Privacy Policy

This page describes what we actually collect and how we use it — it reflects what the code really does, not a generic template.

1. What we collect

• Account: email, nickname, password (stored only as a PBKDF2-SHA256 hash), a hash of your registration IP, and registration / last-login timestamps
• Comments: text (including @mentions), nickname, timestamp, and a hashed IP for abuse prevention
• Submissions: the URL, name, description, suggested country/category, your account email, hashed IP and browser identifier, and the review record
• Click statistics: site id, country/category, source, language, timestamp, plus hashed IP and browser identifier (for de-duplication and anti-abuse)
• Notifications: records of @mentions in comments

2. What we do not do

• We set no cookies ourselves: the session token lives in your browser's localStorage and is written only when you sign in
• No third-party analytics or ads: our CSP is same-origin only (default-src 'self'), so the page never talks to third parties
• We do not collect names, phone numbers, addresses or payment data, and we do not build ad profiles ourselves

3. How IP addresses are handled

We do not store plain IP addresses — only an HMAC-SHA256 hash with a server-side secret. It is used for two things: de-duplicating repeated clicks by the same visitor on the same site, and detecting automated traffic. (A plain SHA-256 would not be enough: the IPv4 space is small enough to enumerate, so we use a keyed HMAC instead.)

4. AI and third parties

The URL and description you submit are sent to a large language model provider for automated review and to pre-fill suggestions; a human always makes the final decision. Please do not include sensitive information. When no model is configured (mock mode), this content is not sent anywhere.

Otherwise we do not share your data with third parties, except where legally required.

5. Retention

Accounts, comments, submissions and click events are kept while the site operates. There is currently no automatic expiry; ask us for deletion as described below. Click events are used only for statistics and de-duplication, not to identify individuals.

6. Your rights

You can ask us to access, correct or delete data tied to your account. There is no self-service deletion yet — please leave a note via the submission page and we will handle it within a reasonable time. After account deletion your comments remain but are no longer linked to an account.

7. Minors

This site is not directed at children. If you are below the age of legal consent, please use it with a guardian.

8. Changes

If this policy changes we will update the date at the top of this page and summarise what changed.