Legal
Privacy policy
What we collect, why, and what we never expose.
Data we store
- Account: name, email, hashed password (scrypt) or a Google account link, verification timestamps.
- Abuse prevention: keyed hashes of your signup IP address and browser user agent. Raw IP addresses are not stored.
- Activity: listings, points ledger, rank history, notifications, campaigns and audit entries needed to run the service.
- Analytics: outbound click counts per listing using rotating hourly visitor hashes. No third-party tracking scripts are loaded.
What is public
Listing titles, descriptions, URLs, favicons, committed points, rank history with timestamps, and the display name of the owner. Nothing else.
Cookies
A session cookie (HttpOnly, SameSite=Lax, Secure in production), short-lived OAuth state cookies and a referral-code cookie. No advertising cookies.
We send verification, password reset and rank notification emails only. Transactional email is delivered via SMTP when configured.
Retention and deletion
Account data is kept while the account exists. Email support to request deletion; ledger entries may be retained in anonymised form for audit integrity.
Payments
No payment data is collected while the platform is in demo mode. Any future provider will handle card details on their hosted pages; we will never store them.