Privacy

OPERATOR NOT CONFIGUREDSet OPERATOR_LEGAL_NAME and CONTACT_EMAIL before taking payments. These pages are a starting point and require legal review for the jurisdictions you sell into.

Browsing without an account

You can browse every market page, vote, click through to a website and share a listing without creating an account.

The anonymous browser identifier

On your first visit we set one first-party cookie containing a random identifier, signed so it cannot be forged or replaced with an arbitrary value. It exists to enforce "one vote per listing per 24 hours" and to rate limit abuse.

The identifier is never stored alongside your activity. What is stored is a salted, non-reversible hash of it, so the events table cannot be used to reconstruct one person's browsing. The cookie is not shared with third parties and is not used for advertising or cross-site tracking.

What we record

Attention events: qualified page views, sentiment votes, outbound website clicks, shares and link copies, each stored against the hashed identifier, a timestamp and the listing.
Rate limiting: short-lived counters keyed by the hashed identifier, or by a hash of your IP address when no cookie is present. IP addresses are not stored in readable form.
Payments: the order, its amount, its Stripe references, and an email address if you provide one. Card details never reach our servers.
Claims: the email address you use for ownership verification, and the method used.

What we do not do

No advertising or third-party tracking pixels.
No selling or renting of personal data.
No publication of individual activity. Presence and attention are only ever shown as aggregate counts, and only above a display threshold.

Processors

Stripe processes payments and receives what it needs to do so, including your card details, which we never see.
Supabase hosts the database that stores the records above.
Vercel serves the application and processes request logs.

Retention

Attention events are kept to compute rolling windows and heat. Payment and claim records are kept as long as required for accounting and dispute handling. Rate limit counters are short-lived and pruned automatically.

Your requests

Because visitor activity is stored against a salted hash we cannot connect it back to you from a name or an email address. For payment and claim records, which are identifiable, contact roberto.sannazzaro@att.eu to request access or deletion. Clearing cookies for this site discards the anonymous identifier; a new one is issued on your next visit.