Privacy policy.

Who runs the site.

status.forsale is an independent HTTP status code reference and advertising service.

Daniel Lawson is the controller for the personal information described in this policy, trading as status.forsale from United Kingdom. The operator and postal details are in the legal notice. For privacy questions or requests, contact hello@status.forsale.

Information we use.

• Adverts: the company name, website, domain, logo URL, advertising line and description you submit, along with the selected code, claim identifier, time and displayed amounts.
• Checkout identifier: a random identifier in an essential HttpOnly cookie attaches a checkout to this browser and supports eligible previous-payment credit for the same destination URL and HTTP code.
• Website imports: when you request an advert preview, we read public metadata from the website you enter. You can review and change those details before submitting.
• Cookie choice: your browser stores whether you have accepted or rejected optional analytics. See the cookie policy.
• Technical requests: our hosting providers receive connection details such as IP addresses, request URLs and browser information to deliver and protect the service.
• Sponsor-link clicks: we keep an aggregate click count for each paid advert when a visitor follows its website link. We do not attach a visitor identifier or IP address to that count in our database.

Optional analytics: if you accept analytics, our analytics provider receives page views, browser and device information, a browser/session identifier, and events for starting a claim, importing a website, selecting manual entry and completing a claim. These events include the status code, takeover indicator and displayed amounts, not company descriptions, email addresses or payment-card details. Page and referrer URLs have query strings and fragments removed. Session replay, automatic form capture and automatic error capture are disabled. The navigation reads a temporary presence channel while the site is open. Your browser publishes a presence entry and is included in the live count only after analytics acceptance. That entry is removed if analytics is rejected or consent is withdrawn.

The claim form does not take an email address or card details. Dodo collects the billing identity and payment details on its hosted checkout. Avoid entering personal or confidential information in advert fields or website URLs.

Why we use it.

Advert details let us show the advert you submit. Claim records and the private browser identifier let us identify the current holder, calculate takeovers and recognise previous claim credit. Technical information supports delivery, security and troubleshooting. Aggregate sponsor-link counts help us report how often an advert sends visitors to its website.

We rely on our legitimate interests to run and protect the service, publish submitted adverts, maintain claim history, calculate takeover amounts and prevent misuse. We limit the information collected and keep the browser identifier private to balance those interests with your rights. Optional analytics relies on your consent. Rejecting it does not prevent browsing or claiming. You can withdraw it at any time through Cookie settings. We do not use marketing trackers.

You can browse the reference without submitting an advert. The claim feature needs the requested company details and an essential browser identifier to work. Prices follow fixed takeover rules; there is no advertising profile or automated decision with legal or similarly significant effects.

Who receives it.

Other people with access to the site can see submitted advert details, claim history and recent activity. Those details also appear in the code’s response and share images. They are intended for display; the browser identifier and private credit calculation are not published with them.

The site is delivered through Vercel, with claim records stored in a Supabase database. Hosting access is separate from the app’s cookie notice.

When analytics is accepted, our analytics provider processes analytics for us. Its service receives IP addresses and browser request information when analytics events are sent. Dodo acts as merchant of record, processes the information supplied on its hosted checkout and sends signed payment notifications to our server. Supabase holds the order and payment references. We do not store card numbers.

Website imports resolve the entered domain through the hosting runtime and request the entered page from its website server. These server requests do not forward your browser cookies. Displaying an externally hosted company logo connects your browser to that image provider, which receives your IP address and browser request information. Visiting a sponsor’s link takes you to a separate website with its own privacy practices.

Some providers may process information outside the UK. Where UK data protection law requires safeguards, we rely on an applicable adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum. Contact us to ask about the safeguards that apply to your information.

How long it stays.

Checkout identifiers expire one year after the latest claim interaction. Cookie choices expire after 180 days. Analytics stops when the choice expires or is withdrawn, and its browser identifiers are cleared on the next consent check. Clearing browser storage does not erase adverts or claim records from the database.

Browser consent expiry does not automatically delete analytics events already received by our analytics provider. We keep analytics only while it is useful for understanding use of the service and review whether it is still needed at least once a year. Claim records remain while they are needed to show the current advert, explain takeover history, calculate claim credit, handle rights requests or resolve disputes. Payment records remain while needed for accounting, fraud prevention, disputes and legal obligations. We delete or anonymise records when those purposes no longer apply, unless the law requires longer storage.

Share images use versioned URLs and can be cached for up to a year. An old image can still describe an earlier advert after a takeover. Removal requests need to consider these cached copies as well as the advert record; copies already held by other websites are outside our direct control. Vercel and other infrastructure providers keep operational and security logs according to their own documented retention schedules.

Your choices and rights.

To request access, correction or deletion of personal information, or ask about restriction or portability where applicable, contact hello@status.forsale. Include the relevant code and advert URL; do not send browser cookies or passwords. We may need information to verify that the request relates to you.

You can object to the use of your personal information based on legitimate interests. Explain your circumstances when contacting us so the request can be considered.

You can also complain to your local data protection authority. In the UK, you can contact the Information Commissioner’s Office.

Material changes to tracking or payment processing will be reflected in this policy and the consent controls before they are introduced.