What we keep, and what we don’t.

What is public

Your profile is the product: username, display name, bio, avatar, city and country, your links, projects, tools, technologies, gear and setup photos, your follower and following lists, your project updates and upvotes, and a verified X handle if you connect one. Anyone can read these, signed in or not, and search engines index them.

Location is city-level only. We store the coordinates of the city you pick, never your own. Two founders in the same city share one pin.

What is not public

• — Your email address. It is never shown on your profile or in the API.
• — Your password. It is hashed by Supabase Auth; nobody here can read it.
• — Direct messages, readable only by the two people in the conversation.
• — Who you blocked, and who reported whom.
• — Payment records: what you paid, when, and for which plan or spotlight.
• — Abuse-limit records: a timestamp and your account id, so limits cannot be reset by deleting things.

These rules are enforced by the database itself, not by the interface, so they hold even for a request that skips the site entirely.

Tracking

There is none. No analytics, no tracking pixels, no advertising networks, no third-party cookies, no session recording. We do not build a profile of what you read.

The only cookies are the ones that keep you signed in. Your light or dark preference is kept in your browser’s local storage and never sent to us.

Who else sees something

• — Cloudflare sits in front of the site and terminates the connection, so it sees your IP address and the pages you request.
• — Stripe handles payments. Card details go straight to Stripe and never reach our server; we keep the charge record, not the card.
• — OpenStreetMap answers the city search box. What you type there, and our server’s address, reach their service — not your address.
• — X is contacted by our server when you pin a post, to fetch that post’s public content.
• — Gravatar is contacted by your browser only if you choose the Gravatar avatar suggestion, using a hash of your email address.

We do not sell anything to anyone, and we do not share your data for advertising.

Where it lives, and for how long

Everything runs on a single server in the European Union, with encrypted backups in Cloudflare R2. Backups are encrypted before they leave the server and are rotated, so a deleted account disappears from them as they age out — it is not instant.

When you delete your account, your profile, links, projects, updates, messages, uploads and follows go with it, and any active subscription is cancelled first. Your username is held for 90 days so that nobody can immediately take it and inherit your inbound links. Payment records are kept as long as tax and accounting rules require. Reports about content are kept so that repeat problems stay visible to moderators.

Your side of it

• — See and correct everything about you in your settings.
• — Take it with you: request a copy of your data from your account page.
• — Delete it, from the same page. Deletion is immediate and cannot be undone.
• — Object or complain: write to [email protected], or to your local data protection authority.

Changes

If this page changes in a way that matters, the date at the top changes with it and we will say so on the site rather than quietly editing the text.

Questions: [email protected] · Terms of use