Privacy Policy

• Listing content you submit: business or project name, description, button label, destination URL, and an optional logo image.
• A contact email address, used for your receipt and any notice about your listing. It is never displayed publicly.
• Payment metadata from Stripe or PayPal: the provider payment or order identifier, capture identifier, amount, currency, and status.

We never receive or store your card number, CVC, or expiration date. Card data goes directly from your browser to Stripe. PayPal payments are completed on PayPal.

• Aggregate page-view counts per day and per path.
• A unique-view count per day, deduplicated using a salted, one-way hash of a random anonymous cookie value.
• Click counts on listings, with the same anonymous hash and the referring domain only.
• An optional live-viewer count derived from short-lived anonymous heartbeats held in memory for about a minute.

We do not store raw IP addresses. Where an IP is used at all it is an input to a keyed hash for rate limiting and abuse prevention, and only the hash is kept. We do not use third-party advertising trackers, and we do not sell personal information.

• tts_anon — a random anonymous identifier used to deduplicate views and clicks. It contains no personal data.
• tts_admin_session and tts_admin_csrf — set only for administrators who sign in to the admin area.

These are strictly functional. We do not set advertising or cross-site tracking cookies.

When you enter a destination URL we may fetch that page from our server to detect its icon. The request is restricted to public HTTPS hosts, follows a limited number of redirects, and is size-capped. Any icon we retrieve is stored and re-served from our own domain, so visitors never load assets from third-party servers while browsing the leaderboard.

• Published listings and their payment references are kept while the listing is live and afterward as a financial record.
• Anonymous view and click records are kept in aggregate; per-session rows exist only to deduplicate a day of activity.
• Administrative audit logs are retained to document moderation and refund decisions.

We share data only with the processors required to run the Service: our hosting provider, our database provider, Stripe, and PayPal. Each receives only what it needs to perform its function. We may disclose information if required by law.

You can request access to, correction of, or deletion of the information associated with your listing by writing to support@thetopspot.example. Deleting a published listing does not automatically refund a payment; see the Refund Policy.

The Service is not directed to children and is not intended for anyone under 18.

Privacy questions: support@thetopspot.example.