Privacy Policy

1 Who we are

VibeTopList (vibetoplist.com) is a community-run toplist for AI-assisted ("vibe-coded") indie browser games. In this policy, "we", "us", and "VibeTopList" refer to the operator of the service. For any privacy question, write to vibetoplist@gmail.com.

This policy applies to vibetoplist.com and any subdomains we operate. It does not cover third-party websites you reach by clicking out (e.g. a creator's game, a sponsored banner, or Stripe-hosted checkout pages).

2 Data we collect

Account data

When you register: a username, your email address, and a salted hash of your password (we never see your plaintext password). If you submit a game, you also give us its title, description, category, tags, optional YouTube link, optional screenshots, banner image, and the public URL of your game.

How you found us

The first time you open the site without being signed in, a small cookie (vtl_src, see Cookies) remembers where you came from: the kind of link (for example a search engine, a social site, an ad, another website, or none), that site's name, any campaign tags in the link, the page you landed on and the date. It holds no ID. If you create an account in that browser, we store this with your account and delete the cookie, so we can see which places bring the people who sign up, list a game or buy.

Voter & abuse-prevention data

When you cast a vote we record an HMAC-SHA256 hash of your IP address (we do not store the raw IP), a hash of your user-agent string, a hash of the random device ID in our vote cookie (see Cookies), and the listing you voted on. Hashes let us enforce the 12-hour cooldown per network, per device and (when you're signed in) per account, rate-limit bots, and block abuse, without retaining identifying network information. Failed vote attempts (bot detection, CAPTCHA fails, rate-limit hits) are logged the same way for fraud review.

Billing data

Payments are processed by Stripe, Inc. We don't see your card details. After a successful checkout we store a Stripe session ID and the line items so we can grant the purchased Gold tier or banner slot. Stripe's own privacy policy applies to the data they collect.

Technical & log data

Our web server (nginx) records standard request logs: timestamp, request path, response status, user-agent, and IP address. Logs are kept up to 30 days for security investigation, then rotated out. We do not run third-party analytics, fingerprinting scripts, or advertising trackers on the site.

We also keep an application security activity log to detect and investigate abuse: for each request we store the time, the page or action, the response, a salted hash of your IP address (not the raw address) and of your browser, the query string, and, if you are signed in, your account. We keep these records for up to 30 days, then delete them, except for an account we have suspended for abuse or illegal activity, whose records we keep as long as the matter requires. Where we reasonably suspect a crime, we may give the relevant records (which can include the raw IP addresses from the server logs above) to the police or another competent authority.

Visit statistics

We count visits ourselves. For the first page of each visit we store its address, where you came from (the site that linked to us, or a campaign tag in the link), your browser and device type, and a one-way hash of your IP address. While a page of the site is open and visible in your browser, it also tells our server about every 30 seconds which page it is, so we can see how many people are on the site right now; for that we keep a one-way hash of your IP address and browser for two hours. Neither uses a cookie.

Reports

If you report content with our report form, we store your report: what you reported and why, your name and email address (optional when you report sexual content involving minors), your organisation if you give one, your account if you're signed in, a one-way hash of your IP address (to stop abuse of the form) and a copy of the page as it was when you reported it. For copyright reports we also keep private copies of the reported images. When you answer our questions or ask us to look again, we keep that too.

If content you posted is reported, or we act on it, we keep the report, our decision and what we emailed you. When we remove a screenshot or a banner, we keep a private copy so we can put it back if we change our decision.

Saved and played games

When you're signed in, we keep the games you save (with the date), and the games you open with a game page's Play button (the first and the last time), with your account, to show them to you in My Games. You can remove any of them there. A game's owner sees how many players saved their game, never who.

Feedback

If you send us feedback from your dashboard (Submit Feedback), we keep your message, what it's about and whether we may email you about it, with your account. We use it to improve VibeTopList, you see its status next to it (for example Read or Planned), and if you allow it we may email you about it.

Communications

If you email us we keep that email so we can reply and refer to it later. Transactional email we send (verification, password reset, login alerts, receipts) is sent via Gmail SMTP from vibetoplist@gmail.com. If you list a game, we also email you once a month, when the toplist resets, with your games' final ranks and tips to climb. You can turn that email off on your dashboard or with the link in each one. When someone reviews one of your games, we email you what they wrote, once for each person who reviews it; you can turn those emails off the same way. When the developer of a game replies to your review, we email you their reply, once for each game; the link in that email turns these emails off. If you start a banner or Gold purchase and the checkout doesn't go through, we may email you once about it (for a banner, sometimes with a discount on that reservation). The link in that email, and the one on the checkout page, turns these emails off. If your banner holds the Top Banner in a sales event and someone takes the spot over, we email you each time, with the price to take it back; the same link turns these emails off too. If you list a game, we may also email you now and then with news about VibeTopList (events like a sales event on the Top Banner, new features and offers); the link in each one, or the switch on My Listings, turns them off.

Our Discord server

VibeTopList has a community server on Discord, which Discord runs under its own privacy policy. Our bot there keeps only what it needs. When you open a ticket, the form you fill in and the conversation are kept as a transcript in a channel only our team can see, and you get a copy by direct message. If you link your VibeTopList account in #claim-your-rank, we email a 6-digit code to your account's address and then keep which Discord account is linked to which VibeTopList account, to give you the ranks your purchases and games earn and keep them up to date. The Unlink button there removes the link and the ranks. The bot also posts public information from this site: new games, new blog articles and each month's winners.

3 How we use it

• Run the toplist: show listings, record votes, compute monthly rankings, archive Hall of Fame snapshots.
• Keep votes honest: enforce IP-, device- and account-based cooldowns and rate limits, run bot detection, verify Cloudflare Turnstile challenges, log blocked attempts for review.
• Authenticate you: sign-in sessions, verify your email, reset your password, optionally alert you to a new sign-in.
• Process payments: create Stripe checkout sessions, confirm webhooks, grant the purchased feature, send receipts.
• Power the callback API: when a creator opts in, post a signed callback to their server so they can reward voters in-game.
• Keep game owners informed: a monthly email with their games' results when the toplist resets, and an email when someone reviews one of their games (you can turn both off).
• Send game owners news: now and then an email about VibeTopList (events, new features, offers) to accounts with a game listed (you can turn it off).
• Tell reviewers about replies: one email the first time the developer of a game replies to your review (you can turn it off).
• Follow up on a purchase you started: one email when a banner or Gold checkout doesn't go through, for a banner sometimes with a discount, and in a Top Banner sales event an email each time someone takes over your spot (you can turn both off).
• Count visits: how many visits the site gets, where they come from and how many people are on it right now (our own statistics, no third-party analytics).
• Learn what brings people here: count which places (search engines, social sites, ads, other websites) bring the people who create an account, list a game or buy, from how each new account first found the site.
• Keep your games: show you the games you saved and played in My Games, and tell a game's owner how many players saved it (never who).
• Improve VibeTopList: read the feedback you send from your dashboard, show you its status and, if you allow it, email you about it.
• Run our Discord server: answer tickets, and give the ranks your account earned to the Discord account you linked.
• Handle reports of illegal content: review them, ask questions, decide, email the person who reported and the person our decision affects, and keep a record.
• Protect the service: diagnose errors, block abuse, comply with legal obligations.

4 Legal bases (EEA / UK / Swiss users)

Under the GDPR and UK GDPR, we rely on the following legal bases:

• Contract (Art. 6(1)(b)): account creation, processing your purchases, delivering the Gold/banner you bought, keeping the games you save and play in My Games.
• Legitimate interest (Art. 6(1)(f)): fraud prevention, security logging, hashed-IP cooldowns, error diagnostics, transactional sign-in alerts, the monthly results and new-review emails to game owners, the email to a reviewer when a game's developer replies, the one follow-up on a banner or Gold purchase you started, the email when someone takes over your spot in a Top Banner sales event, our occasional news emails to game owners, recording how a new account first found the site, protecting the report form against abuse, reading and answering the feedback you send us, answering tickets on our Discord server and giving the ranks you ask for there, and our own visit statistics. Our interest is keeping the toplist usable and the service safe, and knowing which places bring the people who sign up; we've balanced this against your privacy by hashing identifiers, keeping logs short and recording only where a first visit came from.
• Legal obligation (Art. 6(1)(c)): tax records, responding to lawful requests, and handling reports of illegal content and telling the people involved our decisions (the EU Digital Services Act).
• Consent (Art. 6(1)(a)): where it applies, e.g. if we ever add optional marketing. Apart from that one follow-up on a banner or Gold purchase you started, the email when someone takes over your spot in a Top Banner sales event and our occasional news emails to game owners (all of which you can turn off), we don't send marketing email.

5 Cookies

VibeTopList sets a small number of its own cookies: the strictly-necessary ones below, one that remembers how you first found the site (vtl_src) and one that remembers whether you chose dark mode (vtl_mode). None of them follows you to other sites, and we don't share them with anyone.

• session | a signed session cookie that keeps you logged in. HttpOnly, Secure (in production), SameSite=Lax. Cleared on sign-out.
• csrf_token | a per-form anti-forgery token (form input, not a long-lived cookie).
• vtl_device | a random number set when you open a vote page, so the 12-hour wait between votes counts per browser as well as per IP address (switching networks doesn't give anyone a new vote). We store only a hash of it with your vote, and it isn't linked to your account. HttpOnly, Secure (in production), SameSite=Lax, sent only to vote pages, kept up to 400 days.
• vtl_src | remembers how you first found the site: the kind of link and the site's name (for example Google, Reddit or an ad), any campaign tags in the link, the page you landed on and the date. It holds no ID and is set only while you're not signed in. If you create an account in that browser, we store it with your account and delete the cookie; otherwise it simply expires. HttpOnly, Secure (in production), SameSite=Lax, kept up to 90 days.
• vtl_mode | remembers your choice of dark or light mode, so every page opens the way you left it. It is set only when you press the moon / sun button at the top of the page, and holds nothing else (just "dark" or "light"). SameSite=Lax, Secure (in production), kept up to a year; delete it or press the button again to change it.
• Cloudflare Turnstile may set a short-lived challenge cookie when you submit a vote, sign up or send a report. See Cloudflare's policy.

6 Sharing & service providers

We share data only with the processors below, only as needed to run the service. We do not sell personal information.

Reports: for copyright and trademark reports we tell the game's maker the rights holder's name, so they can respond; we never share the email address of the person who reported, and for other reports we never say who reported.

We may also disclose data when required by law, to enforce our Terms, or to protect the rights and safety of users (for example, telling the police about a threat to someone's life or safety).

7 International transfers

Servers are hosted in the European Union (Netherlands). Some of our processors (Stripe, Cloudflare, Google, Discord) operate in the United States. When data leaves the EEA we rely on Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework, where applicable, as published by each processor.

8 How long we keep data

• Account | until you ask us to delete it.
• How you found us | with your account; the cookie itself up to 90 days, or until you create an account.
• Visit statistics | 180 days; the "right now" count's hashes two hours.
• Vote records | indefinitely (hashed identifiers + listing); needed to keep the historical leaderboard truthful.
• Vote-cooldown rows | auto-pruned after the cooldown expires (12 hours).
• Blocked-attempt audit log | up to 90 days for fraud review.
• Security activity log | up to 30 days (salted hashes, not raw IPs); for an account suspended for abuse, kept as long as the matter requires.
• nginx access logs | up to 30 days, then rotated.
• Billing records | retained for the period required by tax law (typically 7 years).
• Email correspondence | retained for up to 2 years.
• News emails | which news email went to which account, 12 months.
• Feedback | with your account, until it is deleted or you ask us to delete the feedback.
• Discord | ticket transcripts up to 2 years; the link between your Discord and VibeTopList accounts until you unlink it; a linking code 15 minutes, and our note that one was asked for 2 days.
• Saved and played games | with your account, until you remove them in My Games or the account is deleted.
• Reports | the reporter's details, what they wrote and the hashed IP address until 12 months after the report is closed; after that only an anonymous record stays (the reason, the page, our decision and the dates).
• Decisions about content or accounts | as long as the account exists, so we can answer questions about them and recognise repeat infringement; private copies of removed screenshots and banners 12 months.

9 Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your account and personal data (note: votes you cast remain in aggregate, but the hashed identifiers can't be linked back to you after deletion);
• Restrict or object to certain processing;
• Export your data in a portable format;
• Withdraw consent where we relied on it;
• Lodge a complaint with your data-protection authority (in the Netherlands: Autoriteit Persoonsgegevens).

To exercise any of these rights, email vibetoplist@gmail.com from the address on your account. We aim to respond within 30 days. California residents may also exercise CCPA rights through the same channel; we do not sell personal information.

10 Security

Defenses we run today: HTTPS everywhere (Let's Encrypt, HSTS 1 year, includeSubDomains), Content-Security-Policy, X-Frame-Options SAMEORIGIN, hardened session cookies (Secure, HttpOnly, SameSite=Lax), CSRF tokens on every form, SQLite-backed rate limits across all workers, magic-byte image validation with mandatory re-encode (strips polyglot payloads and EXIF), SSRF-safe callback fetching, signed Stripe webhooks, and HMAC-hashed voter IPs. No system is perfectly secure; we'll let you know without undue delay if a breach affects your data.

11 Children

VibeTopList is not directed to children under 13 (or 16 in the EEA). If you believe a child has provided us personal data, contact us and we'll delete it.

12 Changes

We may update this policy as the service evolves. Material changes will be announced on the site at least 14 days before taking effect, and the "last updated" date at the top will change. Continuing to use the service after an update means you accept the revised policy.

13 Contact

Privacy questions, data requests, or breach reports: vibetoplist@gmail.com.

See also: Terms of Service.