Privacy Policy

What we collect

• Account: your email, name and (if you use Google sign-in) your Google profile basics, plus a password hash if you sign up with email.
• Activity you create: favorites, product submissions, sponsorship bookings and purchases.
• Newsletter: your email, language and subscription status. You confirm by email first (double opt-in), and every email has a one-click unsubscribe link.
• Payments: handled by Waffo. We receive order status and the product bought; we never see full card details.

Verified revenue

If you connect a payment account for Verified revenue (Stripe or Waffo Pancake):

• What we read: with the restricted, read-only key you create, we list your subscriptions and charges, and read your account's website, support email and default currency to check that the account belongs to the product. A charge object includes customer details; we read them only in memory while adding up totals and never store them.
• What we store: the key, encrypted (AES-256-GCM envelope encryption; the master key is a Cloudflare Worker secret), its last 4 characters, your Stripe account ID and currency, and one row of totals per day: last-30-day revenue, MRR, active subscriptions and all-time revenue. No transactions and no customer data.
• What is public: those totals, the last sync date, your founder name, optional X handle and account avatar on your product page, your founder page and the badge.
• Waffo: we never receive a Waffo API key. You add a webhook URL that contains a secret token (we store only its hash). For each event Waffo pushes (orders, subscription changes, refunds) we check Waffo's signature and keep only the event type, amount, currency, date, subscription id and billing period, plus your store id and store name for the ownership check. The webhook payload also carries buyer details (email, billing address); we never store them. Numbers count only from the first event.
• How to delete: disconnect in Settings → Verified revenue (the Stripe key is deleted at once, or the Waffo webhook URL stops working at once; you can also revoke the key in Stripe or delete the webhook in Waffo). Syncing also stops and the key is deleted when your verification is not renewed or fails for 3 days in a row. The page then keeps its last totals marked "sync stopped". Deleting your account deletes the key and every daily total.

Analytics

We use Cloudflare Web Analytics, which does not use cookies or fingerprint visitors. It counts page views, referrers (for example visits from X) and performance. A small set of business events (signups, subscriptions, purchases, sponsor clicks) is stored in our own database without third-party trackers.

Spam protection

Sign-up, newsletter, submission and sponsorship forms use Cloudflare Turnstile to block bots, and we keep short-lived request counters per IP address to limit abuse.

Processors

Cloudflare (hosting, database, storage, email, analytics, Turnstile), Waffo (payments), Google (only if you choose Google sign-in), and Stripe (only when you connect it for Verified revenue; we read from it, we do not send it your data). For Waffo-verified revenue, Waffo sends events to us; we send nothing back.

Your choices

You can unsubscribe from email at any time, delete favorites, and ask us to delete your account and data by email. We keep payment records as long as tax law requires.

Changes

We may update this policy; the date above shows the latest version.