Short, because there is little to say. We do not use cookies, we do not run advertising trackers, and we do not store your IP address. Everything below is what the code actually does.
Last updated 24 August 2026
The controller for this site is Agata Raap, Oststeinbeker Weg 1G, 22117 Hamburg, Germany. Contact: instantdofollow@bugsntea.dev. Full provider details are on the Impressum.
Page analytics are handled by Umami, which we host ourselves. It sets no cookies, stores no personal data, and does not follow you across sites. It records aggregate figures — page, referrer, country, browser and device type — and nothing that identifies you. The data stays on our own server and is never sold or shared.
Our hosting layer writes ordinary server logs, which include IP addresses, for security and debugging. These are short-lived operational logs, not analytics, and are not joined to anything else.
When you click through to a listed site we count the click. We do this without a cookie and without keeping your IP address.
What we store is a one-way hash. Your IP address and browser user-agent are combined with a secret salt that is derived fresh for the current UTC date, hashed with SHA-256, and only the resulting value is written — alongside the listing and the date. The salt is never stored, and it changes at midnight UTC, so yesterday's hash cannot be matched to today's. The hash cannot be reversed to an IP address, and it cannot be used to follow you from one day to the next.
Its only purpose is to count each visitor once per listing per day, so the click figures on the board are honest. If you browse with JavaScript disabled, no click is recorded at all and the site works exactly the same.
We store what you send us: the URL, the site name, a description, a category, and the image the site declares as its og:image. All of it is published on the board — that is the point of submitting.
You get a private edit link. We never store that link: we keep only a SHA-256 hash of it, so we can recognise it when you return but cannot reconstruct it. There are no accounts and no passwords, and we do not ask for your name or email to list a site.
To stop abuse we hold submission counts per IP address and per domain in memory for a few hours. They are never written to the database and are lost on restart.
Once a listing is live we fetch its public pages roughly once an hour to check the site is still up, that the URL has not changed, and — if you chose the badge — that the badge is still there. We identify ourselves in the user-agent, we do not execute JavaScript, and we only read pages that are already public.
Payments are processed by Dodo Payments, which acts as merchant of record. They collect and process the billing details, and their privacy policy governs that data. We never see or store your card details. All we keep is a payment reference and the date, so we can match a payment to a listing and issue a refund when one is due.
Listings stay until you delete them or they are removed under the rules. Click hashes are kept as daily aggregates. Payment references are kept as long as tax and accounting law requires. Crawl records are operational and pruned as they age.
If the GDPR applies to you, you have the right to access, correct, delete, restrict and port your data, and to object to processing. In practice: your listing is yours, and your edit link deletes it outright.
Our legal basis is legitimate interest for running and protecting the board, and performance of a contract for anything you have paid for. Write to instantdofollow@bugsntea.dev and we will answer within three business days. You may also complain to a data protection authority; ours is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.