Privacy
What this site stores, who can see it, and what it deliberately does not collect. Written from the database schema rather than from a template, so it says what the software does.
Short version: there is no analytics, no tracking, no advertising network and no third-party script on any page. One cookie, and it only exists once you sign in (plus a second for the five minutes a Google or GitHub sign-in takes). The advertising counters record two integers a day per placement and nothing about who saw it.
Who runs this
NutsGrowth is operated by the person who curates it. Questions, corrections and requests about your own data go to [email protected]. There is no support desk behind that address — it is read by one person.
Cookies
One, called __Secure-eurodir.session_token, and it is set only when you sign in. It holds a random session identifier — not your email, not your name, nothing readable. It is HttpOnly (a script cannot read it), SameSite=Lax, Secure, and it lasts 14 days. Signing out deletes it.
Signing in with Google or GitHub adds a second one for the round trip, __Secure-eurodir.state: a signed random value proving that the answer coming back from the provider is the one this browser asked for. It lasts five minutes and is deleted when you come back.
That is the complete list. There is no cookie banner on this site because there is nothing to ask you about: no analytics cookie, no preference cookie, no third-party cookie. Reading the site sets nothing at all.
Local storage, when you use a prompt. Copying a prompt, or answering “Did it work for you?”, makes this browser remember that in its local storage, so the question is still there when you come back. Answering also keeps a random id (ng-rater) and sends it with your answer, so one browser counts once per prompt. It is not a cookie, it is sent nowhere but with an answer, and it says nothing about who you are. Clearing this site’s data removes it.
What is stored, and who can see it
Each row below is a table in the database. “Public” means anybody reading the site; “admin” means the person who runs it; “the listing’s owner” means an account with an approved claim on that one entry.
| What | Why | Who sees it |
|---|---|---|
| Account: email, name, password | To let you sign in and to attribute what you contribute | Name is public; email admin only. The password is stored as a scrypt hash — it cannot be read back, including by us |
| A connected Google or GitHub account: which account it is (the provider’s id for you) and, for an account created through it, the name, address and picture it reported | To sign you in with it instead of a password | Admin only. The provider’s access tokens are thrown away, not stored. The provider itself sees that you signed in here |
| Session: a random token, your browser’s user-agent string | To keep you signed in, and so you can see and revoke your own sessions | You, and an admin |
| A review: rating, text, the name you chose, your email — and, if you add them, the product you came from, what it cost, what this one costs, your team size, how long the move took and what you miss | To publish the review and to let you edit it later | Everything except the email is public. The email is never rendered on any page — see the section below on the three opt-ins |
| Newsletter: email, which page you subscribed from, an unsubscribe token | To send the newsletter and to let you leave in one click | Admin only |
| A submission, or a correction to a listing: the tool’s details or what you say is wrong, any link you add, and your email if you gave one | To review the suggestion, and to ask you a follow-up question | Admin only. The email is in no export |
| A price correction: the figure, the link that shows it, your note, and your account if you were signed in | So an admin can check the link before a price changes, and credit you if it is applied | Admin only, except the credit: an applied correction shows your account’s name, or “a reader”, beside the price |
| A report: what it points at, which rule, your note, and your account if you were signed in | So an admin can decide whether what you pointed at comes down | Admin only. Nobody else is told who sent a report, including whoever wrote what was reported |
| A job application: name, email, link, message | To pass it to the employer you applied to | That listing’s owner, and an admin |
| A password reset: a hash of the link, and the IP that asked | To make the link work once, expire in an hour, and be traceable if abused | Nobody through the interface. The link itself is stored only as a SHA-256 hash, so a copy of the database is not a copy of your reset link |
| Whether a prompt worked for you: yes or no, and the random id your browser sent with it | To show how many say a prompt worked, counting one answer per browser | The share and the count are public; single answers, admin only. No account, address or IP is stored with them |
| Votes and saved listings | One vote per account per listing per month; your own reading list | Vote totals are public, who voted is not. Saved listings are yours alone |
| An audit log of administrative actions | So a change to the directory can be traced to whoever made it | Admin only. Email addresses appear in it masked, because logs get pasted into issues |
What is deliberately not collected
These are decisions in the code, not omissions, and each is checkable by opening the page source or the network tab:
- No analytics of any kind. No Google Analytics, no Plausible, no self-hosted tracker. Nobody, including us, can tell you which pages you read.
- No third-party scripts. The fonts are served from this domain rather than from Google Fonts, so reading a page contacts no other company at all. Embedded video is behind a click-to-load placeholder: nothing reaches YouTube or Vimeo until you ask it to. Where a video's card shows a picture, this server fetched that thumbnail once, when the video was added, and serves it from here.
- Advertising counters hold no visitor information. A placement records two integers per day — how many times it was shown, how many times it was clicked. There is no visitor identifier, no fingerprint, no per-click row. A click goes through this server rather than through an ad network.
- The 404 log records paths, not visitors. When a broken link is followed we store the address that was missing and a counter — nothing about who followed it.
- Your IP address is not stored — with one exception, named in the table above. It is held in memory for about a minute to rate-limit public forms, and is gone when the process restarts.
The three opt-ins under a review
This is the one place your email address can leave this site, and it only happens if you tick a box. The review form says so where you tick it, in those words.
Ticking “let them reply”, “tell me about updates” or “send me offers” gives that vendor your address, for that purpose only. They send it themselves, from their own systems. Two consequences worth being plain about:
- Unsubscribing from their mail is between you and them. This site cannot do it for you, and cannot take back an address they already hold.
- Each purpose is separate. If you asked about updates and not about offers, you appear on one list and not the other.
Leave all three unticked and your address stays here, used only to let you edit your own review. It is never shown on a page either way.
An earlier version of that form promised the opposite — that the address would never be given to the vendor. Reviews written under that wording are recorded as such and are excluded from every export permanently, whatever their boxes say. That is enforced by a column in the database rather than by anybody remembering.
Email we send
Sent through Resend, which therefore handles the address and the message on the way out. We send: the newsletter, a notice when somebody replies in a review thread you are part of, a password reset when you ask for one, a link to confirm your address when you create an account or ask for one, and a notice to a listing’s owner when somebody replies to them.
The newsletter carries one-click unsubscribe headers, so your mail client can remove you without opening anything. Thread notices carry a link that stops them for that review. A password reset has no unsubscribe link, deliberately: it is the only way back into a locked account, and offering to switch it off would be offering to break the recovery path.
🛑 Paying for an advertising placement
This is the one place where data about you deliberately leaves this server, so it gets its own section rather than a row in the table.
Card payments are handled by Waffo Pancake, which is the merchant of record for the sale. You are sent to a checkout page Waffo hosts. No card number, expiry, security code or bank detail is ever seen by this site, and none of it is stored here — there is no field in this database that could hold one.
What this site sends to Waffo when you start a payment: your account id, your account email address (only to save you typing it on their form), the amount, and which placement and term you are buying. Nothing else — not your other placements, not anything you have posted, not anything about other people.
What comes back and is kept here is deliberately thin: the Waffo order reference, the fact and time of payment, and the delivery id of each notification so the same one is not counted twice. The notification body is not stored. It arrives carrying a billing address and an email, and keeping it would build a second copy of your details outside the tables listed above — so it is read, acted on, and dropped.
As merchant of record Waffo is the seller and needs billing and tax information to be that — it collects that on its own page, under its own privacy terms, and it is the party to ask about anything it holds. This site cannot delete a record Waffo keeps for tax purposes, and would not be told if you asked it to.
Gravatar
Only if you tick the box. We then ask gravatar.com for your picture once, from this server, and keep a copy here. Your address is never placed in a page for your browser to send onward, which is how a Gravatar normally works and how most sites leak the addresses of everybody who comments.
Your own data
- Your reviews — editable and deletable by you at /admin/reviews, if you were signed in when you wrote them. A review posted while signed out has no owner and cannot be claimed later: with no email verification, matching on the address would let anybody take over somebody else’s review. Write to us and we will remove it by hand.
- Your account — name, picture and profile at /admin/account. A public profile page is off until you turn it on there, and never shows your address.
- The newsletter — the unsubscribe link in any message, which works without signing in. We mark you as unsubscribed rather than deleting the row, so that a later sign-up form cannot quietly put you back on the list.
- Anything else — a copy of what we hold about you, or its deletion, by writing to the address above.
Where it is stored
One SQLite file on a server in the United States, rented from Railway. Backups are the platform’s. There is no data warehouse, no analytics pipeline and no second copy anywhere else.
Worth saying plainly on a site that files listings by where their operator is: this site is not itself EU-hosted. Judge it by what it collects rather than by where it runs.
Changes
This page is part of the source code, so it changes when the software does — that is the point of writing it from the schema. There is no version history published here yet; if a change alters what happens to data already collected, it will be described rather than applied silently, as the review opt-ins were.
This is an accurate description of what the software does, written by the person who built it. It is not legal advice and has not been reviewed by a lawyer. If you need a formal GDPR position — a named controller, a stated lawful basis per purpose, a documented response procedure — that is a separate exercise from describing the code, and it has not been done.