What is stored

What is public

A listing shows a domain, a name, a tagline, an optional X handle and what it paid. All of it is the product: it appears on the board, on the listing page, in share cards, in the RSS feed, on the badge image, and in posts from the site account when there is one.

Nothing else about the person who paid is published. The email address behind a listing is never shown on the site.

The email address

The payment provider refuses a cross-border payment without one, and it refuses it when the payment page is created rather than when it is paid, so the checkout form has to ask. What you type there is passed to the provider to build the payment page. The address stored against a listing is the one the provider reports back with the payment itself.

It is used for two messages: the receipt for what you paid, and, when a rank near the top of the board changes hands, the notice that somebody has taken it from you, with the price of taking it back. There is no newsletter, no marketing list and nothing to unsubscribe from. Ask and the address is cleared, which stops both messages; a person does that by hand, because there is no screen for it.

The phone number

Required by the payment provider for the same reason and at the same moment. It is handed to the provider and there is no column for it anywhere in this database. It reappears here only if the provider echoes it back inside the notification of a payment, which is stored as it arrived.

IP addresses are not stored

Never the address itself. What is written down is a truncated SHA-256 of it, taken with a secret salt held on the server and the current calendar month mixed in. That is not reversible, not comparable with anything outside this server, and not stable over time: when the month turns, hashes taken before it stop matching hashes taken after it, on purpose.

The hash exists to answer one question — has this person already been counted — in three places. A click on a listing counts once per listing in any twenty-four hours, with a hash of the user agent stored beside it the same way. Looking up what a rank costs counts once per listing in any twenty-four hours, and that is what the interest signal on a listing page is made of. A visit counts once a day, and the table that answers it holds a date and a hash and nothing else: no address, no timestamp, no listing, nothing to join a person against.

The count of people on the site right now never reaches the database at all. It uses a different hash, with no month in it, kept in memory for five minutes and then forgotten, and deliberately not comparable with anything that was stored.

Obvious bots are identified by user agent and dropped before any of this, because a number printed next to a price should be people.

What a payment leaves behind

A row recording which listing was paid for, how much, when, which provider handled it and the payment id it gave, plus where the visit came from. The provider notification is kept exactly as it arrived, because a payment that cannot be reconciled later is a payment nobody can answer a question about.

The card is entered on the page the payment provider hosts. Card details never reach this server.

Where you came from

One first-party cookie, smr_src. It is set on the first page you land on and only when that landing carries a ref tag, UTM parameters or a referrer from another site. It is never overwritten, it expires after thirty days, it is marked httpOnly so no script can read it, and it is never sent anywhere but this domain.

It holds a referrer, the UTM values and the ref tag. If you pay, that snapshot is copied onto the payment row, which is how a link can be told apart from a search result in the revenue figures. It does not follow you anywhere else and it identifies nobody.

Your light or dark preference is kept in the browser under smr-theme and is never sent to the server.

Analytics

No pageview analytics runs on this site. There is no script tag on any page here for one, and nothing counts your reading beyond the visit and click records described above, which are first-party and hashed. If that changes it will be Umami, self-hosted on this machine and cookieless, and this paragraph will say so.

There is no Google Analytics, no advertising pixel, no ad network, no session recording, no heatmap, no fingerprinting and no cross-site tracking. Nothing collected here is sold, and there is nobody to sell it to.

Who else sees anything

The payment provider, which runs the page your card is entered on and holds its own record of the payment under its own privacy policy. The email provider that delivers the receipt and the notice that a rank changed hands, which necessarily handles the address they are sent to.

How long any of it is kept

Listings, takeover records and payments are kept indefinitely. The board is a record of who paid what and when, and a leaderboard that forgets is not one.

Click and price-check rows keep their month-scoped hash and their timestamp. They are not swept, because after the month turns they cannot be matched against any hash taken since.

The visit table holds today and yesterday, and is swept beyond that. Yesterday is kept only so a visit arriving as the date rolls over is not counted twice. The lifetime visitor figure is a daily count with no hashes in it.

The attribution cookie lasts thirty days in your browser. If it was copied onto a payment, that copy stays with the payment. The presence hash lasts five minutes and is never written down.

Removing a listing

Write from the address the listing was bought with, or from an address at the domain, and say which listing. It is hidden from the board, the listing page, the feed, the badge and every other read path.

The payment behind it stays, because it is a financial record and removing it would falsify the board history. Removal is not a refund.