- One cookie, holding a random number that means nothing anywhere else.
- No advertising, no ad networks, no cross-site tracking.
- Your IP address is never stored.
- Where you arrived from is kept as a hostname, once, and nothing finer.
- Nothing is sold or shared with anyone who would sell it.
Cookies
mba_v holds a random 32-character number for a year. It is
generated here and derived from nothing about you, so it cannot match you
on another site or be traced back. It is what lets the counter say how
many people are reading rather than how many pages were served.
mba_seen lasts a minute, so reading ten pages writes to the
database once instead of ten times.
Deleting them is enough to be forgotten: the row they point at is a random number with two dates beside it and nothing else. Crawlers, and the invisible requests a browser makes guessing which link you will click, are not counted at all.
Your browser also keeps mba:pid, a random id for analytics,
and mba:acq, the campaign parameters you arrived on, until
you close the tab.
What is written down
- Visitors
- The number from the cookie, the day it was first seen, the day it was last seen, and the hostname of the site you were on when you first arrived, if your browser sent one. The hostname only: not the page, not the search that led there. It is written once, on your first visit, and never updated. No address, no browser, no record of which pages you read.
- App statistics
- Two counters per listing: times opened, and times somebody left for the developer's site. They sit on the listing, not on a person, so they cannot be read as anybody's history.
- Searches
- The phrase, how many times anyone has typed it, and how many results it found. One row per phrase rather than one per search, with no visitor id and no time of day, so it cannot be turned back into one person's session. Anything containing an @ is discarded unread, because people paste addresses into search boxes by accident.
- Submissions
- What you type into the submission form, including your name and email address, and the campaign parameters that brought you. Kept whether the app is listed or declined. Your address is used to answer you and is not added to any list, because there is no list.
- Spam signals
- Against each submission: whether the hidden honeypot was filled, how long the form was open, and a SHA-256 of your IP address salted with a secret only this deployment holds. It enforces a limit of five submissions a day from one sender. The salt means the table cannot be turned back into addresses by anybody, including whoever runs this site. The address itself is never written down.
- Enquiries
- If you tick the box saying you would pay to be promoted, your address, your message and the budget you named. It grants nothing and moves nothing.
Who else sees anything
- Vercel
- Serves every request, so it sees your IP address, as any host does.
- Turso
- Holds the database above.
- Cloudflare Turnstile
- On the submission form only, to tell a person from a script.
- PostHog
-
Analytics, sent from your browser with the random
mba:pid. No name, address or submission content ever reaches it. - Resend
- Carries one email per submission to the person who reviews it.
That is the whole list.
Keeping and deleting
The counters and search phrases have nothing personal in them and are kept while the site runs. So are submissions and enquiries, because they are the record of what was listed and why. Your visitor row lasts as long as your cookie, which is a year unless you delete it sooner.
Write to mehmetalidemir99@gmail.com to see what is held about you, correct it, or have it deleted. Name the app or the address you used and it goes. There is no account and nothing to prove.
The site is operated from Türkiye by Mehmet Ali Demir. When it starts or stops storing something, this page changes and the date at the top moves.