What stains... permanently.

Privacy Policy

Last updated: 9/15/2026 (mm/dd/y)

What blood.bid keeps

We keep only what the service needs to run, and we can state it plainly: your internal account identifier, the usernames you hold, the page configuration attached to each name, your inbox alerts, and the auction bids and transfer history behind each name. We don't keep other categories of personal data unless this policy says otherwise.

Quality of life

A few small things improve the experience: theme and layout preferences, your settings, and the music bar state (like the track already playing on your page). These are stored so the site looks the way you left it.

What we don't do

• We don't sell or rent your data. We don't run ads from anyone else — the only promotions you'll see are blood.bid's own Blood+ spots.
• We don't track you across the rest of the web.
• We don't build profiles of who you are beyond your own account.

Notifications, not messages

Your inbox is a notice board, not a mailbox. It collects only blood.bid's own alerts — a name you're watching putting up a listing, an auction going live, an update from the floor. There's no direct messaging between users on blood.bid, so there are no private messages to store, route, sell or hand over. If messaging is ever added, this policy will say exactly what that stores.

Technical logs

We may keep short-lived technical logs — the endpoint, status and timestamp of a request — to stop abuse and keep the auction floor fair. When you sign in we also record your IP address and browser user-agent with that session. These are used to secure your session, catch brute-force login attempts and enforce rate limits — not to build profiles of you. Session rows are automatically purged within 30 days of expiry; the row itself never outlives that window. Infrastructure providers such as Cloudflare process connection information as necessary to provide their services, subject to their own policy.

Auction records are permanent

Auction and transfer records are retained as long-term provenance records — who held a name, when, and at what bid. Where an account is deleted, identifying account information may be removed or detached while the name's historical record remains. A name's provenance should outlive its former owner, not drag their identity along behind it.

Deletion

Remove a page and its configuration and contents go with it. Remove an account and its data is erased: settings, inbox alerts, credit history and the account identifier itself. Auction records for names that already changed hands are kept, as noted above.

Payments

Card details are handled by the payment processor (Stripe) rather than stored by blood.bid; our servers never receive them. We retain payment information such as transaction status, amount and relevant transaction identifiers as needed to operate the service and maintain financial records.

Third-party services

There are no ad networks and no tracking scripts built in. The services we rely on are named here: Cloudflare (content delivery and protection) and Stripe (payments). If we add or change a third-party service, this list is updated, with a link to its own policy.

Legal requests

We may disclose data where the law requires it — on a valid court order or equivalent process. We don't run a messaging service, so there are no message contents for anyone to request. Legal requests can reach the data we already hold, not anything beyond it.

Cookies and local storage

We use a small number of first-party cookies: the session cookie (required to stay signed in) and a short-lived referral cookie (bb.ref) when you follow an invite link. No tracking cookies, no advertising cookies, nothing from third parties. Your browser's local storage stores a handful of quality-of-life preferences — the theme you chose, the track on your music bar — none of which is shared with anyone.

Age

blood.bid isn't aimed at children. First-time members must confirm they're old enough to enter into the Terms where they live — and we don't knowingly collect personal information from anyone under that age. If we learn an account was opened by someone who isn't old enough, we'll delete its data as described in Deletion.

Contact

Questions about what's stored: open a request from Support and a human (not a script) will answer.