Privacy

• Account: your name, email address, and — if you sign in with Google — the profile image and account id Google returns. If you use a password, only a hash of it is stored, never the password.
• Listings: everything you submit about a product, and the page content we fetched from your site to prefill the form.
• Votes: which products you upvoted and when, so each person votes once per product and vote rings can be spotted.
• Payments: if you buy placement, we store the amount, what it was for, and the Stripe identifiers. Card details go straight to Stripe and never touch our servers.
• Operational logs: short-lived server logs that can include IP addresses, used for rate limiting and abuse prevention.

Only the services needed to operate the site: Stripe for payments, Resend for transactional email, OpenAI to turn your submitted URL into draft listing copy, and Cloudflare as the CDN in front of our server. Everything else — the database and the application — runs on infrastructure we operate ourselves.

We do not sell personal data, and we do not run third-party advertising or analytics trackers.

Transactional emails about your own launches — confirmation, the reminder while your window is open, and the result — are part of using the service. Any newsletter is separate and has an unsubscribe link in every message.

A session cookie keeps you signed in. That is the only cookie the site sets, and it is strictly necessary — there are no advertising or analytics cookies.

You can edit or delete your listings at any time from your dashboard. Ask us and we will export or delete your account and its data. Deleting an account removes your listings and votes; published listings that survived may be retained in an anonymised form so leaderboards and historical archives stay intact — tell us if you would rather they were removed entirely.

Privacy questions and deletion requests go to the address listed on our contact page.

Note for the site operator: this describes how the application as built actually handles data. Before launch, confirm it still matches your deployment, add your legal entity and a real contact address, check your GDPR/CCPA obligations for your jurisdiction, and remove this note.