Privacy Policy

What we collect

• Essential cookies — a cookie-consent flag stored in localStorage and as a first-party cookie. It records your Accept/Decline choice. No personal data.
• Analytics, only if you Accept — Google Tag Manager and Google Analytics 4 then receive page views and technical data, including your IP address, and set the analytics cookies described in the cookie policy. Decline does not load them.
• Fonts — the site loads Inter and JetBrains Mono from Google Fonts. Your browser sends your IP address to Google to fetch the files, whether or not you accept analytics cookies.
• Payments — if you start a paid plan, Stripe collects the payment details. We store the plan and the Stripe customer id. We do not store your card number.
• Server logs — IP address, user agent, request path, response code, and timing. Used for security, abuse detection, and aggregate performance analysis. Retained for 30 days.
• API requests — your IP, the endpoint hit, and response code. Used for rate limiting and abuse detection. Not linked to your identity unless you sign in.

What we do not collect

• No advertising trackers. Google Analytics and Google Tag Manager load only after you click Accept.
• No browsing history sold by us, and no fingerprinting. Page views go to Google Analytics only after you click Accept.
• No account unless you sign in. If you subscribe, Stripe collects the payment details described above.

Your rights (GDPR / CCPA)

You have the right to access, correct, delete, or export any personal data we hold about you. To exercise any of these rights, email [email protected]. We respond within 30 days.

Data retention

• Server logs: 30 days.
• API rate-limit counters: 15 minutes sliding window.
• Account data (if you sign in): until you delete your account.

Third parties

We use the following processors to operate the Service. Each is bound by a data processing agreement:

• Railway — application hosting (Frankfurt region).
• Neon — managed PostgreSQL (US-east).
• Upstash — managed Redis (US-east).
• InsForge — authentication, only invoked if you sign in.
• Cloudflare — DNS, edge cache, and DDoS protection.

These services also process data when you use the site:

• Google — Google Fonts when the page loads Inter and JetBrains Mono. Google Tag Manager and Google Analytics 4 only after you accept cookies.
• Stripe — payment processing when you subscribe to a paid plan.

Changes to this policy

We may update this policy. The "Last updated" date at the top will reflect the change. Material changes will be announced via the site banner.

Contact

For any privacy-related question: [email protected].