What this site knows about you.

If you only look at the board

One thing is counted: that a page was viewed. We use Vercel Web Analytics, the visit counting built into the platform this site already runs on. It sets no cookie, it stores no IP address, and it does not follow you to other sites. Repeat views on the same day are told apart by a hash that expires within 24 hours and cannot be traced back to a person. What we can see are totals: how many people visited, and which pages they looked at.

The visitor figures in the top bar are counted by us, the same way the rate limiter counts: a SHA-256 hash of your address combined with a secret salt, and a timestamp of your last page view. The address itself is never written down and the hash cannot be turned back into it. That is how the site can say how many people are on it right now without knowing who any of them are.

Beyond that, nothing is stored about you. There is no advertising pixel and no third-party tracker on any page. Pages are rendered by our own server.

Legal basis: legitimate interest in knowing whether anybody visits at all.

Rate limiting, on every public form

To stop one person flooding a form, we count requests per visitor. The visitor is identified by a SHA-256 hash of their IP address combined with a secret salt. The address itself is never written down, and the hash cannot be turned back into it. What is stored is the hash, a bucket name, a time window and a count.

Legal basis: legitimate interest in keeping the service usable.

If you arrive through a founder's share link

We set one cookie, ab_ref, holding only that founder's public share name. It exists so the founder who actually brought you gets the credit, even if you then vote for somebody else. It contains nothing about you, it is set once and not overwritten, and it expires after seven days.

If you vote

Voting requires signing in with GitHub or X, because one vote per person is the only thing that makes the race mean anything. We ask those services for the narrowest scope they offer and we never request your email address.

We store exactly four things about a voter, in one row, for ever:

• which service vouched for you, GitHub or X
• your stable numeric id at that service
• your public handle
• when that account was created, because an account has to be at least 6 months old to vote

No access token is kept. It is used once to read those fields and then discarded. No email, no name, no follower count, no anything else.

Two short-lived signed cookies carry a vote through sign-in: ab_vote_state also protects the one-time founder confirmation against somebody else starting it, and ab_vote_receipt lasts two minutes so the page after voting can show you what you did. Both are httpOnly and neither is used for tracking.

The vote itself is kept for as long as the site runs. The standings of a finished race have to stay checkable, and a competition whose result cannot be audited is not a competition.

If you apply to enter the race

The form at /enter collects your name or project name, your link, one line about it, the share link you want, and a contact email address.

The first four are published if your application is approved. That is the point of them. The email address is never published, never shown on any public page, never included in any public API response, and never passed to a sponsor. It is visible only on an internal page behind a shared key, so that a person can write back to you, and it is used for nothing else.

To publish automatically, you sign in once with GitHub. We read its stable account id, public handle and account creation date. The creation date is checked but not stored. We store the id, handle and confirmation time with the application so one account cannot publish multiple founders. We request no GitHub email and keep no access token.

We keep the application, including the address, while the race runs and afterwards as a record of who entered and who was turned down and why. Ask at anton.mateo.berndt98@gmail.com and we will delete it.

If you take a free spot on the wall

The wall holds 50 listings and, while any of them are open, taking one costs nothing. The form collects your link and one contact email address, and asks you to tick a box before we may use it.

The link is published. That is the point of it. The email address is never published, never shown on any public page, never included in any public API response, and never sold or passed to a sponsor.

We use it for exactly two messages, both about your own listing and nothing else: one when a paid listing pushes you off the wall, and one when you lose the top spot. At most one message a day. Every message carries a one-click unsubscribe link, and using it stops all of them for good without touching your listing or its place on the wall.

We keep the address for as long as the listing exists. Ask at anton.mateo.berndt98@gmail.com and we will delete it, or use the unsubscribe link in any message we have sent you.

If you pay for a listing

Payments are handled by Stripe. Card details never reach this site. You pay on Stripe's own page and we are told the amount, the currency and whether it succeeded. We store the amount, the time, and Stripe's reference for it, so the board can be reconciled against the money.

Stripe asks for an email address for its own receipt. That is Stripe's collection under its own notice, and it is separate from the address you may have given us when taking a free spot.

Stripe is its own controller for what it collects, and its privacy notice covers that. Paying involves a transfer to Stripe, which operates in the United States as well as Europe.

Payments are switched off at the time of writing. When they are switched on, this section stays true.

Links we fetch

When a link is submitted, our server visits it once to read the picture and description the site publishes about itself, so the listing has a card. That request comes from our server, not from your browser. The site being visited sees our server.

Who else sees any of this

Nobody buys data from us and nobody is given it. The site runs on Vercel and the database is hosted by a managed Postgres provider, both of which process data on our instructions in order to run the site. Stripe handles payments as described above. There is nobody else.

What you can ask for

Under the GDPR you can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, ask for a copy, and object to us holding it. Write to anton.mateo.berndt98@gmail.com and a person will answer. You can also complain to a supervisory authority; for Berlin that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

One honest limit: a vote that decided a finished race cannot be removed from the record of that race without making the result unverifiable. If you ask us to delete your account, we can detach your handle from it, and we will say exactly what remains.