Privacy policy

What we hold

• Account data: your email address, a salted hash of your password (never the password itself), and whether your email is verified. If you sign in with Google, we receive your email address and the basic profile details Google provides.
• What you do while signed in: favourites, your library and installs, reviews and ratings, bookmarks and reading progress, and your creator profile and submissions if you publish.
• What you send us: newsletter sign-ups, comments, and any message you write to us.
• Server logs: request time, path, status, duration and IP address. Cookies and authorization headers are redacted, and request bodies are not logged.

Cookies and local storage

We set first-party session cookies to keep you signed in. They are not readable by scripts on the page. Your browser also stores preferences such as theme, language and dismissed notices.

We do not run analytics or advertising trackers. If you choose Google sign-in, your browser loads Google's sign-in script and Google handles that sign-in under its own policy.

Who else handles data

• An email delivery provider (Cloudflare) sends verification and password-reset messages.
• Our hosting and database providers process data on our behalf.
• Source checks for submitted listings read public information from GitHub and npm.

What is public

Reviews, creator profiles and published listings are visible to everyone. Your email address and library are not.

Your choices

Write to us to ask for access to, correction of, or deletion of your data, or to unsubscribe from the newsletter. We keep logs and account data only as long as we need them to run and secure the service.

Changes

We will update the date above when this policy changes.