Privacy

Reading the site

Google Analytics runs on every page. It and the Google advertising script described under Advertising below are the only things here that measure you, and this site sets no cookie of its own.

The analytics exist so we can see which entries are actually read, which is what tells us where more of the writing is worth doing. That is the entire use of it: nothing here is ordered, recommended or personalised from those numbers, and nobody is contacted on the strength of them. The script stores a randomly generated identifier in your browser as a cookie and reports each page view to Google, who handle it as our analytics provider under their own terms. Google states that Analytics does not log or store the addresses it receives — a coarse location is derived from one and the address itself discarded.

You can refuse it, and refusing costs you nothing: blocking cookies for this site, a content blocker, or Google's own Analytics opt-out browser add-on each stop it, and no page behaves any differently as a result.

Your colour theme preference is kept in your browser's local storage. It never leaves your device and is not sent to us.

Cloudflare serves the site and keeps its own operational logs, as any host does.

Images inside reproduced READMEs

Project logos are copied onto this site precisely so that browsing a listing does not report your visit to each project's host. The images inside a reproduced README cannot be handled the same way, because some of them are generated on demand.

What is done instead: status badges are removed entirely — they tell you nothing useful about a project and were the bulk of these requests. The images that remain are diagrams and screenshots. They load only if you scroll to them, and no referrer is sent, so the other host learns an address and nothing about which page you were reading.

Advertising

Two advertising systems run here. Project pages carry one labelled slot served by EthicalAds, above the content rather than below it. Separately, Google AdSense places ads automatically across the site's pages; its script loads on every page.

EthicalAds sets no cookies, builds no profile of you and does not follow you to other sites. Its ad is picked from the topic of the page you are on and a coarse idea of your region, and nothing about that view is retained against you.

Google AdSense is a conventional ad network, and the honest description is that Google's script may set cookies and use identifiers to serve, measure and — where permitted — personalise ads, under Google's own advertising policies. In regions whose law requires consent, such as the EEA and the UK, Google's consent framework governs what runs before you have agreed. Personalisation can be adjusted on Google's Ads Settings page (adssettings.google.com).

Separately from both, one box labelled Sponsored, on the home page and on project pages, is an affiliate link. It is an ordinary link: nothing is stored in your browser for it, and following it passes on only what following any link passes on — the page you came from and the usual request headers. It leads through a redirect run by the advertiser's affiliate provider, which records that a click happened and forwards you on. If you go on to subscribe, we are paid a commission; what that does and does not buy is set out on the How we curate page.

In either case your browser requests the ad from the network's servers, which see an address the way any host does.

Submitting a project

The submission form stores what you type — the repository, an optional category, an optional note and an optional name or handle — together with the time, your language, a salted hash of your IP address, the two-letter country code Cloudflare provides, and your browser's user-agent string.

The IP address itself is never stored. The hash exists to rate limit submissions and to deal with abuse; it cannot be turned back into an address.

The form deliberately does not ask for an email address. There would be no honest use for it: outcomes are visible on the site, and holding contact details we would rarely use is a liability rather than a service.

Cloudflare Turnstile runs on that page to keep automated submissions out. It is operated by Cloudflare under their terms.

How long it is kept

Submissions are kept while they are in the review queue and for a reasonable period afterwards as a record of what was decided. Rate-limit counters expire on their own.

Ask and your submission will be deleted. There is no form for this and no account to prove — write to the address on the contact page and say which repository it concerned.

Who else sees it

Nobody. Submissions are not sold, shared or used for anything other than deciding whether to list a project.

Cloudflare processes the data as our infrastructure provider — hosting, the database, the anti-spam check and the forwarding address on the contact page. EthicalAds serves the labelled advertisement. Google appears twice over: it serves and measures the AdSense advertising, and it receives the analytics, both described above. The affiliate provider behind the affiliate box learns only that someone followed that link, and that only when someone does. None of them receives anything from the submission form.