Session cookie
Every visitor gets an httpOnly cookie named bms_session, signed by the server, lasting up to a year. It is the bidder credential. It is not used for advertising. There is no third-party auth provider.
Payments
Deposits and remainders are paid through NOWPayments. We store what NOWPayments reports about each payment — its id, status, the coin it was paid in, the amount that landed and the incoming transaction hash — against your session. We never see the wallet you paid from, so bids appear anonymously on the public auction board. Refunds are sent through NOWPayments to the payment they came from. Optional email, if you type one, is stored so we can send auction notices through Resend when that is configured.
What we do not do
We do not sell personal data. We do not run a marketing list off the bid form. We do not hold your private keys. Analytics, if enabled on the host, is Vercel Analytics page views — not a bidder dossier.
Operators
The site operator can see bids, payment records, and emails in the admin tools because those are required to settle remaining balances and send refunds.
Auction mechanics are on the rules page.