Privacy

The first time you click through to a listed site, a cookie called tj_vid is set. It holds a random identifier and a signature, nothing else — no name, no email, nothing derived from you. It is HttpOnly, so no script on any page can read it, and it exists for one reason: to know that this browser has already taken a click from a listing, so it cannot take the same one twice.

Your IP address is used but never stored. It is truncated first — to the network rather than the address, /24 for IPv4 and /64 for IPv6 — and then hashed with a secret key. What is stored is that hash. It cannot be reversed into your address, and its only job is the same: one click per network per listing.

Alongside that, each click through to a site is recorded — which listing, when, and whether it cost the listing anything — and your browser is counted as present so the board can show how many people are on it.

Signing in is by emailed link, so your email address is stored. There is no password. The address identifies your account, carries the clicks you collected, and is how we would contact you about the service. It is not used for marketing.

Polar is the merchant of record. Payment and billing details go to them, not to us — we never see or store a card number. What we keep is the record of the order: its Polar identifier, what was bought, the amount, and the email address on the purchase, so a payment can be traced if something goes wrong.

The URL you submit is fetched from our server and its title, description and icon are stored and shown publicly. Only pages that are already public are fetched.

Datafast counts visits to this site. It sets no cookie and builds no profile that follows you elsewhere; what it reports is aggregate — how many people came, from where, and which page they landed on. It is used to know whether the board is being found at all.

Supabase stores the database and runs sign-in. Vercel hosts the site. Polar processes payments. Datafast counts visits. Data is transferred outside the EU under the standard safeguards those providers publish. There is nobody else, and nothing is sold or shared for advertising.

Account and purchase records are kept while the account exists and afterwards for as long as tax and accounting rules require. Listings and their click history are kept for as long as the listing exists, which is what makes the board a record rather than a snapshot.

Hashed networks and visitor identifiers are kept for as long as they are useful against abuse. Today that means they are not deleted automatically. If you want yours removed, ask.

You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted, and you can object to it being kept. Email c00y@proton.me. For a signed-out visitor there is nothing that identifies you to us, so tell us the value of your tj_vid cookie or we will not know which rows are yours.

If you are in the EU and think this is being handled badly, you can complain to your national data protection authority. In Spain that is the AEPD.

If you switch between the light and dark themes, that choice is saved in your own browser’s local storage. It never reaches the server.

Email c00y@proton.me, or @erictormo on X. One person reads both, so expect a human answer rather than a fast one.