Privacy Policy

What we collect

• Server logs: IP address, browser type, and requested pages, kept for 14 days for security and debugging, then deleted.
• Abuse prevention: to protect costly features we briefly record a one-way hash of your IP address, never the address itself. These records are deleted within 24 hours.
• Account data (only if you sign in with Google): your Google account's email address and name.
• Listings you submit: the name, URL, tagline, description, category, tags and any other details the submission form asks for, any logo or screenshot you upload, and a record of the automated review of that submission.
• Payment records: your email address, the payment provider and payment ID, which listing was upgraded, the type of upgrade, the amount and currency, the payment status, and the time of payment.
• Usage statistics: data about how the site is used (pages visited, referrers, approximate region), to understand what the directory is used for.
• Cookies and browser storage: one session cookie, set only when you sign in and required for sign-in to work. Our analytics runs in its cookieless mode: it sets no cookies and keeps only a session-scoped entry in your browser that is discarded when you close the tab.

Why we collect it

To operate and improve the site, let you sign in, publish the listings you submit, and contact you about them.

The legal bases: your account data, listings and payment details are processed to provide the service you asked for. Payment records are also kept to comply with tax and accounting obligations. Server logs and abuse prevention rest on our legitimate interest in keeping the site secure and available. Usage statistics rest on our legitimate interest in understanding how the directory is used so we can improve it; you can object to that at any time.

Who we share it with

We never sell your data. A few services receive data from us, each only for the purpose named:

• Google: the sign-in exchange, for authentication. Google acts on its own account for that step, not on ours, so Google's own privacy policy governs it.
• OpenAI: the text of a listing you submit (name, URL, tagline, category, tags, description), for the automated review described below, and any logo or screenshot you upload, to screen it for unsafe content.
• Anthropic: the text of a listing you submit (name, URL, tagline, category, tags, description), for the automated review described below.
• Resend: your email address and the message text, to send you service emails about your listings.
• Cloudflare: uploaded images and requests to the site, for storage and delivery.
• Datafast: usage statistics, for analytics.
• Dodo Payments: checkout and billing information, to sell and process paid upgrades as our merchant of record. Dodo Payments acts as an independent controller for this processing, under its own privacy policy.
• Our hosting provider: everything the site stores, to run the server.

Where a provider processes data outside the EU, that transfer relies on the European Commission's standard contractual clauses or an adequacy decision. Email us if you want to know which safeguard applies to a particular provider.

Automated review of submissions

Listings are checked automatically before they are published, and a submission can be rejected. The decision only ever affects whether a listing is published. You can change the listing and submit again, or write to us if you think a decision was wrong.

Your rights (GDPR)

How long we keep things: backups of the database, and copies of images you removed, are kept for 60 days so the site can be recovered after a failure. After that they are deleted.

Payment records: payment records are kept for as long as statutory retention requires, even if you delete your listing or account during that period.

Deleting your account: sign in and use your account page. It removes your profile, your listings, and your sessions on every device, and puts your uploaded images beyond public reach at once. The image files themselves are deleted once the 60 day backup window has passed. It cannot be undone.

What survives deletion: we keep a record that a deletion happened, and when, so that restoring a backup cannot quietly bring a deleted account back. It holds no profile data. Payment records survive as described above.

You have the right of access, correction, deletion, restriction, portability and objection, and the right to complain to a supervisory authority. To exercise any of these, email [email protected]. The legal notice names the data controller.