Privacy

website.show is operated by a private individual resident in Argentina, who is responsible for your personal data (the “controller”). Contact: hello@website.show.

This policy explains what we collect, why, who helps us process it, and how to have it deleted. The Terms cover everything else.

• Account. Your email address, name and profile picture from the Google account you sign in with. To sign you in and show you your listings.
• Listings. What you submit: the product name, tagline, description, category, tags, site address, icon, optional screenshot, optional X handle and optional questions and answers, all of which are published; and the email address for notifications, which is not. To publish the listing and tell you about it.
• Moderation records. Results of the automatic checks, badge checks and link checks, moderators’ notes, the history of edits to your listing: what changed, when, and by whom, and a dated log of what happened to it: submitted, approved, paid, its link turned on or off. To run the directory, explain its decisions and see how it is doing.
• Payments. If you pay, we receive the amount, the payment status and reference, and your email address. Dodo Payments collects your card and billing details as the merchant of record, under its own privacy policy. We never see your card details.
• Email. Messages about your listings: in the queue, approved, not listed, payment received, link paused, archived. These are part of the service and are not marketing.
• Newsletter. Only if you tick the box: your email address and where you signed up. You can unsubscribe from any issue.
• Security. Your IP address, to limit how often forms can be used and stop abuse. We store only a one-way hash of it, made with a secret key, in short-lived counters. Our host also keeps request logs, which include IP addresses, for a short time.
• Error records. When something fails on our side, a technical record of what failed, where and when, so we can fix it. Email addresses and anything resembling a password or key are removed before it is stored.
• Clicks to listed sites. When you follow a link from a listing page to the site it lists, we record which listing and when, to show its maker how many visitors we sent and to list the week’s most visited products on our home page, as totals per product. No cookie is involved, and your IP address is not stored with the record: a one-way hash of it is kept in a short-lived counter, only so that repeated clicks count once. The link itself carries utm_source=website.show, so the listed site’s own analytics can tell the visit came from us; the tag names us, not you.
• Where visitors arrive from. On the first page you open here, your browser reports where you came from: the tags in the link you followed (such as utm_source=youtube), or otherwise the site that sent you (its name only, such as google or youtube, never the page address), and the page you landed on. We count these to see which places send visitors. If you then submit a listing in the same visit, its record notes that source too, so we know which places bring makers. Nothing is stored in your browser, no cookie is involved, and your IP address is not stored with the record: a one-way hash of it is kept in a short-lived counter, only to stop abuse.
• Pages you view. Each page you open here sends us its path, the width of your browser window and, for the first page, where you came from. From the request we take your country (two letters, from our hosting’s lookup of your IP address) and the family of your browser and operating system (such as “Chrome on Android”). To count unique visitors without a cookie, we combine your IP address and browser details with a random value that changes every day and one-way hash them; only that hash is stored, the day’s random value is deleted the next day, and your IP address is not stored. So we can tell how many people visited on a day, but not who you are, and not whether you came back on another day. Nothing is stored in your browser.
• Links from our blog. A link from one of our blog posts to the submit form names the post in its address. When you open the form that way, we record which post and when, and if you then submit a listing, its record notes the post too. That tells us which posts are useful to makers. No cookie is involved.
• Bot check. On the submit form, on /score and on the free tools that read a site, Cloudflare Turnstile checks that a person is using the page. Cloudflare receives your IP address and signals from your browser to tell; we receive only whether the check passed. To keep scripts from abusing the form and the tools.
• Analytics. Pages you visit, the site that sent you, your device and browser, and your approximate location, collected by Google Analytics with cookies. To see which pages are useful and where visitors come from. In the EEA, the UK and Switzerland, only if you accept; elsewhere, until you turn it off (see Cookies).

The legal bases, where the law asks for one: performing our contract with you (account, listings, payments, service emails); your consent (newsletter, and analytics in the EEA, the UK and Switzerland); our legal obligations (payment records); and our legitimate interests in keeping the service secure, free of abuse and working, and in understanding how it is used (security, moderation records, link checks, click counts, where visitors arrive from, which blog posts lead to the submit form, and analytics elsewhere).

When you submit a listing, or ask for a draft, we send the listing text and a limited snapshot of your site’s public homepage (its title, description, headings, a text excerpt and button labels) to Anthropic, whose AI model checks the listing against the submission rules or drafts the text. Under Anthropic’s commercial terms, this data is not used to train its models. We also send your site address to Google (Safe Browsing or Web Risk) to check it is not listed for malware or phishing, and its domain name to the public RDAP registry service (through rdap.org) to read the date the domain was registered.

If you verify that you run a listed site, we read its homepage for our verification tag, or send a six-digit code to the address on its domain that you type. We keep that address with the listing as the record of the verification and never show it.

For a published listing, we read the site’s public homepage, robots.txt, llms.txt and sitemap each week and show what we find as a site check on the listing page. No model is involved in it. The site’s owner can hide it.

When you enter a site at /score or in one of our free tools that read a site, we fetch the files that tool names and show you the result. We do not store the address you entered or who asked, apart from the hashed counters that limit how often any one site is checked. A /score result for a site is kept in our server cache for up to 24 hours, so a repeat check of the same site is answered without fetching it again; it holds the site’s address and its findings, nothing about you, and it is never published. If you choose to share a /score result, the site’s address, its scores and the date are written into the share link itself, signed so they cannot be changed; anyone with the link can see them. We still store nothing, and the page behind the link is kept out of search engines.

These checks can refuse a submission automatically, and the reason is shown to you. If you think a refusal is wrong, email us and a person will review it. Nothing is published without a person approving it. Before approving, that person may look at public sources, such as company registers and the profiles your site links to, to confirm who is behind it.

We use these providers, each only for its part of the service:

• Supabase: database, sign-in and file storage
• Vercel: hosting
• Resend: service emails
• Dodo Payments: payments, as merchant of record
• beehiiv: the newsletter, only if you subscribe
• Google: Analytics, and Safe Browsing or Web Risk checks for malware and phishing
• RDAP registries (through rdap.org): the registration date of a listed site’s domain, for which we send the domain only
• Anthropic: automatic review and drafts
• Ahrefs: the Domain Rating of listed sites, for which we send the site’s domain only
• Cloudflare: Turnstile, the bot check on the submit form and the site tools

We do not sell personal data or share it with advertisers. We disclose it to others only when the law requires it, to protect our rights or anyone’s safety, or to someone who takes over website.show, who would then be bound by this policy.

These providers are based in the United States and other countries, so your data may be processed outside the country you live in. We rely on the safeguards they offer for international transfers, such as standard contractual clauses.

The homepage shows badges of other directories that list website.show. Your browser loads them from those directories’ own servers, which receive your IP address and browser details, as any server does, and handle them under their own privacy policies.

Published listings are public by design, and we allow search engines and AI crawlers to read public pages. Once a listing is removed, we delete our copy, but we cannot recall copies that search engines, archives or AI systems have already made.

A maker page shows the name you choose, the few lines you write about yourself, the X account you add, and the listings whose site you verified. It appears only once you have verified products, under an address made from your name that you can change; it never shows your email address. Its picture is drawn from your account unless you choose to show your Google photo, which we then copy to our storage. You can hide the page at any time from your dashboard.

• Sign-in cookies, set when you sign in, keep you signed in. The service cannot work without them.
• Your cookie choice (ws_consent) remembers whether you accepted or declined analytics, for six months.
• Whether we need to ask (ws_consent_region, in your browser’s local storage, not a cookie) remembers for a month whether your region requires us to ask before analytics loads. We work it out once from the country your IP address points to; the country itself is not stored, only yes or no.
• Google Analytics cookies (_ga, _ga_*) tell visits apart. They last up to two years.

If you are in the EEA, the UK or Switzerland, Google Analytics does not load at all until you accept it. Elsewhere, it loads by default. Wherever you are, “Cookie settings” at the bottom of every page lets you change your choice; declining removes the analytics cookies already set.

We use no advertising cookies. You can also block or delete cookies in your browser, or opt out of Google Analytics on every site with Google’s opt-out add-on.

• Account and listings: until you ask us to delete them, apart from the records below.
• Payment records: as long as tax and accounting law requires.
• Rate-limit counters, which hold a one-way hash of your IP address and never the address itself: about two hours after your last request, and 26 hours at most when the site is quiet.
• Host request logs: a short period set by the host.
• Error records: 90 days after the error last happened.
• The listing activity log, click records and arrival records: 12 months. Page view records: about 13 months.
• Analytics data: at most 14 months.
• Your cookie choice: six months, then we ask again.
• Newsletter: until you unsubscribe.
• Verification codes: we keep only a one-way hash, which expires after 30 minutes.
• Backups: overwritten on a rolling basis within a limited period.

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, and withdraw consent you gave, such as for the newsletter. Email hello@website.show from the address you use with us. We reply within 30 days. We may need to keep some data, such as payment records, where the law requires it.

If you are unhappy with how we handle your data, you can complain to the data protection authority where you live. In Argentina, that is the Agencia de Acceso a la Información Pública (AAIP).

El titular de los datos personales tiene la facultad de ejercer el derecho de acceso a los mismos en forma gratuita a intervalos no inferiores a seis meses, salvo que se acredite un interés legítimo al efecto conforme lo establecido en el artículo 14, inciso 3 de la Ley Nº 25.326. La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley Nº 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.

Data travels over encrypted connections, access to it is limited to what running the service needs, and our providers maintain their own security programmes. No system is completely secure, so we cannot guarantee absolute security.

The service is not meant for anyone under 18, and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.

We will post any change here and update the date above. If a change materially affects how we use data we already hold, we will also email account holders before it takes effect.

hello@website.show