Privacy
What we keep.
This is a plain description of the data this version stores. It is not a lawyer's privacy policy.
Public sources
Repository names, star counts, descriptions, and README excerpts come from the public GitHub API. Mentions come from public Hacker News posts and from files an operator chooses to ingest. We show the post URL and the handle that was already public on that post.
Addresses you give us
The newsletter form stores the email address in our database and nothing else about you. We do not send mail yet. When a sender is connected, the address can be copied there. Unsubscribe then means deleting the row, or the sender’s own unsubscribe link.
Submissions and removal requests store the fields on the form: a repo URL, a post URL, handles, a note, and for removals an email. Those sit in a review queue.
Rate limits
Submit and signup requests store a SHA-256 hash of the IP address plus a server-side salt, so we can cap 3 submissions and 5 signups per address per day. We do not store the raw IP. The honeypot field is discarded.
Analytics and cookies
If NEXT_PUBLIC_CF_BEACON_TOKEN is set, the page loads Cloudflare Web Analytics. That beacon is the only analytics script. There is no ad network. Turnstile, if both keys are set, is Cloudflare’s captcha on the submit form.
Where it lives
The production database is Cloudflare D1. Pages are static files on Cloudflare. The pipeline runs on GitHub Actions and commits a public catalog. Admin access uses a bearer token that is not written to the page.