Privacy policy

Atollship is a directory of web projects rated by AI judges. This page explains, in plain words, what personal data it handles, why, and what you can do about it. It applies to atollship.dev and its sign-in pages.

Who is responsible?

Atollship is run by Darjus Kazakevic, a private individual in the EU, who is the data controller under the GDPR. For anything about your data, write to darjus.dev@gmail.com.

What do we collect, and why?

• Account data: your email address; the name and email GitHub or Google share with us if you sign in with them; your password, stored only as a hash by our sign-in service; and when you accepted the terms. We need it to run your account (contract).
• Projects you submit: the URL, what our analysis reads from that public site (text, screenshots, technologies, speed), and your edits. We need it to analyse, rate and list your project (contract).
• Likes you give: which projects you liked, and when. Projects only show how many likes they have, never who gave them, not even to their owner (contract).
• Capital purchases: what you bought, for which project, the price, its status and the payment’s reference. We never see your card or bank details. We need it to deliver the purchase and handle refunds (contract).
• Notification preferences and in-app notifications, to tell you about your projects (contract).
• Sign-in security events, such as failed logins, to protect accounts. They are kept for at most 30 days (legitimate interest).
• Project visit counts. To count each visitor once a day, we keep a keyed hash for at most 2 days, the daily totals for 400 days and a running total for the life of the project. We never store your IP address for this. A project’s visitor numbers for the last 30 days and all time are shown publicly, rounded down (fewer than 10 is never shown as a number), unless its owner hides them (legitimate interest).
• Site analytics: page views (path, title, referrer, campaign tags), page speed and script errors, plus a fixed set of product events such as “project published”. They never include your account, a project URL or anything you typed. For every page request, our server also reports the path, user agent and host, so we can see which crawlers visit (legitimate interest).

We don’t sell your data, show ads or track you across other sites. Atollship’s own server doesn’t log IP addresses.

Who else processes it?

We use a few services that process data on our behalf:

• Our hosting provider (EU): hosting for the app and database.
• Resend: sends account emails (verification, password reset).
• GitHub and Google: only if you choose to sign in with them.
• OpenRouter: runs the AI judges on the public content of submitted sites. It does not receive your account data.
• Google Chrome UX Report: speed data, looked up by the site’s URL.
• Stripe: the merchant of record for capital purchases. It runs the checkout, takes the payment, handles tax and receipts, and receives your email address, your payment details and, when it asks for one, your billing address, and a tax ID if you add one for a business purchase.
• ruthylisa: our analytics. Your browser connects to it directly, so it sees your IP address the way any website does. It sets no cookies.

Some of these are based outside the EU, mainly in the US. Those transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

What about cookies?

Only the ones needed to sign you in and keep you signed in: a session cookie, a short-lived cookie for the sign-in round trip, and the sign-in service’s own session cookies. There are no advertising or cross-site cookies, which is why there is no cookie banner.

How long do we keep it?

Account data stays until you delete your account. Unpublished drafts expire on their own after 30 days. The other periods are listed above. When you delete your account, your projects, likes, capital orders, notifications and account data are deleted with it. Stripe keeps its own payment and tax records as the law requires.

What are your rights?

You can ask to access, correct, export or delete your data, object to processing based on legitimate interest, or restrict it. Export and deletion are self-service on your account page. For anything else, write to darjus.dev@gmail.com. We reply within one month. You can also complain to your local data protection authority.

Will this policy change?

If it changes, we update this page and its date. If the change matters for how your data is used, we tell signed-in users in the app first. See also the terms of use.