Privacy policy

Last updated 16 October 2026

Short version: you can browse without an account, we don't use advertising or tracking cookies, and we don't sell or share your data.

What we collect

• Search terms, without anything that identifies you (we remove email addresses and long numbers), kept for 90 days to see what people look for that we don't list.
• Server logs (IP address, page, time, browser) are kept by our host, Vercel, for security and abuse prevention, for as long as Vercel's log retention allows. We don't copy them anywhere else.
• Visit counts, only if you accept analytics, using Plausible, which does not set cookies or build profiles. Analytics is not switched on yet.
• Your cookie choice, stored in your own browser.
• If you sign in with GitHub or Google: your provider account id, display name, profile picture link, the roles you pick, what you follow, your alert settings and when you last visited. We don't request your email address, repositories or contacts.
• Creator referral totals: a count of visits per referral code, day and page. No IP addresses or visitor identifiers.
• Weekly email list: your email address, from the moment you sign up, marked as waiting for confirmation. We email only that confirmation link until you click it, and delete the address if you haven't confirmed within 30 days. When you confirm or unsubscribe we record when; after you unsubscribe we keep the address marked as unsubscribed so we never email it again. Every email has a one-click unsubscribe.
• Alert email (signed-in creators who add one): the address and when you verified it. Remove it any time in Account settings.
• Email delivery log: what kind of email was sent and when, under a one-way hash of the address, so we don't send the same email twice.
• Sponsors: company name, the ad (logo, short description, link), booking dates, payment status and Stripe's receipt link. Card details go straight to Stripe; we never see or store them.
• Sponsor ad totals: counts of how often each ad was shown and clicked per day. No visitor identifiers.
• Contact messages: what you write, the topic, the reply email if you give one, and your account if you're signed in. Deleted a year after you send it.
• API keys: the name you give a key, its first characters, a one-way hash of the key (never the key itself), and when it was created, last used or revoked.
• API use: requests per day and endpoint, counted against your account if you use a key, so you and we can see usage against your limits.
• API rate limits without a key: requests are counted under a one-way hash of your network (your IP address with the last part removed) that changes every month. The IP address itself is never stored. Daily counts are deleted after two days and limit counters once their month has passed.

What we never collect

• Advertising identifiers or cross-site tracking data.
• Personal data about the people who build listed projects; we store contributor counts only.

Third parties

Fonts are served from our own site. We use these processors only for the purposes above:

• Vercel (hosting and server logs) and Neon (database).
• GitHub and Google (sign-in, only if you choose them).
• Resend (sending email you asked for), once email is switched on.
• Plausible (visit counts, only if you accept analytics), once analytics is switched on.
• Stripe (sponsor payments), once payments are switched on.

Links to project sites, GitHub and Hugging Face take you to their own privacy policies.

Your rights and deleting your data

• Under UK GDPR you can ask what we hold about you and ask us to delete it.
• Signed-in users can delete their account themselves from Account settings. This removes it immediately, with your sign-ins, sessions, follows, alert settings, alert email, API keys and their usage counts, and sponsor bookings. While you have an active sponsor booking (held, waiting for review, or running this month or later) you can't delete the account; cancel the booking first or wait until its month has ended.
• The weekly email list is separate from accounts: use the unsubscribe link in any email.

Contact

For a privacy question or request, use our contact form. Messages come only to us and are never published.