Privacy

What we collect

• If you submit a project: your name, email, and the project metadata you fill in. The email is used to verify you, to send approval/rejection notices, and never displayed publicly.
• If you comment: your name and email. Same email handling as submissions; only your name is shown publicly with the comment.
• If you click anything: we record the click count. We do not store IPs, cookies, fingerprints, or session identifiers; instead we keep a 24-hextruncated daily-rotated SHA-256 hash of your IP, used only for rate-limit detection, and rotated out every UTC day. You cannot be identified from it. We also derive a coarse country code (e.g. “DE”) from your IP at that moment via a local offline lookup — country granularity only, no city or coordinates — and keep just that code for aggregate traffic stats. The IP itself is never stored.
• If you submit a project: alongside the listing data, we record the raw IP and user-agent of the submitting request. This is moderation-only — used to spot spam patterns and verify suspicious submissions, never displayed publicly, and only visible to admins on the pending queue. Project clicks (above) remain anonymized via the rotating hash; the submission-time fingerprint is the exception.
• If you send us email: the message lands in our admin mailbox. We keep it as long as it's relevant to the conversation.

What we don't collect

• No analytics scripts (no Google Analytics, no Plausible, no Fathom, no third-party pixels).
• No cookies for tracking. The only cookie is the admin session cookie when an admin is signed in.
• No fingerprinting. No precise location — only the coarse, country-level code described above. No browsing history outside our own pages.

Who we share it with

Nobody. Your email never leaves the database except as a verification message sent to you, or a moderation/reply email from us. We don't sell, trade, or hand it to advertisers.

Subprocessors that touch your data, transparently:

• Hetzner (Germany) — hosting and outbound mail relay.
• picsum.photos — placeholder thumbnails for seed entries (not used for real submissions).
• GitHub — read-only public repo metadata when you provide a repo URL.

How long we keep it

• Approved projects: as long as the project lives on the site.
• Rejected submissions: 90 days, then purged.
• Comments: as long as the project lives.
• Click events: indefinitely (they have no PII).
• Admin mailbox: as long as the conversation is relevant.
• Email-verification tokens: 24 hours, then expired.

How to remove your data

Email admin@vibcod.dev from the address you used to submit. We'll remove your project, your comments, and your email from our database within 7 days, and confirm by reply.

Cookies

None for visitors. Admins signing in get a session cookie issued by NextAuth — that's it.

Where we are

The operator is based in Slovenia (EU); the server is in Germany (EU). GDPR applies. Your rights under GDPR — access, correction, erasure, portability — are real here. Email us to exercise them.