Privacy policy

Last updated: 2 September 2026

DomainRiff.app is a crowdfunding platform for dormant domains. A domain owner lists a domain, proves they own it, and our AI agent writes reuse ideas for it. Visitors vote on the best idea, then contribute money through Stripe to fund the build. This policy explains what information we collect, why we collect it, and what you can do about it.

Who we are

DomainRiff.app is operated by an individual site owner in the United Kingdom. For any privacy question, contact the owner on X: @vibedcoder. We aim to reply within a few days.

Information we collect

• Account data. When you sign in with GitHub or Google (the only sign-in options), we store the email address, display name and avatar your provider returns, plus the provider name and identifier. We never see or store your provider password.
• Listings. The domain name you submit and its status history. To prove ownership we store a verification token and the method and time it was verified (HTML file or DNS TXT record). To check a listing we may fetch the public content of the domain you listed; we store only the verdict, not the fetched content.
• Generated content. The AI reuse ideas, riff score and category created for your listing. These become public with the listing. Idea generation is handled by our AI provider (see Third parties).
• Votes. Voting requires a sign-in, so we record your account, your IP address and the idea you voted for. Votes are free and limited to one per person per listing, and who voted is not shown publicly.
• Contributions and payouts. When you contribute, we store your email address, IP address, the amount, and Stripe's payment identifiers. If you own a listing that receives contributions, Stripe creates a Connect account for you and we store its identifier. Card numbers never touch our servers: payments happen on Stripe's hosted checkout.
• Technical data. Our web server logs IP addresses and user agents for security and abuse prevention. We set one essential session cookie when you sign in, and a small preference cookie if you dismiss the cookie notice. There are no advertising or tracking cookies.

How we use it

• To run the service: show listings, verify ownership, count votes, process contributions and pay out the owner's 85% share.
• To prevent abuse: IP checks enforce rate limits and the one-vote-per-person rule, and ownership proof stops other people listing domains they do not control.
• To comply with UK law: payment records are kept for accounting purposes as required.
• To contact you about your account or a listing, if needed.

We do not sell personal information, and we do not use it for advertising.

Third parties

We share the minimum necessary with the providers that make the service work:

• GitHub and Google for sign-in (they send us your profile data when you authorise it).
• DeepSeek for AI idea generation and abuse screening. We send it the domain name and, for screening, text from the domain's public website. We do not send your email address or other account details.
• Stripe for payment processing and owner payouts. Their privacy policy applies to the payment step.
• Cloudflare as our CDN and network edge; it processes standard request data to operate and secure the connection.

These providers may operate outside the United Kingdom; where we rely on them we use providers that offer appropriate safeguards for UK data protection law.

Where data is stored

Application data is stored on our own server in the United Kingdom. Payment data is held by Stripe under their policy.

How long we keep it

• Account data and listings stay until you delete your account or ask us to remove a listing.
• Listings that are never verified are cancelled automatically after 7 days and stop being processed.
• Vote records are kept to maintain the public tallies.
• Payment records are kept as required by UK accounting law and Stripe's terms.
• Server logs are kept for a limited time for security purposes.

Your rights

Under UK data protection law you can ask us to access, correct, export or delete your personal data, to restrict or object to particular processing, and to withdraw any consent you gave. To exercise any of these, contact the owner on X: @vibedcoder. We will act within 30 days. Deleting your account removes your listings and personal data, except payment records that UK law requires us to keep. You can also complain to the UK Information Commissioner's Office if you are unhappy with how we handle your data.

Children

DomainRiff.app is not aimed at children, and we do not knowingly collect data from anyone under 16.

Changes

If this policy changes, we will update the date at the top of this page. Material changes will be highlighted on the site.