Privacy policy

Who is responsible

TODO — your full legal name, at TODO — postal address, is the data controller for crackedlist. For anything in this policy, email TODO — support@crackedlist.dev.

What we collect

• Account — your name, email address, and profile image from the provider you signed in with, or the email and password you chose. Needed to give you an account and tie a listing to it.
• Listing — everything you typed into the submit form, plus screenshots of the site you gave us. This is published deliberately; that is the product.
• Votes and reviews — what you picked, when, and the review text you wrote. Reviews are published with your name.
• Clicks — a per-listing, per-day count of outbound clicks. A count only; no per-visitor record.
• Technical — a one-way hash of your IP address and browser user-agent string, used to stop the same person voting twice and to spot vote manipulation.

What we do not collect

• We never store raw IP addresses. They are hashed with a secret key before anything is written, and the hash is truncated. A database leak does not leak visitor IPs.
• We never see or store card numbers. Payment is handled entirely by our payment provider.
• No advertising cookies, no third-party trackers, no cross-site profiling, no data sold or shared for marketing.

Cookies

We set one kind of cookie: a session cookie that keeps you signed in. It is first-party, HTTP-only and lasts thirty days. There is no advertising or analytics cookie, which is why there is no cookie banner.

Analytics

We use a self-hosted, cookie-less analytics install for page counts and referrers. It runs on our own server and collects no personal data and no cross-site identifiers. Outbound click counts that appear on member dashboards are counted by us, in our own database, per listing and per day.

Who else sees your data

• Our payment provider, for the purchase you make. They act as merchant of record and have their own privacy policy.
• Our hosting and database providers, as processors, to run the site.
• Anyone on the internet, for the parts of your listing that are public by design: name, handle, tagline, bio, screenshots, links, rank and counts.

How long we keep things

• Account and listing data: until you delete them, or you ask us to.
• Vote and review records: kept, because removing them would rewrite everyone's history. Reviews can be withdrawn from display on request.
• Matchup tokens: automatically deleted ten minutes after they are issued.
• Activity feed entries: automatically deleted after thirty days.
• Payment records: kept as long as tax and accounting rules require.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and listing. Email TODO — support@crackedlist.dev and we will act within thirty days. Deleting your listing removes it from every board; the anonymous vote records that referenced it stay, without your identity attached.

Children

This site is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has an account here, email us and we will remove it.

Changes

If this policy changes materially we will update the date below and note the change here.