What this site stores

Nothing is stored and nothing is set. There is no analytics service, no tag manager, no advertising pixel and no cookie — a request for a page here returns a page and asks your browser for nothing in return. You can confirm that from the outside: a response from any page on this site carries no Set-Cookie header at all, and the content security policy forbids the browser from connecting to any origin but this one.

Two kinds of picture come from elsewhere, and your browser fetches those directly, so those hosts see your address the way any site you visit does: coin logos from CoinGecko, and article thumbnails from the four newsrooms whose headlines the front page reads. That is the whole list, and it is the same list the content security policy names.

A review stores what you typed, the rating and topic you chose, the day you wrote it, and two one-way values. It does not ask for your name or your email, because it does not want them.

• A fingerprint that expires daily

  A SHA-256 of your network address, your browser’s user-agent string, a secret only this deployment holds, and today’s date. Your address is not stored, and the digest cannot be turned back into it. Because the date is part of it, the value changes every midnight: today’s reviews cannot be matched against yesterday’s, by us or by anybody who takes a copy of the database. It exists to count distinct people and to stop one person writing fifty reviews, and it can do nothing else.

• A hash of your withdrawal code

  You are shown a one-time code when you publish. What is stored is a SHA-256 of it, so the code works and we cannot read it. Lose it and nobody here can recover it — which is the cost of the review not being tied to an account.

If you offer evidence in the private box, an editor can read it and a reader cannot. It exists so a claim can be checked without publishing your account statement.

The same daily fingerprint, which broker it is about, which kind of problem, and an optional note that no reader sees until a moderator has cleared it. The fingerprint is the whole mechanism: the status a page shows changes only above a published number of distinct reporters inside a published window, and counting distinct people is impossible without some way to tell them apart. This is the least that does it.

A review comes down with the code you were given, at the withdrawal page. It stops being visible and stops counting towards any score immediately.

The row is kept rather than deleted, marked withdrawn. That is a deliberate choice and worth saying plainly: a directory where a published claim can be made to have never existed is one where a score can be quietly rewritten afterwards. Nothing you wrote is shown to anybody again.

People who edit this site have accounts: a name, an email address, a password stored as a scrypt hash, and a session row that ends when they sign out. Every change they make is recorded against that account in a log nothing can delete from. None of that touches a reader, and there is no reader account to create.

The site is served by Vercel and the data above is held in a hosted Postgres database. Both keep operational logs of requests, as any host does; neither is sent anything by this site beyond what serving a page requires.

A contact address for privacy requests has not been published yet.