Privacy policy
Draft — structured for Québec's Law 25. Prepared with AI assistance, not legal advice. To be reviewed by a lawyer. Version 2026-10-11. Contact: [email protected].
1. Data we collect
We collect only what the site needs to operate:
- Accounts. When you sign in with a magic link, we store your email address (and your name if you provide one), your referral code, and who referred you. A session cookie (
sh_session, valid 30 days) keeps you signed in. - Anonymous usage statistics. Pages fire invisible beacons that record only anonymous aggregates: page views (page path, day, country), search queries (the query text, the number of results shown, day, country), listing views, and clicks on outbound links (repository, install-prompt copy, external purchase — listing, click type, day, country). When a search leads you to open a listing, we also record which listing answered which search (search text, listing, day). When you first arrive on the site, we record only a broad origin class — search engine, Reddit, GitHub, other social media, direct visit, or other — never the referring address itself. Searches made by AI agents through our public connector and our MCP server are counted separately by channel, and MCP tool calls are counted per tool per day (tool name, the listing concerned where applicable, day, country). No IP address, no user agent, no cookie, no account link. Signed-in sessions are never counted. If you'd rather not be counted at all, opt out in one click (this browser only; undo).
- Forms. Listing reports — name, email, message content.
- Install feedback. If you choose to leave feedback after an installation, we store your answers and optional comment, along with an optional email address if you provide one for follow-up. This data is only used for internal quality review and is never displayed publicly or shared with sellers without your explicit consent.
- Contest. Your avatar profile and entries (avatar name, public display name, bio, avatar image) and your votes (one per account per entry).
- Newsletter. Your email address if you subscribe via the footer form — every email includes an unsubscribe link.
We do not collect banking information; payments for our own services are processed by Stripe.
2. How we use it
Form submissions are used solely to review reports and to reply to you. Account data runs your account, the referral program, and the contest — public contest pages show only the display name you chose, never your email address. We do not sell personal information and do not use it for advertising.
3. Storage and retention
Data is stored on Cloudflare's infrastructure (D1 database). Reports are kept as long as needed for moderation, then deleted on request. Raw install feedback is kept for at most 12 months; after that, only per-listing aggregates survive. An email address provided for a feedback follow-up is deleted as soon as that follow-up is closed.
4. Your rights (Law 25)
You may request access to, correction of, or deletion of your personal information at any time by writing to [email protected] with the subject "Law 25 request". We will acknowledge receipt within 7 days and respond within 30 days. Deletion requests are honored unless we must keep data for a legal obligation (e.g. transaction records).
5. Cookies
This site uses no advertising or tracking cookies. It does use:
sh_session— strictly necessary session cookie (30 days) that keeps you signed in; set only after you request a magic link.- Your language preference — stored in your browser only, never sent to our servers.
6. Security incidents
We keep an internal register of confidentiality incidents as required by Law 25. If an incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information as required by law.