Privacy

Every Debut is run from 990 Peachtree Industrial Blvd #805, Suwanee, GA 30024, USA. Questions, or a request to see or delete what we keep about you: hello@everydebut.com. There are no third-party analytics, no tracking pixels, no ad networks and no chat widgets on this site. The few ads we sell ourselves are plain labelled boxes that load nothing from anyone else.

Your account

• Your e-mail address (never shown publicly), username, display name and the optional bio, avatar and website.
• If you link GitHub: your GitHub id, login and the date the GitHub account was created. We do not keep the access token.
• Sign-in codes and links: stored only as one-way hashes, valid for 10 minutes, deleted within a day after they expire.
• Sessions: a hash of the session token, when it was created and last used, and one-way keyed hashes of the IP address and browser name. Sessions end after 30 days without use, or when you sign out.
• For new accounts: a keyed hash of the IP address, to limit sign-ups per network (5 a day).

Votes, feedback and products

• Your votes, with the weight they had, how you arrived (for example through the makers' link) and keyed hashes of the IP address, its network (/24 or /48) and the browser name. These hashes help moderators spot coordinated voting.
• Feedback, replies, follows and reports you post, and the products, images and updates you submit.
• Images you upload are converted and stripped of all metadata (such as location and camera data).
• Public: your profile, products, feedback and badges. Not public: your e-mail address, your votes and the hashes.

The forum

• The threads and replies you post, when you posted and edited them, the idea votes you cast and the threads you follow (with the time you last opened each one, to show which replies are new).
• Public: your posts, shown with your display name and username, and on ideas the number of votes. Not public: who voted for what, and which threads you follow. Your e-mail address is never shown.
• If you delete one of your posts, its text is deleted at once and the post shows "Removed by the author". If moderators remove a post, its text is kept so the decision can be checked or undone, and the post shows the reason; you can still delete that text yourself. A post removed because it shared personal information loses its text at once.
• Quotes of your post in other people's replies stay; ask us if one should go.
• To limit spam, each new thread or reply adds one to a short-lived counter keyed by a keyed hash of your IP address (never the address itself); these counters are deleted within 3 days. Accounts in their first week pass the Cloudflare Turnstile check described below when they post.

Counting impressions and clicks

To keep the exposure guarantee we count how often a launch is seen and how often its website is visited from here. We do this without cookies: each visitor is counted once per launch per day using a keyed hash of the IP address and browser name. The key is random, changes every day and is destroyed after its day, so these hashes cannot be linked across days. The hashes themselves are deleted after 2 days. Known bots are not counted.

To know how fast pages load for real readers, your browser sends two timings per page (how long the main content took to appear and how much the layout moved) with only the kind of page (for example "a product page", never which one) and whether the screen is phone-sized; we store them with the day, and nothing that identifies you or your device is stored with them. These rows are deleted after 30 days.

To stop anyone flooding these counters, each request also adds one to a short-lived counter keyed by a keyed hash of your IP address (never the address itself); these counters are deleted within 3 days and are never stored with the counts or timings.

Orders and payments

• Stripe is our payment processor. You pay on Stripe's own page; we never see or store card details. We send Stripe the order number, what you buy and the amount; Stripe asks you for the e-mail address for its receipt. Stripe's privacy policy applies to what you give it.
• We keep each order: your account, what you bought, the amount, Stripe's references for the checkout and the payment, the status and its dates, a keyed hash of the network you ordered from (used for affiliate self-referral checks for 90 days), and, for ads and stories, the texts, image and links you gave us. We keep orders for 7 years for accounting and tax, also after you delete your account (then without the link to it).
• Each ad box counts how often it was seen and clicked per day, in the same cookie-free way as launch impressions (below). The advertiser sees only these daily totals, never who saw or clicked.

The affiliate cookie

If you open Every Debut through an affiliate link (an address with ?aff=), we may set one first-party cookie named __Host-aff for 60 days. It holds only a random visit id, used only for affiliate attribution: if you make your first purchase, the affiliate whose link you followed is paid. No third party can read it, and you can delete it in your browser at any time.

If you visit from the European Economic Area, the United Kingdom or Switzerland, or if we cannot tell where you are (Cloudflare tells us the country of each request), we set no such cookie. Then the visit id stays only in the address of the page you opened, and it counts only if you start a checkout in that same visit.

With the visit we keep a keyed hash of the network it came from (the IPv4 address or the IPv6 /64, never the address itself) for 60 days, to refuse self-referrals, and we count the click once per day in a total.

Affiliates' payout details

If you join the affiliate program, we keep your affiliate code, when you accepted the terms, a keyed hash of the IP address you joined from (to refuse self-referrals), your commissions and, if you give them, your payout method (PayPal or Wise) and the e-mail address of that account. Only you and our admins can see the payout details; we use them only to send your payouts, by hand, through PayPal or Wise, whose privacy policies apply to the payment, and we e-mail your account when they change. Each payout record keeps the address the money went to, for tax records. If you delete your account, the affiliate account is anonymised: payout details go, while paid commissions and payout records stay without your account. If we have to ask for tax forms, we keep them only as long as the law requires.

How long

• Account data: until you delete your account. Deleting removes your account, sessions, follows, idea votes, followed threads and your votes in unfinished weeks; your feedback and forum posts stay, shown as written by "Deleted account"; frozen weekly results do not change.
• Moderation records (who decided what and why): kept as the public moderation log; they never contain your e-mail address.
• Backups: daily, kept for 14 days.

Who helps us

• Amazon Web Services (Amazon SES) delivers our e-mails (sign-in codes, account, launch and order messages).
• Stripe processes payments for ads and sponsored stories (see “Orders and payments”).
• Cloudflare carries traffic to our server, and Cloudflare Turnstile checks that forms are used by people and not bots. Turnstile loads only on pages with such a form and looks at technical information from your browser.
• The site and its database run on our own server. We never sell or share your data for advertising.

Your rights

You can download everything we keep about your account, including your forum posts and votes (Settings → Export my data), change it, or delete your account at any time. You can also write to us.

Newsletter: e-mails about new pages

If you ask for it, Every Debut sends you an e-mail when something new is published on everydebut.com: at most one e-mail a day, only about new pages. Nothing is sent until you confirm with the button in the first e-mail we send you.

What we keep

• Your e-mail address and whether your subscription is waiting for confirmation, active or ended.
• A record of your consent: when you asked and when you confirmed, the page you signed up on, which version of the sign-up wording you saw, and a one-way scrambled ("salted hash") form of your IP address. We do not store the IP address itself.
• A log of the e-mails we sent you (date and a message number) and whether they could be delivered.
• Addresses are looked up through a keyed, one-way scrambled form, so our logs and database copies do not show who subscribed.
• If you unsubscribe: that scrambled form, so you get no more e-mails from Every Debut. You can come back only by confirming again yourself: with the button in a new confirmation e-mail (we send at most one such e-mail per 30 days after an unsubscribe), or while signed in to your account on everydebut.com.
• If someone else entered your address: every confirmation e-mail has a second button, "It wasn't me — don't e-mail me again". It blocks the address (and its +tag variants) on all our sites for good.
• If an e-mail to the address bounces or someone marks one as spam: the same scrambled form, so the address is never e-mailed again by any of our sites.
• If you subscribe through your account on everydebut.com, we record that your address was already confirmed by your sign-in code instead of sending a confirmation e-mail.

We ask only for your e-mail address.

Why: to send the e-mails you asked for, to be able to show that you asked for them, and to stop people from signing up addresses that are not theirs or flooding the form (that is what the scrambled IP address is used for). We rely on your consent; you can withdraw it at any time.

How long

• Never confirmed: the request is deleted after 30 days.
• Active subscription: until you unsubscribe.
• After you unsubscribe (or the address bounces or is reported as spam): the address itself is deleted within 30 days. The scrambled form stays, so we know not to e-mail it. The consent record is kept for 3 years after that, as proof of what you agreed to, then deleted.
• The log of sent e-mails is deleted after 6 months.
• Our daily backup copies of the list are kept for 14 days.

Who helps us: Amazon Web Services (Amazon SES) delivers the e-mails; Cloudflare Turnstile checks that the sign-up form is used by a person and not a bot. It loads when the form comes into view and looks at technical information from your browser. The list lives in a database on our own server. We never sell it, share it or use it for advertising. Our e-mails contain no tracking pixels and no tracked links: we do not know whether you open them or what you click.

How to unsubscribe: every new-page e-mail has an "Unsubscribe" link at the bottom; one click is enough. Most mail apps also show an "Unsubscribe" button next to our address. You can also reply to any of our e-mails or write to the address below and we will take you off the list. If you never confirm the first e-mail, you are not subscribed and nothing else is sent.

Contact

Every Debut, 990 Peachtree Industrial Blvd #805, Suwanee, GA 30024, USA · hello@everydebut.com