Privacy Policy
Effective October 21, 2026 · Last updated October 21, 2026
Who Spent Most ("we", "us") runs whospentmost.com, a public leaderboard where people buy a listing for their name and a short message, ranked by the total amount they've paid. This policy explains what information we collect, how we use it, who we disclose it to and how, and how we keep it secure.
The short version
- Your display name, message, amounts, and rank are public. Choose Anonymous to hide your name.
- Card payments are handled by Stripe. We never see or store your full card number.
- We don't sell your personal information, and we don't use advertising or cross-site tracking cookies.
- We keep purchase records to meet tax rules and to handle chargebacks.
1. Information we collect
Information you give us
- Account details: email address, display name, and password. We store the password only as a one-way hash, never in readable form.
- Listing content: the name and message you enter for the leaderboard, and whether you chose to appear as Anonymous.
- Reports: the reason and any details you include when you report an entry.
- Messages to us: anything you send to our support email.
Information from purchases
- Purchase records: amount, currency, date and time, the list it applies to, and Stripe's transaction ID.
- Limited card details from Stripe: card brand, last four digits, expiration date, and billing country and postal code. Your full card number and security code go directly to Stripe and never reach our servers.
- Payment status: whether a payment succeeded, failed, was disputed, or was charged back.
Information collected automatically
- Technical data: IP address, browser and device type, and the time and pages of your requests.
- Security records: sign-in times, your acceptance of our Terms (with timestamp and IP address), and actions like purchases and reports.
2. How we use it
- To create and run your account and show your entry on the leaderboard.
- To process purchases, add them to your total, and send receipts.
- To keep the site safe: verifying email addresses, stopping fraud and stolen-card use, rate-limiting abuse, and blocking hate speech.
- To review reports and moderate entries that break our rules.
- To respond to chargebacks and payment disputes, and to enforce bans on accounts that file them.
- To answer your support requests.
- To meet legal, tax, and accounting obligations.
We don't sell your personal information or share it for cross-context behavioral advertising, and we don't use it to build advertising profiles.
3. What's public
The leaderboard is the product, so some information is visible to anyone who visits the site:
- Your display name (or "Anonymous" if you chose that), your message, your rank, your total and monthly amounts, and the month you joined the list.
Your email address, payment details, and IP address are never shown publicly. Choosing Anonymous hides your name from the public, but we still know which account the entry belongs to. Anything shown publicly may be seen, copied, or archived by others, including search engines.
4. Who we share it with
We disclose personal information only to these parties, and only what each one needs:
| Who | What | Why |
|---|---|---|
| Stripe, Inc. | Payment details, email, purchase amount, IP address, device data | Processing payments, fraud prevention, and dispute handling. Stripe's own privacy policy applies to the data it collects. |
| Hosting and infrastructure providers | All data we store, and request logs | Running the website, database, and backups |
| Email delivery provider | Email address and message content | Sending verification emails and receipts |
| Card networks and banks | Purchase records, Terms acceptance, sign-in and listing records | Responding to a dispute or chargeback you filed |
| Law enforcement, courts, regulators | Whatever the request lawfully requires | Complying with valid legal process, or protecting people from harm |
| A buyer or successor | The data described in this policy | If the site is sold or merged, under this same policy |
Our service providers may use your information only to provide their services to us, not for their own purposes.
5. How it's shared
- Payment data is entered on Stripe's secure checkout and sent directly to Stripe over an encrypted connection. Stripe returns only the limited details listed above.
- Service providers receive data electronically, through their encrypted interfaces (APIs) or the secure systems they host for us.
- Dispute evidence is submitted electronically through Stripe, which passes it to your card issuer.
- Legal requests are answered only in response to valid legal process, using a secure method appropriate to the request.
- Public leaderboard data is published on the website for anyone to view.
6. How we protect it
- Encryption in transit: the whole site uses HTTPS (TLS), so data between your browser and our servers is encrypted.
- No card storage: payments are processed by Stripe, which is certified to PCI DSS Level 1, the highest level of security for payment card data.
- Password hashing: passwords are stored with a strong, salted one-way hash.
- Encryption at rest: our database and backups are stored encrypted.
- Limited access: only the site operator can access personal data, using accounts protected by multi-factor authentication.
- Application safeguards: we validate all input, protect against injection attacks, and limit repeated sign-in, purchase, and report attempts.
- Monitoring: we watch for suspicious activity and keep software up to date.
No system is perfectly secure. If a breach affects your personal information, we'll notify you and the authorities as the law requires.
7. Cookies
We use only the cookies needed to run the site: a cookie that keeps you signed in, and security cookies that protect forms from abuse. Stripe's checkout may set its own cookies for fraud prevention. We don't use advertising cookies or cross-site tracking. If we add analytics later, we'll update this policy first.
8. How long we keep it
- Account and listing data: while your account is open. All-time entries stay on the list until you delete your account or ask for removal.
- Purchase records: up to 7 years, for tax, accounting, and dispute purposes.
- Banned accounts: the minimum needed to keep the ban in place (for example, email address and payment fingerprint).
- Technical and security logs: up to 90 days, unless needed longer to investigate abuse or a dispute.
- Reports: up to 2 years after they're resolved.
9. Your choices and rights
- Hide your name: switch your entry to Anonymous at any time.
- Access or correct: ask for a copy of your data, or fix your display name or message.
- Delete: ask us to delete your account. We'll remove your entry from the list and delete your account data, except purchase records and the minimum we must keep for legal reasons or to enforce a ban. Deleting your account doesn't make a purchase refundable.
- Emails: we only send emails needed to run your account, like verification and receipts.
Depending on where you live, you may have additional rights under state privacy laws. You can exercise any of these rights by emailing us. We won't treat you differently for doing so.
10. Age requirement
You must be 18 or older to create an account or make a purchase. We don't knowingly collect information from anyone under 18. If you believe someone under 18 has given us information, email us and we'll delete it.
11. Changes to this policy
If we change this policy, we'll update the date at the top. For significant changes, we'll notify account holders by email before the change takes effect.
12. Contact
Questions or requests about your privacy: support@whospentmost.com
We aim to respond within 7 days, and within the time limits set by applicable law.