Privacy

The short version

We keep as little as we can. We never store your network address; votes and visits are counted using a one-way hash that we salt and that can’t be turned back into an address. We don’t sell anything about you, and there are no advertising trackers on this site.

If you just read and vote

• A voting cookie, so one person’s votes can be told apart and the 12-hour wait works. It holds a random id, nothing about you.
• A salted hash of your network address, used for the same wait and to spot automated voting. The salt is ours and the hash is cut short. We never keep the address itself.
• Counts of page views and clicks, kept as daily totals per game. Each visit is counted against a hash of your address and browser that changes every day and is deleted after two days. The daily totals stay for two years.
• Whether you asked for light or dark, in your browser.

We don’t use any of this to build a profile of you, and it isn’t shared.

If you make an account

• From the service you signed in with (Discord, Google, GitHub, Apple or Steam): the id it gives us, your name there and your picture. From Google and Apple we also keep your email address when it’s verified. We never see your password for those services.
• If you set a username and password: the username, and a hash of the password made with scrypt. We can’t read your password.
• If you turn on two-factor sign-in: the secret for your app, encrypted, and the recovery codes as hashes.
• What you put on your profile: a name, a picture and a short description, if you add them.
• Sessions: a hash of your sign-in cookie, for 30 days. Signing out deletes it.
• Sign-in attempts on a username, for 15 minutes, so a password can’t be guessed at over and over.

If you list a game

Everything in the listing, who on your team changed what, the proof that the website is yours, and the keys your game uses to talk to us. If you buy a placement, Stripe handles the payment and we keep what it tells us about the order. We never see your card.

Who else is involved

• Cloudflare sits in front of the site, and stores the pictures people upload.
• Cloudflare Turnstile checks that a vote came from a person.
• Stripe takes payments for placements.
• Resend sends our email, such as password reset links.
• OpenAI checks what people send us for things like hate or threats, and drafts news articles that a person then edits. We don’t send it your account details.

Each of them only gets what it needs to do that job.

Cookies

Only the ones that make the site work: signing in, the voting wait, and the few minutes during a sign-in when we check the answer came back to the same browser. No advertising or analytics cookies, so there’s no banner to click away.

How long we keep things

• Visit rows: two days. The daily counts made from them: two years.
• Sessions: 30 days, or until you sign out.
• Sign-up tracking for a game: 31 days, then only the counts.
• News items we collected: 45 days unless they’re part of a story.
• Notifications: 90 days.
• Your account and what you wrote: until you ask us to delete it.

What you can ask for

Write to [email protected] and we’ll give you a copy of what we hold about you, correct it, or delete it. Deleting your account removes your votes, comments and pictures too. Where the law gives you more rights than this, those apply.

Children

Upvote100 isn’t for children under 13. If you think a child has made an account, tell us and we’ll remove it.

Changes

If we start keeping something new, we’ll say so here and change the date at the top before it happens.