Privacy
What this site stores, who can see it, and what it deliberately does not collect. Written from the database schema rather than from a template, so it says what the software does — and from what Cloudflare, in front of it, adds.
Short version: there is no advertising network and no tracking cookie, and nothing on this site follows you from page to page. The site runs behind Cloudflare, which counts page views without a cookie and sets one cookie of its own to tell browsers from bots; both are described below. This site's own cookie exists only once you sign in (plus a second for the five minutes a Google or GitHub sign-in takes). The advertising counters record two integers a day per placement, and the affiliate counters one integer a day per button, and nothing about who saw or clicked.
Who runs this
NutsGrowth is operated by the person who curates it. Questions, corrections and requests about your own data go through the contact form, choosing “Your data or privacy”. There is no support desk behind it — it is read by one person.
Cookies
This site sets one, called __Secure-eurodir.session_token, and it is set only when you sign in. It holds a random session identifier — not your email, not your name, nothing readable. It is HttpOnly (a script cannot read it), SameSite=Lax, Secure, and it lasts 14 days. Signing out deletes it.
Signing in with Google or GitHub adds a second one for the round trip, __Secure-eurodir.state: a signed random value proving that the answer coming back from the provider is the one this browser asked for. It lasts five minutes and is deleted when you come back.
Cloudflare, which sits in front of the site (see below), sets one more on your first visit: cf_clearance. It holds the result of Cloudflare's check that your browser is not an automated script, is HttpOnly and Secure, lasts about a year, and this site's code never reads it. Cloudflare lists it as strictly necessary.
That is the complete list: no analytics cookie, no preference cookie, no advertising cookie. Reading the site sets only Cloudflare's. There is no cookie banner because none of them is for analytics or advertising: they sign you in, or they check for bots.
Local storage, when you use a prompt. Copying a prompt, or answering “Did it work for you?”, makes this browser remember that in its local storage, so the question is still there when you come back. Answering also keeps a random id (ng-rater) and sends it with your answer, so one browser counts once per prompt. It is not a cookie, it is sent nowhere but with an answer, and it says nothing about who you are. Clearing this site’s data removes it.
What is stored, and who can see it
Each row below is a table in the database. “Public” means anybody reading the site; “admin” means the person who runs it; “the listing’s owner” means an account with an approved claim on that one entry.
| What | Why | Who sees it |
|---|---|---|
| Account: email, name, password | To let you sign in and to attribute what you contribute | Name is public; email admin only. The password is stored as a scrypt hash — it cannot be read back, including by us |
| A connected Google or GitHub account: which account it is (the provider’s id for you) and, for an account created through it, the name, address and picture it reported | To sign you in with it instead of a password | Admin only. The provider’s access tokens are thrown away, not stored. The provider itself sees that you signed in here |
| Session: a random token, your browser’s user-agent string | To keep you signed in, and so you can see and revoke your own sessions | You, and an admin |
| A review: rating, text, the name you chose, your email — and, if you add them, the product you came from, what it cost, what this one costs, your team size, how long the move took and what you miss | To publish the review and to let you edit it later | Everything except the email is public. The email is never rendered on any page — see the section below on the three opt-ins |
| Newsletter: email, which page you subscribed from, an unsubscribe token | To send the newsletter and to let you leave in one click | Admin only |
| A submission, or a correction to a listing: the tool’s details or what you say is wrong, any link you add, and your email if you gave one — sent through the form, or by an AI assistant through /mcp, which says which | To review the suggestion, to tell you once when it is listed (only if you gave your email after the form said so), and to ask you a follow-up question | Admin only. The email is in no export |
| What an AI assistant searched for through /mcp: the words or names it asked about, the filters, how many listings matched, and the day. Not the address the request came from, and nothing about who asked | To see what the directory is missing. Deleted after 90 days | Admin only |
| A message from /contact: what it is about, your name, your email and what you wrote | To read it and reply. It is kept until we delete it | Admin only. One copy is emailed to our own inbox, with your address to reply to; nothing is sent to you automatically |
| Verified revenue, when a listing’s builder connects Stripe: a read-only Stripe key, and the totals it produces — MRR and one reading of it a day while connected, revenue for each of the last 90 full days and their total, and how many active subscriptions and customers | To state that listing’s revenue as verified, and to measure it again every few hours | The totals are public on the listing page, and MRR on its card in lists; a listing connected under the first notice shows the totals only. The key is shown to nobody and stored encrypted, so a copy of the database is not a copy of it. Stripe’s records are read only to add them up: nothing about any one of that company’s customers is kept or shown. Disconnecting deletes the key, the totals and the daily readings |
| Notion, when you connect it from your account: which workspace, the page and table your saved listings go in, an access token, and which saved listings already have a row there | To add each listing you save to that table, and keep its row up to date | You. The token is shown to nobody and stored encrypted, as a Stripe key is. What goes to Notion is each listing’s public facts and whether you still have it saved — nothing about you. Disconnecting deletes the token and the record of rows here, and revokes the token at Notion; the table stays in your workspace, yours to keep or delete |
| A website you showed you run, when claiming a listing: which site, the code its file holds, and when it was last checked and with what result | So the admin deciding your claim can see that you run the listing’s website | Admin only. To check it, this site fetches that one file from your website, once each time you press Verify; the request carries no cookie and names itself as NutsGrowth’s site verification |
| After a suggestion on /submit, the link offered to claim it: a random code, and which account took it up, if one did | So a claim can open for that account when the suggestion is listed | Admin only. Only the browser that sent the suggestion is given the link |
| An API token you make for your listings: its name, a one-way hash of it, whether it may write, when it was made, when it expires, when it was last used, and when it was revoked | So an agent you choose can work on your listings, and you can see and stop it | You, on your account page. The token itself is never stored, so not even we can read it back, and the address requests come from is not recorded. What a token changes is recorded as your account’s change, naming the token |
| A price correction: the figure, the link that shows it, your note, and your account if you were signed in | So an admin can check the link before a price changes, and credit you if it is applied | Admin only, except the credit: an applied correction shows your account’s name, or “a reader”, beside the price |
| A report: what it points at, which rule, your note, and your account if you were signed in | So an admin can decide whether what you pointed at comes down | Admin only. Nobody else is told who sent a report, including whoever wrote what was reported |
| A job application: name, email, link, message | To pass it to the employer you applied to | That listing’s owner, and an admin |
| An event registration made on this site: name, email, and your account if you were signed in | To pass it to the company running the event, and to email you the link that confirms your place, the joining link, a calendar file, and any change of time or place | That listing’s owner, and an admin, once you have confirmed your place — not before. Deleted 90 days after the event ends, and with the event if it is deleted sooner |
| A password reset: a hash of the link, and the IP that asked | To make the link work once, expire in an hour, and be traceable if abused | Nobody through the interface. The link itself is stored only as a SHA-256 hash, so a copy of the database is not a copy of your reset link |
| Whether a prompt worked for you: yes or no, and the random id your browser sent with it | To show how many say a prompt worked, counting one answer per browser | The share and the count are public; single answers, admin only. No account, address or IP is stored with them |
| Votes and saved listings | One vote per account per listing per month; your own reading list | Vote totals are public, who voted is not. Saved listings are yours alone |
| An audit log of administrative actions | So a change to the directory can be traced to whoever made it | Admin only. Email addresses appear in it masked, because logs get pasted into issues |
Verified revenue
To measure a connected listing’s revenue, this server calls Stripe with that company’s own read-only key, and asks the European Central Bank’s reference rates (through frankfurter.dev) for the day’s US-dollar rates. Neither request carries anything about you or any other reader: one is the company’s account, the other is a rate table.
Links to a product’s own site
A link to a product’s own site carries utm_source=nutsgrowth&utm_medium=referral, so the company’s analytics can name this site as where the visit came from — the same thing your browser’s Referer header already tells it, and nothing about you: no listing, no page, no identifier. Following one adds one to that listing’s count of visits for the day — see below — and nothing else is kept.
Affiliate links
Some blog posts carry affiliate links, and each such post says so at the top; so can the Visit button in a listing page’s side column, which is marked where it is. When you follow one, you arrive at the company through its affiliate network, which records that the visit came from this site — on their side, under their policy. On ours, a click on a button we manage is counted as one integer per listing, per post (or per listing page), per day (affiliate_clicks), with no cookie, address or identifier. Links an author added go straight to the company and are not counted here.
Cloudflare
Every request to this site goes through Cloudflare, which serves it and protects it from attacks. Cloudflare therefore sees your IP address and each request, as the network in front of any website does, under its own privacy policy. Three of its features are switched on here, and each adds something to a page that this site's own code does not:
- Web Analytics. Each page loads a script from
static.cloudflareinsights.com, which sends one report per page view to this site's/cdn-cgi/rum: the page's address without its query string, your browser's engine and version and your operating system's version, how long the page took to load and how much memory it used, and a random id for that one page load. It sets no cookie and stores nothing in your browser, and Cloudflare says it does not fingerprint visitors by IP address or user agent. What we see is totals — page views, pages, referring sites, countries, load times — never a person, so we cannot tell which pages you read. Cloudflare keeps the unsampled reports for seven days and aggregates them after that. - Bot detection. A script from this domain's
/cdn-cgi/challenge-platform/checks that the browser is not an automated script, and keeps the result in thecf_clearancecookie described above. - Email address obfuscation. Where a page shows an email address, Cloudflare swaps it for a placeholder and a small script that puts it back, so that the address is not in the page's source for scrapers to collect.
What is deliberately not collected
These are decisions in the code, not omissions, and each is checkable by opening the page source or the network tab:
- No analytics beyond Cloudflare's totals. No Google Analytics, no Plausible, no tracker of our own. Cloudflare's reports, above, are counts without a cookie, so nobody here can tell you which pages you read.
- No third-party scripts but Cloudflare's. The fonts are served from this domain rather than from Google Fonts. Embedded video is behind a click-to-load placeholder: nothing reaches YouTube or Vimeo until you ask it to. Where a video's card shows a picture, this server fetched that thumbnail once, when the video was added, and serves it from here.
- Advertising counters hold no visitor information. A placement records two integers per day — how many times it was shown, how many times it was clicked. There is no visitor identifier, no fingerprint, no per-click row. A click goes through this server rather than through an ad network.
- Affiliate counters hold no visitor information either. A product box's button records one integer per post per day. The click passes through this server, which counts it and keeps nothing else.
- Listing counters hold no visitor information either. A listing records two integers per day (
listing_stats): how many times its page was opened and looked at, and how many times a link from here to the company’s own site was followed. The page sends which of the two it was and which listing — nothing about you — and nothing is stored in your browser. Only the people who maintain that listing, and an admin, see the numbers. - The 404 log records paths, not visitors. When a broken link is followed we store the address that was missing and a counter — nothing about who followed it.
- This server does not store your IP address — with one exception, named in the table above. It is held in memory for about a minute to rate-limit public forms and the listing counters, and is gone when the process restarts. Cloudflare sees it on every request, as described above.
The three opt-ins under a review
This is the one place your email address can leave this site, and it only happens if you tick a box. The review form says so where you tick it, in those words.
Ticking “let them reply”, “tell me about updates” or “send me offers” gives that vendor your address, for that purpose only. They send it themselves, from their own systems. Two consequences worth being plain about:
- Unsubscribing from their mail is between you and them. This site cannot do it for you, and cannot take back an address they already hold.
- Each purpose is separate. If you asked about updates and not about offers, you appear on one list and not the other.
Leave all three unticked and your address stays here, used only to let you edit your own review. It is never shown on a page either way.
An earlier version of that form promised the opposite — that the address would never be given to the vendor. Reviews written under that wording are recorded as such and are excluded from every export permanently, whatever their boxes say. That is enforced by a column in the database rather than by anybody remembering.
Email we send
Sent through Resend, which therefore handles the address and the message on the way out. We send: the newsletter, a notice when somebody replies in a review thread you are part of, a password reset when you ask for one, a link to confirm your address when you create an account or ask for one, a notice to a listing’s owner when somebody replies to them, and, when you register for an event on this site, the link that confirms your place, the event’s details with a calendar file, and word if its time or place changes or it is cancelled; and, once, that a tool you suggested is listed, if you left your email for that. A message you send from /contact is copied to our own inbox only — never to you, so the form cannot be used to send mail to anybody.
The newsletter carries one-click unsubscribe headers, so your mail client can remove you without opening anything. Thread notices carry a link that stops them for that review. A password reset has no unsubscribe link, deliberately: it is the only way back into a locked account, and offering to switch it off would be offering to break the recovery path. Email about an event carries the link that gives up your place, which also stops the email.
🛑 Paying for an advertising placement
This is the one place where data about you deliberately leaves this server, so it gets its own section rather than a row in the table.
Card payments are handled by Waffo Pancake, which is the merchant of record for the sale. You are sent to a checkout page Waffo hosts. No card number, expiry, security code or bank detail is ever seen by this site, and none of it is stored here — there is no field in this database that could hold one.
What this site sends to Waffo when you start a payment: your account id, your account email address (only to save you typing it on their form), the amount, and which placement and term you are buying. Nothing else — not your other placements, not anything you have posted, not anything about other people.
What comes back and is kept here is deliberately thin: the Waffo order reference, the fact and time of payment, and the delivery id of each notification so the same one is not counted twice. The notification body is not stored. It arrives carrying a billing address and an email, and keeping it would build a second copy of your details outside the tables listed above — so it is read, acted on, and dropped.
As merchant of record Waffo is the seller and needs billing and tax information to be that — it collects that on its own page, under its own privacy terms, and it is the party to ask about anything it holds. This site cannot delete a record Waffo keeps for tax purposes, and would not be told if you asked it to.
Gravatar
Only if you tick the box. We then ask gravatar.com for your picture once, from this server, and keep a copy here. Your address is never placed in a page for your browser to send onward, which is how a Gravatar normally works and how most sites leak the addresses of everybody who comments.
Your own data
- Your reviews — editable and deletable by you at /admin/reviews, if you were signed in when you wrote them. A review posted while signed out has no owner and cannot be claimed later: with no email verification, matching on the address would let anybody take over somebody else’s review. Write to us and we will remove it by hand.
- Your account — name, picture and profile at /admin/account. A public profile page is off until you turn it on there, and never shows your address.
- The newsletter — the unsubscribe link in any message, which works without signing in. We mark you as unsubscribed rather than deleting the row, so that a later sign-up form cannot quietly put you back on the list.
- Anything else — a copy of what we hold about you, or its deletion, by writing to the address above or through /contact.
Where it is stored
One SQLite file on a server in the United States, rented from Railway, reached through Cloudflare's network. Backups are the platform’s. There is no data warehouse and no second copy of the database anywhere else; Cloudflare's page-view totals are kept by Cloudflare, not here.
Worth saying plainly on a site that files listings by where their operator is: this site is not itself EU-hosted. Judge it by what it collects rather than by where it runs.
Changes
This page is part of the source code, so it changes when the software does — that is the point of writing it from the schema. There is no version history published here yet; if a change alters what happens to data already collected, it will be described rather than applied silently, as the review opt-ins were.
This is an accurate description of what the software does, written by the person who built it. It is not legal advice and has not been reviewed by a lawyer. If you need a formal GDPR position — a named controller, a stated lawful basis per purpose, a documented response procedure — that is a separate exercise from describing the code, and it has not been done.