Privacy policy

This policy explains what listme.name collects and why. The short version: reading the site needs no account and sets no tracking. Accounts store only what is needed to sign you in and keep your saved items.

Who is responsible

The data controller is Yunus Emre Vurgun, who operates listme.name. Contact: hello@listme.name.

Reading the site

We do not use analytics, advertising, tracking pixels or social-media embeds. The share buttons and the "ask an AI" buttons are ordinary links: nothing is sent to those services unless you click one, and then only the page address and a question you can see.

The web host and Cloudflare, which delivers and protects the site, process technical request data (IP address, browser, requested address, time) in their server logs to serve pages and defend against abuse. The site itself keeps hashed IP counters only to rate-limit abuse.

Accounts

When you create an account we store:

your email address and an optional name;
a password hash (Argon2id; we never store or see your password), unless you only ever sign in with Google, in which case the account has no password;
if you choose Sign in with Google: Google's account identifier for you, the email address and name Google reports, and when you last signed in that way. We do not receive your Google password, contacts, files or any other Google data;
when the account was created, confirmed and last used;
sessions (a random token stored as a hash, the browser and operating system, the network address and the time it was last active);
trusted devices (a random token stored as a hash, the browser and operating system, and when it was last used), so that a device you have used before does not need an emailed code every time;
sign-in codes (stored as a keyed hash, valid for 10 minutes);
items you save (products and rankings);
a security log of sign-in events, with network address and time.

We use this to sign you in, protect your account, show your saved items, and send the emails below. We do not sell data and do not use it for marketing.

Choosing "Sign in with Google" or "Sign up with Google" sends you to Google to sign in there. Google tells us who you are (identifier, name, email address, and that the email is confirmed) and nothing else; we ask for no other permission. Google handles that sign-in under its own privacy policy. The first time, we create your account from that email address or connect it to the account you already have with the same confirmed address. You can disconnect Google on your account page once the account has a password, or delete the account at any time. Google may also be told, by you signing in, that you use listme.name; we do not tell Google anything else.

The installed app and saved pages

listme.name can be added to your home screen. When it is, or when you simply browse, a service worker keeps copies of public pages you opened and of the site's own files on your device so they open faster and work offline. Pages that need you signed in, the account area and the API are never kept. Clearing this site's data in your browser removes the copies. Nothing in them is sent to us.

Emails

We send only account emails: the confirmation link, the link to choose a first password for a Google account, the sign-in code for a new device, password resets, notices that your password changed or that someone tried to register your address, and the confirmation that your account was deleted. Messages you send through the contact form are read by the publisher and used to reply.

How long we keep it

Unconfirmed accounts are deleted after 30 days.
Sessions end after 30 days of inactivity (8 hours on a shared computer); trusted devices lapse after 180 days unused.
The security log is kept for up to 365 days.
Everything else stays until you delete your account, which removes it immediately. Backups made by the hosting provider may keep deleted data for a limited time.

Your rights

You can see your data, download it as JSON (account page, "Download my data"), change your name and password, end any session or trusted device, and delete your account yourself. If you are in the EU, the UK or Türkiye you also have the rights your data protection law gives you (access, correction, erasure, objection, complaint to the authority); write to hello@listme.name and we will answer within 30 days.

Processors and transfers

Data is stored on the web host's servers and delivered through Cloudflare. Both may process data outside your country under their own terms and safeguards.

Security

Passwords are hashed, tokens are random and stored hashed, cookies are Secure and HttpOnly where possible, forms are protected against cross-site requests, sign-in attempts are rate-limited, and a device we have not seen before must prove access to your inbox. No system is perfectly secure; report a problem to hello@listme.name.

Cookies

See the cookie list. All cookies are strictly necessary, so there is no consent banner.

Changes

If this policy changes materially, the date above changes and signed-in users are told by email.