Privacy and account data

We store your email, display name, password hash, access permissions and login sessions on the server. Display names are shown beside public reviews and are not verified identities.

The login cookie identifies your session. The CSRF cookie protects forms. We do not use an analytics cookie.

You can change your display name and password or revoke other login sessions from My account. Logout revokes the current session. Password changes revoke existing sessions and create a replacement for the current browser.

My account also provides a JSON export of your own data. Closing your account anonymizes your email and display name, signs out every session, makes your listings unclaimed, withdraws your public reviews, releases authored pages from the account and removes bookmarks, votes and queued email. Submissions, claims, reports and audit history remain for moderation under the closed account, and the account cannot sign in again. Review withdrawal alone is not account closure.

Verification and password reset emails are sent through our email provider. Delivery is not guaranteed. The provider receives the recipient address and message, including the private link, and has its own data handling.

We store only hashes of verification and reset tokens, not the raw links. Tokens expire and can be used once. Queue records contain delivery status and timing, not message bodies or credentials.

Sent or failed email jobs are removed after 30 days. Pending and running jobs are kept. This does not delete account, review, report or audit records.

Use password recovery if you cannot sign in. A completed password reset revokes existing login sessions and requires a new login. My account shows email verification status and lets unverified accounts request another verification email.

Verifying your email confirms you can access that mailbox. It does not prove identity or repository ownership.

The database stores bookmarks, votes, reviews, submissions, ownership challenges and proof URLs. Visible, non-withdrawn reviews and approved listing metadata are public. Hidden reviews do not contribute to public ratings; the author can still see their hidden review while its listing is active unless they withdraw it.

Withdrawing a review removes it from public view and clears its title and text. Its stored rating, review identity, account and listing links, moderation status, timestamps and linked report records remain. Withdrawn reviews do not contribute to public ratings. A later repost reuses the review record and retains moderation status: a hidden review stays hidden.

Reports include your account association and reason. Authorized moderators inspect reports and may resolve or dismiss them. Reporting does not automatically remove a listing or hide a review. Moderation decisions and account actions can appear in the audit log, which can associate actions with an account.

Claim evidence must be public for reviewers to inspect. Do not put passwords, private tokens or other secrets in descriptions, proof notes, reviews or reports. The ownership challenge is intended to be public.

Collection is disabled by default. When an administrator enables it, the application records event names, fixed application paths, timestamps and, where relevant, listing IDs. Events include page and listing views, source visits, searches, bookmarks, review saves and votes.

Analytics records contain no search queries, query strings, IP addresses, account identity, referrers or visitor fingerprints. They do not measure unique visitors, browsing sessions, downloads, installations or revenue. Counts cover retained recorded events only.

To opt out when collection is enabled, use a browser that sends Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1). The application skips analytics events for either signal. There is no separate site opt-out cookie or toggle.

Analytics retention is 7 to 365 days, with a default of 30. Turning collection off stops new events but does not erase old ones. Account, moderation and audit records are separate.

Rate limiting uses keyed hashes derived from the connected peer and, where applicable, an account or email value. These are security records, separate from analytics; the limiter does not store the raw IP or email in those records.

The application does not populate raw IP fields in login sessions or audit entries through its current web routes. Hosting or proxy logs may follow a separate policy; this application does not control them.

Source links leave this marketplace. If analytics is enabled and no opt-out signal is sent, the source redirect records a source-visit event before opening the external URL. Source websites can log requests according to their own policies.