Privacy policy

When you browse

• Analytics. We count visits with a self-hosted Plausible instance. It sets no cookies and does not store IP addresses or build profiles of individual visitors; we see totals such as page views, referrers and countries.
• Hosting and security. The site runs on Cloudflare, which processes your IP address and request details to deliver pages and block abuse.
• Theme. Your light or dark choice is saved in your browser's local storage and never sent to us.
• Free tools. Image tools such as circle crop work inside your browser; your images are not uploaded. Tools that check a website fetch the URL you enter from our server and do not store your details.

When you sign in

• Google sign-in gives us your Google account ID, email address and name (scopes openid email profile). We use them to sign you in and to contact you about your listings and purchases. We get no access to your Gmail, Drive or other Google data.
• A sign-in cookie keeps you signed in for up to 60 days. A random browser identifier is kept in a cookie for two years.
• To enforce one free submission per person, we store salted, one-way hashes of the IP addresses and browser identifiers you use. We do not store the raw values.

When you submit a tool

• We keep what you send: the tool's name, website, description, category, images and your contact email.
• Cloudflare Turnstile checks that you are a person; it processes browser signals under Cloudflare's privacy policy.
• To draft the listing we read the tool's public website and send that text to OpenAI's API with a hashed identifier, never your name or email. OpenAI does not use API data to train its models.

When you buy credits

Payments are handled by PayPal. We receive the order and payment IDs, the payer email, the amount and the payment status; we never see card or bank details. We keep your credit history so your balance stays correct.

Who processes data for us

Cloudflare (hosting, database, file storage, Turnstile), Google (sign-in), PayPal (payments), OpenAI (drafting listings) and Fastmail (our support email). They may process data outside your country, including in the United States. We do not sell personal data or use it for advertising.

How long we keep it

• Account data, submissions and credit history: while your account is open.
• Rate-limit records: deleted automatically after a short window. Network hashes used for the free-submission check look back 90 days.
• Payment records: as long as tax and accounting law requires, even after an account is closed.
• Published listings describe products, not people, and stay up under our terms.

Your choices and rights

You can ask for a copy of your data, a correction, or deletion of your account by emailing support@ordalin.com from the address on your account. We reply within 30 days. If you are unhappy with our answer you may complain to your local privacy regulator; in Australia that is the OAIC.

Ordalin is not meant for children under 16, and we do not knowingly collect their data.

Changes

We will update the date at the top when this policy changes, and email account holders about material changes.