Privacy Policy

Effective 5 September 2026 · Last updated 5 September 2026

This policy describes what tallest.company collects, what it publishes, who else processes it, and how to have it removed. It is written to describe the system as it is actually built, not the widest thing we might one day do.

The short version.

There are no accounts and no passwords. We set no cookies and run no analytics or advertising trackers. We never see your card details — the payment happens on our processor’s pages, not ours. Almost everything we do store is information you asked us to publish: your company, its icon, its link, and what it paid for its position on the ladder.

01Who we are

Tallest.company is operated by Devoic Skilltech & Consultancy Pvt. Ltd., a company registered in India, which is the data controller for everything described here. Reach us at growthsq.in@gmail.com — that is also the address for every request in this policy. Payments are handled by Dodo Payments as merchant of record.

02What we collect, and why

Your company’s placement — published

The website address you enter, your company name, its one-line description, its icon, the colours of its tower, the sector you pick, whether you raised a hiring board and the link on it, and the total amount you have paid.

All of this is public by design. It is drawn into the skyline and listed in the standings, where the whole point is that anyone can see it. The amount paid is public because it is the ranking — rank is cumulative spend, and a ladder whose ordering could not be checked would not be a ladder.

Kept while the placement stands, and in the bid ledger afterwards.

Metadata read from your website — published

When you enter a website address, our server fetches that page and reads its title, its meta description, its icon and its declared theme colour. We request only what a browser or a search engine requests, and only from the address you gave us. The icon is stored on our infrastructure and served from there rather than hot-linked from your site.

Cached by domain and refreshed on demand.

Payment records — not published

Our own claim identifier, your brand identifier, the identifiers our processor gives the checkout session and the payment, the amount, the currency, and whether it succeeded or failed.

We do not receive, see or store card numbers, CVVs, billing addresses, or the name and email you give at checkout. Those are collected by Dodo Payments on their own pages and under their own policy. What comes back to us is a reference and a result.

Kept as long as required for accounting and to resolve disputes.

Visitor presence — published only as a number and a figure

Each browser that opens the planet stores a random identifier in its own localStorage (under the key tbotm.session) and sends it back about every twenty seconds while the tab is visible, so we can show how many people are here now and how many have ever visited. We store that identifier, the time it was last seen, and a small opaque number that decides which settler on the planet is yours.

The random identifier is never shown to anyone else. Only the small opaque number is published, precisely so other viewers can see a figure without being handed anything that correlates your visits. The identifier is generated in your browser, is not derived from anything about you, and is not linked to any other data we hold — a placement you buy is not connected to it.

Kept indefinitely, because a returning browser that was forgotten would be counted as a second visitor. Clearing your site data ends it — you simply become a new visitor.

An in-progress checkout — your browser only

While a payment is open, your claim identifier is held in your browser’s sessionStorage so that returning from the payment page lands you back on your own tower. It is discarded when the tab closes.

Server logs — held by our providers

Our hosting and backend providers keep standard technical logs, which ordinarily include IP addresses, user agents and request times. We use these only to keep the service running and to investigate abuse. We do not build profiles from them and do not combine them with placements.

Retained under the providers’ own schedules.

03What we do not do

No accounts, no passwords, no email sign-up, no newsletter.
No cookies. The two things stored in your browser are the visitor identifier and an in-progress checkout, both described above; neither is a cookie and neither is sent to any third party.
No analytics, advertising, remarketing or cross-site tracking, and no third-party tags of any kind on the page.
We do not sell or rent anything we hold, and we do not share it for advertising.
No automated decision-making with legal or similarly significant effects.

04Who else processes it

Four parties, each doing one job:

Dodo Payments — merchant of record. Collects and processes your payment details and billing information on its own pages, under its own privacy policy. We never hold them.
Convex — the database and file storage the ladder and the icons live in.
Vercel — hosting and delivery of the site itself.
Google Fonts — the three typefaces the site uses are loaded from Google’s servers, which means your IP address and user agent reach Google when the page loads. No fonts are self-hosted at present.

These providers operate internationally, and information may be processed outside your country, including in the United States. We add no other third parties without updating this page.

05Public means public

A placement is an advertisement on a public page. Search engines, archives, screenshots and anyone who visits may copy or retain what they see. If we remove a placement at your request, we can remove it from this site — we cannot remove copies other people or services have already made.

06Your choices and your rights

Whatever your jurisdiction, you may email us to:

See what we hold about you or your company.
Correct a name, description, icon, sector or link that is wrong.
Have a placement taken down. We will remove it from the skyline and the standings. Taking a placement down does not refund it — see the terms.
Have the underlying records deleted, except where we must keep them: the bid ledger and payment records exist because money moved, and a disputed placement or a chargeback has to be reconstructable later. Those we retain for as long as accounting and dispute-resolution obligations require.
Object or complain. You may also complain to your local data protection authority.

Your visitor identifier needs no request from us: clear your browser’s site data for tallest.company and it is gone. We aim to answer everything else within 30 days, and to acknowledge within two business days.

07Security

The site is served over HTTPS. Payment credentials and API keys are held server-side and are never exposed to the browser. Because we never receive card details, the most sensitive information in the transaction never reaches our systems at all. No system is perfectly secure, and we do not claim otherwise.

08Children

This is a business-to-business advertising product. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has provided information, email us and we will delete it.

09Changes

We may update this policy. The effective date at the top changes when we do, and material changes will be reflected here before they take effect. This page always describes the system as currently built.

10Contact

Devoic Skilltech & Consultancy Pvt. Ltd., operator of tallest.company. Privacy questions, access and deletion requests, and takedowns: growthsq.in@gmail.com.