We know almost nothing about you.

01 The one tracker: Google Analytics

Every page loads Google Analytics 4. It sets a cookie (_ga) to tell one visitor from another, and tells Google which pages you opened, where you came from, your browser and device, and roughly where you are: country and city, worked out from your IP address, which Google Analytics 4 does not store. No names, no emails, no advertising features, and we never try to work out who anybody is.

What we do with it is count. The totals are public, on the same page we read them from. Google handles the data under its own privacy policy.

To stay out of the count, block it: any content blocker works, and so does Google's opt-out add-on. The site works exactly the same without it.

02 What stays in your browser

The visitor counter in the footer is real: the number of visits Google Analytics has counted since launch, fetched from the same Cloudflare Worker as the analytics page and kept in your browser's local storage (sw_total) for an hour so it isn't fetched again on every page. The analytics page remembers the date range you picked the same way, and keeps the numbers it last fetched for three hours so it doesn't ask again on every visit. Neither is ever sent anywhere. Clearing your site data clears both.

03 Who serves the pages

The site is static files on GitHub Pages, and the numbers on the analytics page come through a Cloudflare Worker. Like any web host, both see your IP address when your browser asks for a page, and keep their own logs under their own policies (GitHub's, Cloudflare's). We have no access to those logs.

04 If you submit or contact us

There are two forms. The submit form takes a link, the contact form takes your email address, a subject and a message. Each turns what you typed into one email to one inbox. It gets there through a Cloudflare Worker, which stores nothing, and Resend, which delivers it and keeps a delivery log under its own policy. Your IP address is used to stop one sender flooding the forms, and is not put in the email.

Those two pages, and only those, load Cloudflare Turnstile, the check that you're not a bot. It looks at your browser and IP address to decide, isn't used for advertising, and runs under Cloudflare's Turnstile policy.

Either way we then have what you sent, because you sent it. It is used to answer you and, if you submitted an app, to list it. It is not added to anything, shared or sold. Want it deleted? Ask through the same form, and it is.

05 If your app is listed

Cards quote what builders said in public, word for word, with a link to where they said it, next to a public name or handle. Nothing on a card comes from anywhere private. Misquoted, wrong price, or something about your card you want changed? Say so, and it gets fixed.

06 The spiteware uploader

The videos on our YouTube channel are put there by a small script, registered with Google as spiteware uploader. It uses YouTube API Services, so the YouTube Terms of Service and the Google Privacy Policy apply to it.

It is not a public app. The only account that ever signs in to it is the site's own, and the only permission it asks for is to upload videos to that channel. It reads no YouTube data, collects nothing about viewers or anybody else, and shares nothing. Its sign-in token is kept on the one computer that runs it, and can be revoked at any time from Google's security settings.

07 Changes and questions

If this page changes, the date at the top changes with it, and the full history is public. Questions, or something you sent us that you want deleted: the contact form.