Privacy notice

Account and submission data

Accounts can store a name, email address, hashed password, email verification state, and session information. Authentication uses session cookies.

Submissions can store product content, official website and maker links, categories, review history, backlink checks, and order state. Administrators can view submission and review records needed to operate the directory.

Directory analytics

The current code uses a first-party anonymous cookie to support daily deduplicated counts. It records daily keyed hashes for product views and website clicks. These metrics support directory reporting and Featured placement operations.

The current code does not describe a third-party advertising tracker. If production analytics or advertising services are added, this notice and the relevant consent controls must be updated before launch.

Cookies and browser storage

Session cookies are used for authentication. A theme preference is stored in browser localStorage. The anonymous directory cookie is scoped to daily counting and deduplication.

Users can clear browser cookies and storage through browser controls, but clearing authentication cookies may sign them out or remove local preferences.

External resources

Product icons and preview images may load from third-party hosts, which can expose a visitor IP address and request metadata to those hosts. Following a product website or any other external link is governed by that site own privacy policy.

Payments and email

The current repository uses local test checkout and email flows. It does not process real card data in local testing.

Before live payments or production email are enabled, the operator must select production processors, publish their terms and privacy information, configure support contact details, and define lawful data handling for each region served.

Retention and deletion

Data retention periods, deletion workflows, backup schedules, export processes, and legal bases for processing are not finalized in this draft. The operator must define these rules before collecting production data.

This draft does not promise a retention period, deletion timeframe, account export, or response time that the current code does not already provide.

Questions and requests

A public customer support mailbox has not been configured in this build. The Contact page records that limitation rather than claiming that messages reach a real mailbox.

Before launch, the operator must provide a monitored contact channel, privacy request process, controller identity, and any legally required disclosures.

Changes to this notice

This review draft may change before launch. Any production notice must identify the responsible operator, effective date, scope, contact channel, and material changes in a way that is legally appropriate for the jurisdictions served.