Privacy

Slapwars is run by the operator named on the imprint: Ordinary Nerds, L.L.C., a Delaware limited liability company. It decides what happens to the data described here, which makes it the "controller" in the language of data protection law.

Questions about this notice, or about data held about you, go to hello@slapwars.lol or by post to the address on the imprint. We aim to answer within 5 working days; legal and abuse notices within 2.

• There is no account and no sign-up. You are a cookie. An email address is optional and only ever used to get you back in.
• What you put on a sticker — the name, the link, the logo — is public, on purpose. That is the product.
• Your IP address is hashed, not stored, everywhere but the operator's sign-in, which keeps raw addresses of its own.
• We count page views and what gets bought with OpenPanel, without cookies and without an id that lasts past the day. No profiles, no session recording, no advertising, and we never sell your data.
• We never see your card number. Stripe takes the payment on its own pages or, for Apple Pay and Google Pay, with its own buttons in the wallet; for a bid on a spot we keep only the card's last four digits, to show you which card holds it.
• Every link you submit is sent to Google to be checked for malware and phishing, and its domain to Cloudflare's family filter.

A sticker is a public object. Its name, its link, its logo, its category, how many clicks it has had, how deep it is buried and when it was slapped are shown on the wall, on the sticker's page, in the directory, in the share images, and — once your spending has unlocked the AI profile and you have verified your domain — in /llms.txt. Anything you type into a sticker, put it there expecting the whole internet to read it.

What stays out of sight: your balance, what you have spent, your email address and the token your browser holds. Your spending changes how big your sticker prints, so the size is a rough public hint at it; the number itself is yours.

Every cookie here is strictly for running the wall. None of them is for advertising or measurement: the analytics below sets no cookie.

• pile_owner — the owner token: a random value that ties your stickers, your credit and your purchases to this browser instead of to an account. It is set the first time you slap a sticker, not merely by reading a page, and again when you use a recovery link. HttpOnly, so page scripts can't read it, SameSite lax, secure in production, and it lasts a year. Clear it and your stickers are no longer reachable from this browser; that is what the recovery link, the verified domain and the email address are for.
• pile_sites — only if you slap as more than one site from this browser. It holds the owner tokens of the sites you are not using right now (at most 10), so you can switch back to them. Same settings as pile_owner, and it is removed when it would be empty.
• pile_check — set only while you are proving you control a domain. It holds the secret half of that check, so a token read off public DNS can't finish somebody else's. HttpOnly, one day.
• pile_social — only while you connect X or LinkedIn: a hash of that connection's one-time state, sent back only on that network's return to us, so a connect link opened in someone else's browser can't attach their account to your sticker. HttpOnly, SameSite lax, ten minutes.
• Operator sign-in cookies — only on the operator's console, and only for the people who run the wall. They are prefixed slapwars, secure, SameSite strict, and the session lasts a week, refreshed a day at a time. A visitor never gets one.
• sidebar_state — also the console's, written when its sidebar is opened or closed so it opens the same way next time. A preference and nothing else: it holds "true" or "false", for a week.

Every cookie and stored value here is strictly necessary for something you asked the wall to do, and the analytics stores nothing on your device, so there is no consent banner. If that ever changes, a banner comes first.

We read the address Cloudflare's edge reports (cf-connecting-ip) to keep the wall from being drained or flooded, and its click counts honest. A network is an IPv4 address, or the /64 block an IPv6 address falls in, since one device can be handed a whole /64. What a network does is counted; past most limits it is refused, with when to try again, and a repeated report or click is simply not counted. Per network:

• 3 first drops and 10 free slaps a day;
• an hour: 20 site lookups and 60 checks of whose a site is, 30 logo uploads and editor saves together, 10 email links, 30 domain checks started and 60 looks for a check's record, 10 presses of "Read my site again", and 20 clips posted to X or LinkedIn and accounts connected together;
• an hour: 20 spot bids opened, 20 payments opened for top-ups and blasts together (a Checkout, or Apple Pay or Google Pay in the wallet), 10 sticker reports, 30 emailed links spent to sign in, confirm an address or stop emails, and 120 asks for your own row on the leaderboard;
• an hour, for what our cache hasn't already answered: 120 directory searches, 120 pages of slap history, and 120 sticker pages and replays together;
• an hour: 60 changes to your shelf, Show who I am and your email notes together, 10 new recovery links, and 10 props given;
• once: a report counts once per network per sticker a day, and a click out once per network per sticker an hour, or every ten minutes for a spot's link; a drop or lookup refused for going past its limit is written down once per network per window;
• and at the operator's console, ten refused tries in ten minutes.

The address itself is not stored. A network is counted under a hash of it: an HMAC-SHA-256 under a secret salt, so the hashes can't be turned back into addresses by trying every one. Without that salt set the hash is a plain SHA-256, which for an IPv4 address is weak; the salt is a launch requirement. To count a report or a click once, the hash is kept beside that sticker's id, or the spot's number; it is never shown, and never stored with the report or the click count. Every count is cleared after two days.

Two honest exceptions, both inside the operator's sign-in:

• The sign-in library stores an operator's IP address and browser user-agent string on their session row, in the clear. A session exists only once somebody has signed in, so that address is an operator's.
• Its rate-limit table is keyed on the raw client IP address joined to the path being called. Those sign-in addresses answer anybody who calls them, so if you open the console's sign-in page or call one of them yourself, your address is written there in the clear until the window it counts runs out. Nothing else on the wall keeps an address.

Cloudflare is the host and sees every request before we do. What it logs, and for how long, is Cloudflare's, under its own terms.

While the wall is open your pointer's position is sent to the server and relayed to the other people looking at the same wall, tagged with your sticker's name and colour, about sixteen times a second. It is never written down: it lives in memory for as long as you keep moving, and is dropped when you go quiet or leave. Positions are rounded, and they are positions on the wall — not on your screen, and not anywhere else on the internet.

Payments go through Stripe. You leave Slapwars for Stripe's own checkout pages or, for Apple Pay and Google Pay, pay with Stripe's own buttons in the wallet, so card numbers are never sent to us and we never hold them. Stripe collects your card details, your email address and, when tax collection is switched on, an optional business tax ID, under Stripe's own privacy policy.

What we keep is the accounting: the purchase, what it was for, the amount, its Stripe session and payment identifiers, and the credit ledger that the amount lands in. Your owner token is never sent to Stripe — the checkout carries only the purchase's id.

If you have no email address on your account, the one Stripe collected when you paid is kept as the way back to your stickers, unless another account already has it.

A bid on a spot is a hold on your card rather than a charge, and the hold that wins is captured when the auction closes. Once Stripe has confirmed a bid's hold, we ask Stripe for the last four digits of the card it is on and keep them with the bid, so your own bid pages can say which card holds it. Only you, the bidder, are shown them.

An email address is optional, and there is at most one per account. It is used for a link to confirm the address, a link to get back to your stickers on another device and, unless you switch them off in "Tell me when", a note when someone slaps over your sticker (at most one an hour), outbids you on a spot, or gives your company props (at most one a day). Every one of those notes has a link that stops them. Nothing else is sent to it by us — no newsletter, no marketing.

The weekly email is separate, and only for those who ask for it, from the directory, with a sticker or without. We send one link to confirm the address and nothing else until it is used; then one email a week with the week's winners and launches, each with a link that takes the address off the list. That address is kept on a list of its own, never tied to a sticker or an account, and deleted when you stop the emails, or after two days if it is never confirmed.

Sending is done by Resend, which handles the message on its way to your inbox. The links themselves are stored only as hashes, expire (fifteen minutes to sign in, an hour to confirm), and work once. We answer the same way whether an address is known to us or not, so nobody can use the form to find out who is here.

If you connect your X or LinkedIn account to post a slap clip, we keep the key that network gives us to post on your behalf, encrypted, with the account's name. We use it only when you press Post, to upload that clip and post the words you saw, and for nothing else: we don't read your timeline, your messages or your followers. Disconnecting, under "Connected accounts" in Settings (/settings/recovery), deletes the key from our side; you can also revoke it in the network's own settings.

Every link that goes on a sticker, and every address you ask us to make a sticker from, is checked before it is accepted:

• against our own blocklist, which is a list in our code and involves nobody else;
• against Google's malware and phishing lists — the Web Risk API, or Safe Browsing. The address is sent to Google to be looked up, and the verdict is cached for a day. This is Google's service and its handling of the lookup is Google's.
• against Cloudflare's family filter (1.1.1.1 for Families), which knows adult and malware sites. Only the domain is sent, as an ordinary DNS question from our server, never your own address, and the verdict is cached for a day with Google's.

When a check refuses a name or a link, we keep what was typed and which check refused it for 30 days, so we can see what is being tried and block it. That record holds no network address and nothing that says who typed it.

If you ask us to build a sticker from a web address, our server fetches that site to read its name, its description and its icon, over https, with a deadline and a cap on how much is read. That fetch comes from us, so the site you named sees a request from our servers.

Names and links also pass a word filter that runs entirely in your browser and again on our server. Nothing is sent anywhere for it.

If you verify a domain, we look for your token in one of three places: a DNS TXT record, read over DNS-over-HTTPS at cloudflare-dns.com; a file at a well-known path on the site; or a meta tag on its homepage. So a verification tells Cloudflare's resolver which domain was looked up, and fetches the site itself. We store the domain, which account holds it, which of the three methods proved it, and when.

A logo you upload is re-encoded by your browser to at most 256px and stored in our image bucket. It is served publicly, under a random key, and cached at the edge: anyone with the address can fetch it, which is the point of a sticker.

A second, larger copy — up to 1024px, kept so the editor can work from the best pixels — goes into a separate private bucket. No route serves it. Only your own editor reads it back, and it is deleted whenever its logo is.

Logos may be held for a person to review before the wall prints them. Until a logo is approved, only you and the people who run the wall can fetch it. A rejected logo is deleted, original and all.

A link on a sticker goes out through /out/:id with rel="noopener nofollow", and a spot's through /out/spot/:rank. We add one to its public click count and send you on, but only the first time in an hour from your network (ten minutes for a spot), so opening a link over and over doesn't pad it. The link works every time. We do not record who clicked: no address, no country, no row per click — only a number that goes up. To count your network once, we keep its hash beside the sticker's id, or the spot's number, as described under Your IP address; it is cleared after two days.

The redirect sends Referrer-Policy: origin, so the site you land on is told you came from slapwars.lol, and not which page or sticker you came from.

One link works differently: on a company page whose owner's spending has unlocked the followed link and who verified that domain, the link goes straight to their site instead of through us, and the click is counted by a small beacon to the same address, once per network an hour like the rest. What we keep is the same either way.

Each click out is also counted once in our analytics, as an outbound_click. It says which sticker or spot was clicked (its public id, as on its page), the domain the link goes to — never the rest of the address — which part of the site it was clicked from (the wall, a sticker's page, the directory…), and public facts about the sticker such as how buried it was. It is sent by our server, which passes on your IP address and browser's user-agent to OpenPanel — the same two your browser already sends it with every page view — so the click is counted inside your visit. We keep neither.

A sticker's owner sees, on their own page, how often their stickers were seen on the wall, how many visits their sticker's page had and how many clicks reached their site, by day. These are counts and nothing else: no row says who looked. A wall you open counts each sticker drawn on it once, and a sticker's page counts your visit once, each at most once an hour from your network, counted under its hash as described under Your IP address. The page asks for that count itself, with a request that carries no cookie of ours but the owner's own (so an owner's visits to their own page are left out). Crawlers and scripts are not counted.

One key in this browser's local storage, pile-bids, holds the ids of your last 30 bids, so the wall can recognise your own bids when you come back from Checkout. It never leaves your browser, and clearing your browser data clears it.

A second key, pile-buying, is kept in the tab's session storage as you leave for Checkout or pay in the wallet, and removed when you come back or the payment is done: it says what you were buying, so the page can open where you left it. It also never leaves your browser, and closing the tab clears it.

We use OpenPanel (openpanel.dev) to count how the wall is used: which pages are opened, which slaps sell, and where people give up on a checkout. When it is switched on, your browser loads OpenPanel's script from our own address and sends its events there, and our server passes them on to OpenPanel with your IP address, as the script would have shown it. Nothing is added on the way. It is never loaded on the operator's console or on a recovery or sign-in link.

What is sent:

• Page views: the page's path, such as /faq or /s/…, its title, and the site that sent you here, plus a link's campaign tags (utm_source and the like) if it had any. Nothing else after a ?, and never the part after a #.
• What you do on the wall, by name: a free slap, a re-slap, a Slap over, a giant slap, a sticker bomb, a holo finish, the sticker edited, a share pressed (on X or copied), a bid placed, a checkout opened or come back from, and credit arriving, an aim started or cancelled, a company page or a directory shelf opened, a search run, a replay opened, and the sound or "show who I am" switch flipped. Where it has one, an event carries a price or an amount in cents, the spot's rank, which kind of checkout it was, a count (how many stickers a slap landed on, how many results a search found), and public facts about the wall: a sticker's public id, as on its page, and a directory shelf. Never what you typed — not a search, not a name.
• Stickers dropped or refused, from our server: a new sticker's public id, whether it has a link, a handle or a logo, or which check refused a drop (the name filter, the link checks, a rate limit), never what was typed, with your IP address and user-agent passed on to OpenPanel as for clicks out.
• Clicks out, from our server, as described under Clicks out.
• Revenue, from our server, only once money is certain: when Stripe confirms a paid credit top-up or blast, and when a winning spot bid is captured at the close. It carries the amount in cents, the currency (US dollars), which of those three it was and OpenPanel's own short-lived id for your browser, carried through Stripe's checkout (or kept with your bid until the close) so the sale counts inside your visit — never when a checkout merely opens, never for a bid that is held or released, never for granted credit, and with no Stripe id.
• A profile for your site, once you have a sticker. So that your visits, slaps, clicks and payments read as one story, even from another device, OpenPanel keeps a profile under an id our server makes from your owner token with a secret only we hold. The id can't be turned back into the token, and the token itself never leaves our server. The profile carries only what the wall already shows anyone: your sticker's name, your link's domain (never the rest of the link), its shelf in the directory, a spot you hold, what you have paid in total (the leaderboard's figure), how many stickers you have and the date of your first. Our server's events for you (clicks out, refused stickers, revenue) carry the same id. OpenPanel's script keeps the id in memory and stores nothing new in your browser. We do this on the basis of our legitimate interest in understanding how the wall is used. To turn it off, switch Show who I am off in Settings (/settings/profile), under "On the wall, as you": your cursor then says "someone", no profile is kept from then on, and your browser is given a fresh, anonymous OpenPanel id. Visitors without a sticker never have a profile.

What is never sent: your owner token, your email address, recovery or sign-in links, your full link or logo, anything you type, Stripe's ids for your payment, the hashes we keep of networks, or anything from the operator's console. Your sticker's name goes only on the profile above, and session recording is off.

OpenPanel sets no cookie and we have it write nothing to your browser's storage. Like any server your browser talks to, it sees your IP address and your browser's user-agent with each event. It uses them to work out a rough location (country, region, city) and the kind of device, and to tell visits apart by a hash of them, our site and a salt it replaces every day — so today's visit and tomorrow's are not linked.

OpenPanel processes these events for us under its data processing agreement (openpanel.dev/dpa, last updated 21 May 2026), which says the events are stored on Hetzner servers in Germany, with backups on Cloudflare R2 in the EU. Under that agreement events are kept for as long as our OpenPanel account is active, and deleted within 30 days of our deleting the project or the account. Because the events carry no identifier that lasts past a day, we can't pick out yours afterwards to show or delete them.

• Cloudflare — hosting and storage. The whole wall runs on Workers and Durable Objects; stickers, credit and accounts live in their storage, the operator's records and sticker reports in D1, and logos and the past walls' pictures in R2. Cloudflare's resolver also answers the domain checks, and its family filter is asked about the domain of every submitted link.
• Stripe — payments, and the card details we never see.
• Cloudflare Email Routing — receives what you send to hello@slapwars.lol and forwards it to the inbox we read.
• Resend — sending the email links and the notes you switched on, from its EU (Ireland) sending region.
• Google — Web Risk or Safe Browsing, which every submitted link is checked against.
• OpenPanel — the cookieless analytics described under Analytics, hosted in Germany.

The operator's sign-in uses Better Auth, which is software running on our own Workers rather than a service anyone else runs, so it sends nothing anywhere.

Each of these acts on our instructions under its own data processing terms. Stripe and Google are also controllers of some of what they handle (Stripe for fraud prevention and its legal duties as a payment provider), under their own privacy policies.

Your data is processed in the United States and the European Union by the providers above, and the people who run the wall may reach it from the United Arab Emirates. Where it leaves the EU, the EEA or the UK, it is covered by the EU–US Data Privacy Framework where the provider is certified to it, and otherwise by the European Commission's Standard Contractual Clauses (with the UK's addendum) in that provider's data processing terms.

The only analytics is OpenPanel's, above, and the only third-party scripts any page loads are OpenPanel's and, in the wallet, Stripe's, for Apple Pay and Google Pay. No Google Analytics, no tracking pixel, no session recorder, no error reporter, no advertising tag, no embedded widget but those payment buttons. The fonts are served from this site rather than fetched from anyone else.

We don't sell data, we don't share it for cross-context behavioural advertising (in the words of California's law), and we don't build profiles or make automated decisions about you that have legal or similar effects. There are no bots and no fake counters on the wall, so nothing here is measuring you to make a number look better.

• Stickers are kept. On Sunday 20:00 UTC the cleaner may scrape the wall (by default only when it is at least 60% covered, taking stickers older than 48 hours and keeping the newest 40), but scraping is archiving: the row stays, stamped with its wall, and its page and its link keep working, because a past wall is part of the product. Taking a sticker down for breaking the rules hides it; it does not delete it either. To have yours erased, see your rights.
• Logos are deleted when the logo they belong to is replaced, rejected or killed — the public copy and the private original together.
• Pictures of past walls. A past wall can be kept as a picture of the whole site that week: it is drawn once, the first time it is asked for, and stored with Cloudflare (R2) for as long as the archive of past walls exists. When we take a sticker down, every picture it could be in is deleted, and drawn again without it the next time it is asked for; so are the pictures of the weeks a spot's holder held it, while that holder is under review.
• Rate-limit counters are cleared after two days.
• Reports. Reporting a sticker keeps only that sticker's id and the time, never who sent it, for 90 days. Counting each network once per sticker a day keeps that network's hash with the sticker's id in the rate-limit counters above, which are cleared after two days, and never with the report.
• Email links and domain checks expire on their own and are stored only as hashes.
• Purchases and the credit ledger are the financial record. They are kept for seven years from the end of the year of the payment, so that we can account for it to tax authorities and answer a dispute about it; after that it is deleted or made anonymous.
• Your email address, if you gave one, is kept while the account it gets you back into exists, and removed on request.
• The weekly email's address is kept until you stop the emails, and an unconfirmed one for two days.
• Emails you send us are kept as long as we need them to answer you and deal with anything that follows from it.
• Analytics events: as long as our OpenPanel account is active, as described under Analytics.
• The operator's audit log is append-only: who did what, to which sticker, whether it worked, and a salted hash of their network. Nothing in the code deletes a row from it, so — stated plainly rather than dressed up — there is no erasure path for that log today. It records the people who run the wall, not visitors.

Data protection law in the EU and the UK asks for a reason, a "legal basis", for each use of data. Ours:

• To give you what you asked for (performing our contract with you): the owner token and the keyring, your stickers, logos and links, your credit and purchases, the email links, domain checks and recovery.
• Our legitimate interests, weighed against yours: counting actions per network so the wall can't be drained or flooded and its click counts stay honest, checking links for malware and phishing, the operator's audit log, the live cursors, and the cookieless analytics that tell us which parts of the wall work. You can object to any of these (below).
• The law: keeping the financial record, and answering lawful requests from authorities.

We don't ask for consent for anything here, because nothing here needs it; if that ever changes, we ask first.

If you are in the EU, the EEA or the UK, the GDPR or the UK GDPR gives you the right to access, correct, erase, restrict, and port your data, and to object to what we do on the basis of legitimate interests. In California, and the other US states with privacy laws, you have the rights to know, delete and correct, and not to be treated differently for using them. In the United Arab Emirates the Personal Data Protection Law gives you similar rights. We give everyone the same rights, wherever they live, and answer within 30 days.

To use any of them — a copy of your data, a correction, an erasure, an objection — write to hello@slapwars.lol. What the code means for how that works:

• We usually can't tell who you are. There is no account: the identity is a random token in your browser. A request about your own data has to come with something that proves the connection — your recovery link, your verified domain, or your confirmed email address. We ask for nothing more than that.
• Erasing a sticker means we take it off the wall, delete its logo files and every past wall's picture it is in, kill its link, and remove its name and link from our records — except where the sticker was paid for, in which case we keep only what the financial record needs for as long as it must be kept.
• Some things are kept on purpose: the financial record (for the period above) and the operator's audit log, which records the people who run the wall, not visitors.

We answer within 30 days (45 for a California request, if we need it), and tell you if we need longer and why. Using your rights costs nothing and changes nothing about how the wall treats you.

If you're unhappy with our answer, you can complain to the data protection authority where you live or work, or where you think the problem happened: in the UK the Information Commissioner's Office (ico.org.uk), and in the EU and EEA the authority for your country, listed by the European Data Protection Board (edpb.europa.eu). We'd rather hear from you first, but you don't have to.

Everything travels over HTTPS. Secrets — recovery links, email links, domain-check secrets — are stored only as hashes, networks only as keyed hashes, and the owner token sits in a cookie page scripts can't read. The console is behind a sign-in with rate limits and a fresh-session rule for every change, and every change is logged. No system is perfectly secure; if a breach puts your data at risk, we'll tell you and the regulators the law requires us to tell.

Slapwars is not for children. You must be at least 16 to use it and 18 to pay for anything. We don't knowingly collect data from anyone younger; if we learn a sticker belongs to someone under 16, we take it down and erase it as described above, and refund anything paid.

When this notice changes we will date the new version and say what moved. A material change is announced on the site at least 30 days before it takes effect, and every version shows its number and the date it took effect. Smaller fixes (a typo, a clearer sentence) take effect when published.

What moved in version 1.2: your settings are in Settings (/settings), not in a panel on the wall; every count we keep per network is listed, IPv6 is counted by its /64, and a report and a click out each count once per network; a spot bid keeps its card's last four digits, which only its bidder sees; Apple Pay and Google Pay can be used in the wallet, with Stripe's own buttons and script; reports of a sticker, the past walls' pictures, the cookie kept while you connect X or LinkedIn and who can fetch a logo waiting for review are described; and the company page's indexed page, followed link and AI profile are unlocked by spending, no longer bought; and OpenPanel's script and events go through our own address, with a new sticker and a logo counted by our server.