Privacy Policy

Who is responsible

The person responsible for your personal data is Fouad Elbouiadi, Calle Illescas 28, 45222 Borox (Toledo), Spain, who operates Stackboo. Write to contact@stackboo.com for anything about your data.

What we collect

• Account data. Your email address and name, and either a password (stored only as a salted hash) or the basic profile details (name, email, avatar) that Google or GitHub share when you choose to sign in with them. If you sign in that way, the header shows the picture they gave us. The picture is loaded from Google's or GitHub's servers, which therefore see your IP address and browser details, without being told which Stackboo page you are on.
• Sign-in sessions. When you sign in we store a session record with your IP address and browser user agent, so we can keep you signed in, let you revoke sessions, and spot abuse.
• Notifications about your products. When something happens to a listing you own (it is approved, the Stackboo badge is found or disappears, a Featured spot is booked or about to end, it reaches a round number of upvotes, someone comments on it, or someone replies to a comment of yours) we store a short note for you, shown in the bell and on your notifications page. We email you only for things that need your attention, and you can switch those emails off in your account. Notes are removed when you delete your account.
• Your founder profile (optional). If you create one, we store the name, username, bio, picture and links (X, website, GitHub, LinkedIn) you enter. It is private until you tick "Show my profile on Stackboo". Once you do, those details and your live products are public at stackboo.com/founders/your-username and in the founders directory, and search engines can index them. Links on it are marked nofollow. Your email address is never shown. You can hide the page at any time by unticking the box, and deleting your account removes the profile and its picture.
• Listings you submit. The product's name, website, tagline, description, founder note, pricing details, category, tags, logo and screenshots. Listings are public once approved. Do not put personal data in them that you do not want published. You can also add optional extras: a product description, a first comment, a demo video link (YouTube, Vimeo or Loom), an FAQ, your X (Twitter) username and a LinkedIn page (a company page or your own profile). All of these are shown publicly on your listing, including the username and the LinkedIn page as links.
• Upvotes. Which products you upvoted, tied to your account so that each person counts once.
• Comments. If you comment or reply on a product page, we store the text, the time and your account. Your name (or the name of your published founder profile) and your picture are shown with it, publicly, and a comment on a product page can be indexed by search engines. Links in comments are not clickable. You can remove your own comments at any time, the owner of a product can remove comments on it, and we can remove comments that break our terms. Removing a comment clears its text. Deleting your account deletes your comments.
• Impressions. When a listing has been on your screen for a second, your browser tells us which listing and where it was shown (for example the home board or a Featured spot). We add it to a daily total for that listing. We store no cookie, no IP address and nothing that identifies you, and we do nothing of this for visitors who chose "Essential only". Owners see these totals, never who saw them.
• Outbound clicks. When someone clicks through to a listed product we record the product, the referring site's domain, the visitor's country and an anonymous visitor code. The code is a salted one-way hash of your IP address, browser and the date. We never store your raw IP address in these records, and the code changes every day, so it cannot be used to follow you over time. When the click comes from a Featured spot we also record which spot. The owner of a listing sees these only as totals (visits per day, the top referring domains and countries), never as individual visitors.
• The weekly visitor email. If you sign up for it, we keep your email address, when you signed up and confirmed, and which form you used. You can also tick an optional box when you submit a product, or subscribe from your dashboard or account page; then we use your account's email address, and you can switch it off on your account page. Either way we email you a link first and send nothing until you click it. Once a week you get the new AI products and the top of last week's board, and every issue has a one-click unsubscribe link. When you unsubscribe we keep the address, marked as unsubscribed, so nobody mails it again; write to contact@stackboo.com to have it erased completely. We use the address for this email only, and it is sent through our email provider.
• Weekly email about your listings. If you own a live listing and your email is verified, we email you once a week, only when there is something to report: visits to your website, votes and any Featured spot. We use the totals above and your email address, nothing else. Every email has an unsubscribe link that works in one click, and you can switch it off on your account page. Emails about your account itself, such as sign-in codes and review decisions, are not part of this and are always sent.
• Listing claims. If you claim a product we wrote up, we keep a record of the claim: your account, the product, when and how you proved ownership, and, for the email-code method, the address the code went to (the code itself is stored only as a one-way hash). We use it to prevent abuse and settle disputes.
• Visitor statistics. We measure page views, referring site, country, device type and browser with Cloudflare Web Analytics. It uses no cookies or local storage, does not build a profile of you and does not follow you across other websites.
• Visit and purchase analytics. We run our own analytics tool, Minilytics, on our Cloudflare account. For every visitor it counts the pages opened, the site that sent them, approximate location (country, region, city and coordinates rounded to about 1 km, worked out from the IP address), device type and browser, and the buttons pressed on key pages. Unless you press "Accept analytics" in the cookie notice it uses no cookies and stores nothing in your browser, and it cannot recognise you from one day to the next: your visit is counted under a code made from your IP address and browser, mixed with a secret and changed every day, and we never store the IP address. If you press "Accept analytics", it also sets two first-party cookies (see Cookies) and links your visits to the internal ID of your account (a random code), not to your name or email address, so we can see which visits lead to a sign-up. Then, when you pay by card, the two cookie values are attached to the Stripe payment so we can tell which visit led to it. This data stays with us and is not shared with advertisers or used to follow you across other websites.
• Emails. If you contact us we keep the correspondence. We also send you the emails the service needs: address verification, password reset, and updates about your submissions.

AI-assisted submissions

The submit form can pre-fill your listing from your website. If you use it, we fetch the public page you enter and send its text to an AI provider to draft the fields. Only the public content of that page is sent, never your account details. Check the draft before submitting; you stay responsible for what you publish.

Link checks

To confirm that listed products link back to Stackboo we fetch the homepage of listed sites about once a week. See StackbooBot for details and how to opt out.

Why we use your data

• To provide the service you asked for: your account, your listings, your upvotes (performance of a contract).
• To keep the site secure, prevent spam and abuse, and understand which products get attention, through the anonymous click counts (our legitimate interests).
• To send the service emails described above. We do not send marketing email without asking you first.
• To comply with legal obligations when they apply.

We do not sell your personal data.

Who processes your data

We use a small number of service providers, each only for the job described:

• Cloudflare: hosting, network security, file storage for logos and screenshots, cookie-free visitor statistics, the Workers account that runs our own Minilytics analytics, and the Turnstile spam check on the submit form (it looks at your browser and connection to tell people from bots).
• Neon: the database that holds accounts, listings and upvotes.
• Resend: delivery of our emails.
• Ahrefs: the Domain Rating of the websites listed on Stackboo. Once a week we send it the domains of live listings, and nothing about any person.
• Runware: the AI model behind the optional pre-fill feature.
• Stripe: card payments for paid placements. You enter your card details on Stripe's page, never on ours. We keep the order (product, amount, dates, a Stripe reference) and your email, and never see your card number.
• Google and GitHub: only if you choose to sign in with them.

These providers may process data outside your country, including in the United States. Where the law requires it, that happens under appropriate safeguards such as standard contractual clauses.

How long we keep it

Account and listing data is kept while your account exists. Session records expire on their own. Anonymous click records are kept as aggregate statistics. When you delete your account we remove your personal data at once: your profile, sign-in methods, sessions, upvotes, comments and AI pre-fill history. You choose whether your listings and their images are deleted too or stay online without your name. Payment records, if you ever make a payment, are kept without your name attached for as long as tax law requires. Backups may hold copies for a short time before they are overwritten.

Your rights

Depending on where you live, you can ask to see the data we hold about you, correct it, export it, delete it, restrict or object to how we use it, or withdraw consent you gave. You can download your data and delete your account yourself on the account page. For anything else, email contact@stackboo.com from the address on your account and we will reply, normally within 30 days. If you think we handled your data wrongly you can also complain to your local data protection authority; for us that is the Spanish Data Protection Agency (AEPD, aepd.es).

Children

Stackboo is for founders and is not aimed at children. You must be at least 16 to create an account. If you believe a child has given us personal data, email us and we will delete it.

Changes

If we change this policy in a meaningful way we will update the date above and, for account holders, tell you by email or on the site.