection and war chests describe the live board and begin the moment it opens. These terms apply in full to both.
The short version
This policy explains what Dustn.co, of 3424 Stine Rd. #217, Bakersfield, CA 93309(“we”, “us”), collects when you use The Board at toptheboard.com, why we collect it, who else sees it, and what you can ask us to do about it.
We have never sold personal information and we do not share it for cross-context behavioural advertising. We do not sell to data brokers, we do not run an ad network on other people's sites, and we do not build profiles of you to rent out.
The only advertising on The Board is the board itself, which is bought openly by the brands on it and shown to everyone the same way.
We measure activity on our own pages so we can publish the impression and click counts that appear on every listing, and so we can see what is broken or slow and fix it. That measurement is aggregate and operational. It is not used to profile you, follow you around the internet, or target you anywhere else.
The rest of this page is the detail behind those two statements.
Who this covers
This policy covers everyone who uses toptheboard.com: visitors who only read the board, people on the mailing list, and advertisers with an account and listings.
It does not cover the websites that listings link to. Every listing points somewhere we do not control, and once you click through, that site's own privacy policy applies. See section 12.
For data protection purposes, Dustn.co is the controller of the personal information described here, and is a business subject to the California Consumer Privacy Act. Contact details are in section 17.
What we collect
Information you give us
- Account details: your username or handle, your email address, and any display name you set.
- Listing content: brand name, logo image, description, category and destination URL. This is published, deliberately. See section 07.
- Mailing list: the name and email address you enter on the pre-launch form, if you enter one.
- Billing details: handled by our payment processor. We receive a confirmation, an amount, a currency, a timestamp, and a token that identifies the payment. We never see or store your full card number.
- Correspondence: anything you send us by email, including abuse reports and support requests.
Information collected automatically
- Request data: IP address, user agent, referring page, the page requested, response status and timestamp. This is ordinary web server logging and it is how we detect abuse and outages.
- Device and display: approximate screen size, browser and operating system family, and language, so the board renders correctly.
- Interaction events: pages viewed, listings shown, and outbound clicks. This is what produces the counts on every listing.
- Approximate location: country or region derived from IP address, used for fraud checks, tax, and aggregate reporting. We do not collect precise location and we do not ask for it.
We do not collect special category data (health, biometrics, race, religion, sexual orientation, political opinion, union membership) and you should not send it to us or put it in a listing.
Analytics, cookies and similar technologies
We use analytics for two purposes, and only two.
- To publish the numbers advertisers are buying. Every listing shows how many times it has been served and how many outbound clicks it has sent. Those figures are the product: without them nobody can tell what a position is worth. Producing them requires counting impressions and clicks.
- To improve the site. Aggregate page performance, error rates, which screens people give up on, and whether a change made anything worse.
What this looks like in practice
- Strictly necessary storage: a session or authentication token so you stay signed in, and security tokens that prevent forged requests. These cannot be switched off without breaking the Service.
- Preference storage: small values kept in your browser for things like which view of the board you last looked at.
- Measurement: first-party counters for impressions and clicks, and a privacy-respecting aggregate analytics tool for site performance and usage.
We do not use third-party advertising cookies, retargeting pixels, cross-site trackers, fingerprinting, or session replay that records what you type.
Where the law requires consent for non-essential storage, we ask for it before setting anything non-essential, and you can change your answer at any time. Where we rely on legitimate interests instead, you can object using the contact details in section 17.
We honour Global Privacy Control signals as an opt-out of any sale or sharing of personal information. Since we do not sell or share it in the first place, there is nothing for the signal to switch off, but it is respected all the same. There is no agreed standard for Do Not Track headers, so we do not respond to them separately.
How impression and click counts work
Because these figures are public, it is worth being exact about them.
- An impression is counted when a listing is served in a position on the board. The count shown beside a listing is scoped to the current bid: it restarts when the amount paid against that listing changes.
- A click is counted when someone follows a listing's outbound link. Clicks are counted, never estimated from impressions.
- Both counts are aggregate. Advertisers see totals for their own listing and public totals for everyone else's. No advertiser is ever told who clicked, where they were, or anything else about them.
- Nothing pays out on a click. No credit, rank or reward is attached to one, and no click is attributed to a person anywhere on the Service.
- We filter traffic we believe to be automated or duplicated, and we may restate a figure if we find a counting error.
Actions taken against another listing (sabotage) are recorded against the account that bought them, for rate limiting and abuse handling. That record is internal. We never publish who bought an attack, and we do not disclose it to the target.
Why we use it
- To run the Service
- Show the board, keep you signed in, put your listing where you paid for it, apply and expire timed effects, and keep the counts.
- To take payment
- Process a purchase, produce a receipt, handle a dispute, and meet tax and accounting obligations.
- To publish advertiser statistics
- Produce the impression and click figures shown on every listing and in the footer.
- To keep the Service safe
- Detect fraud, bot traffic, credit farming, duplicate accounts, abuse of the sabotage mechanic, and attacks on our infrastructure.
- To moderate content
- Review listings and destinations against the content rules in the Terms of Service, and act on reports.
- To improve the site
- Understand which parts are slow, confusing or broken, and whether a change helped.
- To communicate
- Service messages such as receipts, security notices, moderation decisions and changes to these policies. Marketing email only if you asked for it, and every marketing email has an unsubscribe link.
- To comply with law
- Respond to lawful requests, enforce our terms, and establish or defend legal claims.
What is public on the board
The Board is a public page. Some of what you give us is published by design, and anyone, including search engines, can see it.
- Published: your brand name, logo, description, category and destination link; the amount paid against your listing and the position that buys; its impression and click counts; and any damage or protection currently on it.
- Published if you back someone: your handle and the amount you contributed appear on that listing's public backer list. Backing is public on purpose.
- Not published: your email address, your billing details, your IP address, and any attack you buy. Sabotage is never attributed publicly.
- Sealed before launch: during the pre-launch period, brands and positions are public but every reserved amount is hidden until the board opens.
Treat every field on a listing as a billboard. Do not put your own personal information, or anybody else's, into a brand name, a description or a sabotage tag.
How long we keep it
- Account and listing data: for as long as your account is open, then deleted or anonymised within a reasonable period after closure.
- Payment and tax records: for as long as accounting and tax law requires, typically several years, regardless of account closure.
- Server and security logs: a short rolling window, typically weeks rather than months, unless a log is needed for an active investigation.
- Aggregate statistics: impression and click totals are kept indefinitely in aggregate form. They are not linked to an individual.
- Mailing list: until you unsubscribe, plus a suppression record so we do not email you again by mistake.
- Abuse and moderation records: long enough to enforce our terms consistently and to stop a terminated account simply signing up again.
A listing that has been published may persist in search engine caches, archives and screenshots outside our control after we remove it.
How we protect it
We use encryption in transit, access controls, and the principle of least privilege for staff access. Payment details are handled by a PCI-compliant processor rather than by us.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and the relevant regulator where the law requires it.
You can help: use a unique password, keep your email account secure, and tell us at privacy@toptheboard.com if something looks wrong.
Legal bases (UK and EEA)
If you are in the United Kingdom or the European Economic Area, we rely on the following bases under the UK GDPR and the EU GDPR.
- Performance of a contract
- Running your account, publishing your listing, taking payment, and reporting your statistics to you.
- Legitimate interests
- Keeping the Service secure and free of fraud, moderating content, understanding aggregate usage so we can improve it, and defending legal claims. We balance these against your rights, and you can object.
- Consent
- Non-essential storage where consent is required, and marketing email. You can withdraw consent at any time without affecting what was done before.
- Legal obligation
- Tax and accounting records, and responding to lawful requests.
Links to other sites
Every listing on The Board links to a website we do not operate. We do not control what those sites collect, what they set in your browser, or what they do with it. Clicking a listing takes you to a third party, and their privacy policy governs from that point on.
We record that a click happened, for the advertiser's count. We do not follow you onto their site and we receive nothing back from them about you.
International transfers
We and our service providers operate in more than one country, so your information may be processed outside the country you live in, including in the United States.
Where we transfer personal information out of the UK or the EEA we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses together with additional safeguards where they are needed. You can ask us for details using the contact address in section 17.
Your rights and choices
Depending on where you live, you may have some or all of the following rights.
- Access: ask what we hold about you and get a copy.
- Correction: have inaccurate information fixed. Most of it you can edit yourself in the account panel.
- Deletion: ask us to erase your information, subject to records we are required to keep.
- Portability: receive information you gave us in a portable format.
- Objection and restriction: object to processing based on legitimate interests, or ask us to restrict it while a dispute is resolved.
- Withdraw consent: at any time, where we relied on consent.
- Opt out of marketing: unsubscribe from any marketing email. Service messages such as receipts and security notices are not marketing and continue.
- Opt out of sale or sharing: available to you by law in some places. We do not sell or share personal information, so there is nothing to opt out of, but the request will be honoured and confirmed.
- Non-discrimination: we will not degrade the Service or change your price because you exercised a privacy right.
California residents
We are based in California and the California Consumer Privacy Act applies to us. In the twelve months before the date at the top of this page we collected the following statutory categories of personal information, from you and from your browser, for the purposes listed in section 06, and disclosed them for a business purpose only to the service providers described in section 08.
- Identifiers: username or handle, email address, account identifier, IP address.
- Customer records: billing contact details, and payment confirmations and tokens received from our processor. Never your card number.
- Commercial information: purchases made, listings held, amounts paid, and credit earned or received.
- Internet and network activity: pages requested, listings served to you, outbound clicks, and ordinary server log data.
- Coarse geolocation: country or region inferred from IP address. We do not collect precise location.
We do not collect sensitive personal information as the CCPA defines it, so there is nothing for a request to limit its use. We have not sold or shared personal information in the preceding twelve months, and we do not sell or share the personal information of anyone, including minors under 16. We do not use or disclose personal information for purposes other than those disclosed here.
How to exercise them
Write to privacy@toptheboard.com from the email address on your account, or tell us enough to verify who you are. We answer within 30 days, and will tell you if we need longer and why. An authorised agent may act for you with written proof.
If you are unhappy with our answer you may appeal by replying to the decision, and you may complain to your local data protection authority. In the UK that is the Information Commissioner's Office.
Children
The Service is for people aged 18 and over. It is not directed at children, we do not knowingly collect personal information from anyone under 18, and content that is not appropriate for someone under 18 is not permitted on the board at all.
If you believe a child has given us personal information, write to privacy@toptheboard.com and we will delete it.
Changes to this policy
We update this policy when what we do changes. The date at the top always shows when it was last changed.
Where a change is material, we will give notice on the Service or by email before it takes effect, and where the law requires consent for the change we will ask for it rather than assume it.
Contact
Dustn.co
3424 Stine Rd. #217
Bakersfield, CA 93309
United States
- Privacy requests and questions
- privacy@toptheboard.com
- General
- hello@toptheboard.com
- Reporting a listing
- abuse@toptheboard.com
The rules for what may be advertised, what a purchase buys, and why every purchase is final are in the Terms of Service.