1. What we collect
- Account data. Your email address, an optional display name, and your password stored as a salted hash. We never store your password in a readable form and cannot recover it — that is why password resets exist.
- Product usage. Your favourites, comparison-basket usage, and the recent activity entries needed to show you features such as new-tool lists and to enforce usage limits.
- Content you send us. Messages you submit through the contact form.
- Technical data. Your IP address, the time of the request, and the page requested — used for rate limiting and abuse prevention, plus the records needed to keep you signed in. We also keep standard first-party server access logs so we can tell whether the Service is actually being used and where requests come from. For that we derive an approximate country and city from your IP address using a copy of a geo database that runs on our own server — your IP is never sent to a third-party geo service. Aggregate visit statistics (kept up to 180 days) are used to understand which tools and pages people find useful. There is no third-party analytics, no cross-site tracking and no advertising identifier.
- Payment records. If you subscribe, PayPal tells us that a payment succeeded and gives us an order identifier. We do not receive or store your card or bank details.
2. Cookies and local storage
We set a single first-party session cookie to keep you signed in. It is HttpOnly (not readable by scripts), SameSite=Lax, and expires after 60 days of inactivity; each visit renews it. Signing out deletes the session on the server, not just in your browser. A few interface preferences (such as your comparison basket) are kept in your browser’s local storage. We do not use advertising cookies, cross-site trackers, or third-party analytics services.
3. Why we use it
- to create your account, sign you in, and let you reset your password;
- to run the features you ask for (favourites, comparisons, member reports);
- to send transactional email, such as a password reset link or the weekly digest you asked for;
- to keep the Service available and prevent abuse, including rate limiting and blocking automated bulk access;
- to understand which parts of the directory are useful, in aggregate, so we can improve them.
4. Who processes data for us
We use a small number of service providers. They process data on our instructions:
- PayPal — payment processing for paid plans.
- Resend — delivery of transactional email (password resets, digests).
- DeepSeek — the language model that generates tool descriptions, translations and comparisons. Text submitted for those features is sent to the model provider for processing.
- Vultr — hosting; the Service runs on servers located in the United States.
We do not sell or rent personal data, and we do not share it for advertising. We may disclose data if we are legally required to, or to protect the Service and its users from abuse.
5. How long we keep it
- Account data: until you delete your account.
- Sign-in sessions: up to 60 days after your last visit, then deleted automatically.
- Password reset links: single use, and they expire after 30 minutes.
- Usage events: purged after 90 days.
- Server access logs rotate out after 30 days; aggregated visit records (IP, page, approximate country/city) are deleted after 180 days.
- Payment records: kept as long as required for accounting and tax purposes.
6. Security
Passwords are hashed with a per-user salt, sessions are stored server-side and can be revoked instantly, and sensitive endpoints are rate limited. No online service can promise perfect security, but we aim to keep the attack surface small — for example, the directory data is served from the server rather than shipped wholesale to the browser.
7. Your rights
You can ask us for a copy of your personal data, ask us to correct it, ask us to delete your account and the data attached to it, or object to a particular use. Use the contact form from your account address and we will act on it. If you are in the EEA, the UK, or another region with data protection law, you also have the right to complain to your local supervisory authority.
8. Children
The Service is not directed at children under 16, and we do not knowingly collect their data.
9. International transfers
Our servers are in the United States, so data may be processed outside your country. Where required, we rely on our providers’ contractual safeguards for such transfers.
10. Changes to this policy
If we change how we handle personal data, we will update this page and, for material changes, notify registered users.
11. Contact
contact form — or see our contact page.