Privacy Policy
Short version: there are no accounts, no passwords, and nothing here is sold to anyone. Below is the honest, complete list of what we do collect and why.
What you post is public
A startup's name, URL, pitch, and optional longer description are shown publicly once the listing goes live (72 hours after posting, or sooner — see the submit page), along with a vote count and a rough "posted X ago" time. That's the whole point of the site. There's no account tied to a listing — anyone with the admin password can hide a listing (e.g. spam, a broken link, a moderation issue), but nobody can edit one after posting.
Anonymous anti-abuse signals
Voting is limited to once per person per listing, and outbound-click/share counts are logged internally (not shown anywhere on the site yet). All three work the same way: your IP address is combined with a private, server-side secret and one-way hashed before it's stored. We never store your raw IP address for any of this, and the hash can't be reversed back into one — it only lets us tell "same visitor, different visitor" apart.
Checks run on submission
Before a listing goes live, its URL is checked against Google's Safe Browsing API (only the URL itself is sent, nothing about you) to catch malware/phishing links, and you'll be asked to pass a Cloudflare Turnstile challenge to prove you're not a bot — this can briefly set a Cloudflare cookie/token used only to verify that one challenge.
Your email when you post a listing
Posting a listing asks for your email address. It's private: never shown on the site, never sold or shared. Without your opt-in it's used for exactly two emails about that listing: one confirming it's in the queue, and one when it goes live. It's deleted 30 days after the listing goes live. If you tick the optional "tips and offers" box, we may also send a reminder while the listing is queued and mention paid options like featuring it, and we keep the address until you unsubscribe. Every email has a one-click unsubscribe link, which deletes the address right away. Emails are sent through Resend (EU region), which processes the address only to deliver them.
Ad slots
Buying an ad slot (see advertise here) is handled entirely by Stripe — we're redirected to Stripe's own hosted checkout page, and we never see or store your card details ourselves. What we do store: the ad content you submit (name/URL/tagline) and which 24-hour window it ran in. Same anti-scam checks as a regular listing apply before payment is even accepted.
Featured listings
Paying $2.99 to feature a listing (see the terms) also goes through Stripe's own hosted checkout. We never see or store your card details. What we store is which listing was featured, the Stripe checkout reference, the amount, and the 7-day window. Stripe handles your payment details under its own privacy policy.
Analytics
Page-view stats are collected with a self-hosted GoatCounter instance — no cookies, no cross-site tracking, no individual visitor profiles. We only ever see aggregate numbers like "how many people visited today."
Infrastructure
Like almost every website, this one runs behind a CDN/security layer (Cloudflare), which processes standard connection data (such as your IP address) to keep the site up and block abusive traffic. A small number of countries are blocked outright as an anti-abuse measure — that check happens automatically at the network edge and nothing about it is stored.
Cookies & local storage
The site itself sets no cookies, and a plain page load sets none at all. Two exceptions, both from third parties we use rather than something we configure ourselves:
- Turnstile (submit page only) can set a short-lived cookie/token while it verifies you're not a bot — cleared once the check is done.
- Cloudflare, which sits in front of the whole site for security, may set its own cookie if you're ever shown one of its own challenge/block pages (e.g. the country restriction above) — that's Cloudflare protecting the site, not tracking tied to a listing or a submission.
Separately, your browser's own local storage (not a cookie — never transmitted anywhere) remembers which listings you've already upvoted. It never leaves your browser and we never read it.
GoatCounter, mentioned above, is cookie-free by design.
What we don't do
No accounts or passwords to leak. No ad networks, no third-party trackers, no selling or sharing data — including email addresses — with anyone.
Questions or a removal request?
Email info@celikovic.xyz.