Privacy Policy

1. Summary

• You can browse without an account. To recommend, you verify with a one-time code sent to your email (or phone, where offered).
• Your recommendations are shown publicly only as counts and rankings — not with your email or phone number.
• For security, abuse prevention and basic statistics we use a rotating pseudonymous identifier derived from your network address and browser. We do not store your raw IP address in our application database.
• Google Analytics is loaded through Google Tag Manager with Google Consent Mode. In the United States analytics is on by default and you can turn it off at any time; in the EEA, the UK and everywhere else analytics cookies are only set if you accept them.
• The Meta Pixel is loaded only if you accept the “Advertising” category. Until then, nothing is sent to Meta.
• We do not sell personal data.

2. Sign-in and your account

• Email address or phone number. Used to send your one-time sign-in code, to identify your account, and to contact you about your account or our policies. Stored with your account.
• One-time codes. Stored only as a keyed hash, valid for 15 minutes and limited to a few attempts; expired code records are deleted about a day later.
• Session. After sign-in we set an essential ttb_session cookie containing a random token (we store only a hash of it) for up to 90 days, together with the pseudonymous identifier described below. Signing out deletes the session.
• Sending codes. Email codes are delivered by our email provider (see Service providers).

3. Recommendations, Boards and listings

• We store which option you recommend on each Board, when you recommended, changed or removed it, and a history of those events for integrity and auditing.
• Boards and listings you start or add are linked to your account. Publicly, a Board may show “Started by” your public handle if you have one; we never publish your email or phone number.
• Rankings and counts are public and are built from all valid recommendations.
• If you report content, we store the report and, if you are signed in, that it came from your account.

4. Pseudonymous visitor data

For every request our server derives a pseudonymous visitor identifier by combining your IP address and browser user-agent with a secret key that changes every 24 hours. Your IP address is used only in memory to compute this identifier and for rate limiting; it is not written to our application database. The identifier is used for:

• “Online now” presence — while a page is open and you are using it, your browser tells us about once a minute that you are still there; the last-seen time is deleted after a few minutes;
• daily visitor counting — deleted after two days;
• rate limiting and abuse prevention — rate-limit windows are deleted after 24 hours;
• listing exposure measurement — when a listing is visibly on screen we record an impression (the Board, listing, rank, a device class and whether the visitor looked like a bot). The pseudonymous identifier is removed from these records after 24 hours and de-duplication data after two days. Exposure counts never affect rankings;
• website suggestions — when you suggest a missing website for a listing (no account needed), we keep the address you entered for our review and the identifier for 24 hours to prevent abuse;
• share clicks and integrity signals attached to recommendation events and sessions.

We also keep aggregate daily statistics (page views, visits, Board views, shares) grouped by country where our network provides a country; our current hosting does not provide one, so these are stored as “unknown”. Search queries you type are not stored on our servers.

5. Google Analytics, Meta Pixel, cookies and consent

• We use Google Tag Manager and Google Analytics 4 to understand how the Service is used (for example page views, searches, Board views, sign-in steps and recommendations). We never send your email address, phone number, sign-in codes or session tokens to Google Analytics.
• Defaults by location. If you have not made a choice, we use a default based on the country of your network address: in the United States, analytics is on (you can turn it off in Privacy preferences); in the EEA, the UK and all other or unknown locations, analytics is off until you accept it. Advertising measurement is never on by default anywhere. If your browser sends a Global Privacy Control signal, nothing is on by default. A choice you make always overrides the default. The country is looked up at the moment of your request in a local database (IP geolocation by DB-IP, CC BY 4.0); your IP address is not stored and is not sent to anyone for this.
• We use Google Consent Mode. While analytics is off, analytics storage is “denied”: Google Analytics does not set cookies, and Google receives only cookieless, consent-denied signals that Google uses in aggregate. If you accept, Google Analytics may set its cookies (such as _ga).
• While analytics is on, we also keep a first-party visit record on our own servers to understand how visitors use the Service: a random visit identifier (kept in your browser's session storage for that tab only), the page you arrived on, campaign tags in that link (such as utm_source), whether the link carried an ad-click identifier (not its value), the referring website's domain, your device type (mobile, tablet or desktop), the pages you view and steps you take (for example starting a recommendation, signing in, creating a Board, or an error), and your consent choice. It never includes your IP address, browser user agent, email address, phone number, sign-in codes or search text. The rotating daily pseudonym linked to it is removed after 24 hours and the whole record is deleted after 30 days. While analytics is off, nothing of this is sent or stored.
• With analytics on, when you complete a recommendation we also record which campaign link the visit where you started it came from (the same landing and campaign details as above), so a recommendation finished after switching to your email app is still counted for the right campaign. This record contains no account identifier, email address, IP address or user agent and is deleted after 30 days.
• When you accept analytics after arriving from a campaign link, we tell Google Analytics the campaign of the page you originally arrived on, so the visit is attributed correctly.
• The “Advertising” consent category controls advertising storage and personalization signals, and the Meta Pixel. We use it to measure how visitors who arrive from our ads on Facebook and Instagram use the Service. Only if you accept Advertising, the Meta Pixel loads, may set its cookies (_fbp, _fbc) and reports page views and a few product events (a completed recommendation, a new Board, a completed sign-in, a share click) with the Board involved. For completed recommendations and new Boards our server also sends the same event to Meta's Conversions API with your IP address, browser user agent, those Meta cookies and a one-way hash of our internal account identifier — never your email address, phone number, sign-in codes or session tokens. If you decline or later withdraw Advertising consent, nothing is sent to Meta and we remove the Meta cookies from our domain.
• Your consent choice is stored in your browser's local storage (ttb_consent), not in a cookie. You can change it at any time: Privacy preferences.
• Essential storage (the session cookie, a sign-in cookie for administrators, and the consent choice) is always used because the Service cannot work without it.
• Google and Meta process this data under their own terms and privacy policies; data may be processed in the United States and other countries.

6. Security, integrity and logs

• To protect rankings we evaluate signals such as account age, verification, rate of activity and pseudonymous device overlap, and may hold or exclude recommendations. We do not publish the details of these checks.
• Administrative and moderation actions are recorded in an audit log.
• Our web server does not keep access logs of visitor requests. Application error logs are kept briefly on the server for troubleshooting and are rotated automatically.
• We use reasonable technical and organizational measures (encryption in transit, access controls, hashed tokens, backups). No system is perfectly secure, and we cannot guarantee absolute security.

7. Service providers

We share personal data only with providers that help us run the Service:

• Hetzner Online — cloud hosting of the Service and its database, in a data center in Ashburn, Virginia (United States), including server backups.
• Resend — delivery of sign-in emails (receives your email address and the message).
• Google — Google Tag Manager and Google Analytics, as described above.
• Meta Platforms — the Meta Pixel and Conversions API, only with your Advertising consent, as described above.

We may also disclose data if required by law, to protect the rights and safety of people or the Service, or as part of a business transfer. Because our providers operate in the United States, your data is processed there regardless of where you are.

8. Retention and backups

• Account data, recommendations and their history are kept while your account exists, and afterwards only as needed for integrity, legal or aggregate purposes.
• Short-lived data is deleted on the schedules described above (presence minutes, visitor days two days, pseudonymous identifiers on exposure records 24 hours, rate-limit windows 24 hours, expired sessions and codes shortly after expiry).
• Database backups are kept on the server for up to about six months (daily, weekly and monthly copies), by our hosting provider for a few days, and as an encrypted off-site copy for about 30 days. Deleted data disappears from backups as they rotate.

9. Your choices and rights

• You can remove or change any recommendation yourself on the Board.
• You can ask us to access, correct, export or delete your personal data, or to delete your account, by emailing support@thetopboard.com from the address linked to your account. When an account is deleted we remove your contact details and sessions; your recommendations are removed from rankings.
• Depending on where you live you may have additional rights, such as objecting to processing or complaining to a data-protection authority. We will respond to requests as required by applicable law.
• You can withdraw analytics consent at any time with Privacy preferences.

10. Children, changes and contact

• The Service is not intended for children under 13, and we do not knowingly collect their personal data.
• We will update this policy when our practices change, revise the “Last updated” date and, for material changes, give notice on the Service.
• Contact: support@thetopboard.com. See also our Terms of Use and Accessibility Statement.