Privacy, in plain English.

Who operates the service

Alexander Zotz, trading as NeatLittleApps, operates this service and is responsible for the processing of your personal data. Address: c/o POSTFLEX PFX-375-297, Emsdettener Straße 10, 48268 Greven, Germany. For privacy questions or requests, contact support@neatlittleapps.com.

Information the service handles

• Sign-in: Accounts use Google, GitHub, or a verified email address through Supabase Auth. The app uses the Supabase account ID and email address to identify an account and its owner. Email sign-in uses a one-time code; you do not need to create a password.
• Product submissions: The service stores the product name, short description, website URL, category, pricing details, optional marketing methods, optional uploaded images, account owner ID, submission time, and review status. Older listings may also contain a longer description, maker or team name, and tags. Pending submissions are kept out of the public directory. Approved product details and images are public. An edit returns the listing to review.
• Images: Uploaded logos and screenshots are stored in Supabase Storage. If no logo is uploaded, the server may look for a logo on the submitted public website and store a discovered image with the product listing.
• Bookmarks and browser drafts: In the live service, bookmarks are stored against the signed-in account. The browser stores the selected theme and may store an unfinished listing or placement selection so it can be resumed. Demo bookmarks are local demo data.
• Page and link counts: For approved products, the app increments daily counters for profile views and outbound website-link requests. Those counter rows contain a product and date with totals; they do not contain an IP address or account ID. They are raw counts, not unique visitors or verified ad impressions. Hosting and security providers may keep separate operational logs.
• Site analytics: Vercel Web Analytics records visits and page views on this service, including client-side page transitions. The browser sends page-view data to Vercel for aggregate reporting. Vercel says the service does not use third-party cookies and does not associate analytics records with individual visitors or IP addresses. With your permission, Google Analytics 4 also measures page views, visit sources, completed sign-ins and registrations, submission steps, and sponsored-placement interest and purchases. Google receives cookie identifiers, technical browser information, cleaned page addresses and referrers, approved campaign labels, and event details. We do not send sign-in tokens, email addresses, form contents, or submitted app names to Google Analytics.
• Former traffic connections: Analytics connections for listed products have been discontinued. We no longer offer connections, retrieve provider reports, or display product traffic totals. Previously stored encrypted credentials and aggregate reports may remain in historical records until they are removed under our retention and deletion process. You can revoke the app’s previous access in your analytics provider’s account settings or contact support to request deletion.
• Human verification: The submission flow uses Cloudflare Turnstile. The browser communicates with Cloudflare, and the app sends the verification token to Cloudflare for server-side verification.

Optional paid placements

When bookings are available, Stripe Checkout handles payment and billing details. When a sign-in provider has made an email address available, the app sends that email and the booking details to Stripe; it stores booking, Checkout Session, payment-intent, amount, placement start and end times, and payment-status references. The app does not receive the card number. Tax calculation is handled in Stripe Checkout. If you accepted Google Analytics when starting checkout, a confirmed purchase is measured using the booking reference, package duration, price, tax, and your Analytics client and session identifiers. A return from checkout alone does not count as a purchase.

Support and submission notifications

Messages sent to support@neatlittleapps.com are forwarded by Cloudflare Email Routing to the operator’s Gmail inbox. The operator personally handles support, privacy requests, listing reports, and refund questions. Messages and attachments are processed by Cloudflare and Google for delivery and storage. Only send information needed to resolve your request; never send passwords, sign-in codes, or card details.

Supabase generates and verifies a one-time sign-in code. Cloudflare Email Sending delivers the code to the email address you enter. You do not need to create a password.

For a successful new product submission, a private queue stores the product name and website URL. If dispatched, a Cloudflare Worker uses Cloudflare’s Email binding to send those details and a link to the protected review queue to the operator. It does not include the submitter’s sign-in token.

Service providers

The code uses Supabase for sign-in, database records, and product-image storage; Google and GitHub for sign-in; Google for consent-based site analytics; Vercel for application hosting and site analytics; Cloudflare for Turnstile, DNS, email routing and delivery, and the prepared notification Worker; and Stripe for optional hosted checkout. The providers’ own systems may process technical data needed to provide their services. Provider locations, contract terms, and any international-transfer safeguards have not been verified.

Cookies and browser storage

The application uses authentication session cookies. It also uses browser storage for theme preference and to resume listing or placement drafts. Your Analytics choice is saved for 180 days. Google Analytics loads and uses its cookies only after you accept; its cookies are configured with a 180-day lifetime. After acceptance, session storage helps avoid counting the same submission step or checkout twice. Advertising storage, advertising personalization, and Google Signals are disabled by this integration. The app does not include advertising pixels or a marketing newsletter.

You can change your choice through “Analytics settings” in the footer whenever Analytics is enabled. Rejecting stops Analytics in this browser, removes its cookies and Analytics session storage, and cancels unsent purchase events associated with your signed-in account and browser identifier. It does not erase events already received by Google. Reloading completes the change.

Purposes, legal bases, and retention

We process account, listing, bookmark, placement, and payment information to provide the service you request and carry out steps before entering a contract (Article 6(1)(b) GDPR). If you act for a business that is our customer, we process your business contact information under our legitimate interest in administering that relationship (Article 6(1)(f) GDPR). The information required for sign-in, submission, or checkout is necessary to provide that feature; Google Analytics consent is not required for a free listing.

We process information needed for tax, accounting, and other legal duties under Article 6(1)(c) GDPR. Abuse prevention, account security, moderation, listing reports, essential operational notifications, and handling legal claims rely on Article 6(1)(f) GDPR. Our interests are keeping the directory secure, maintaining accurate listings, and resolving misuse or disputes. Support relating to your contract relies on Article 6(1)(b); other enquiries rely on our legitimate interest in answering and resolving them.

Google Analytics measurement and its cookies rely on your consent (Article 6(1)(a) GDPR). You can withdraw consent through “Analytics settings” without affecting earlier lawful processing. Aggregate service statistics support our legitimate interest in understanding directory use under Article 6(1)(f), insofar as personal data is processed.

Account details, bookmarks, and submitted listings are kept while the account and listing remain in use. You can request account or listing deletion by emailing support. We remove data that is no longer needed, while retaining only information required for an outstanding booking, a legal duty, or a specific dispute. Rejected submission content is deleted after 90 days from rejection unless needed for such an obligation or dispute. Resubmitting a listing returns it to review. Uploaded images are kept while referenced by a retained listing; unreferenced images are handled by the scheduled asset cleanup.

Resolved support correspondence is deleted 12 months after the request is closed unless it must be kept for a legal obligation or a specific dispute. Submission-notification copies in the operator’s inbox are removed when the related rejected submission is deleted, or when the listing is removed, unless still needed for one of those reasons. Retention reviews and privacy requests are handled manually by the operator; the 90-day and 12-month periods are not an automatic account-deletion feature.

Payment, invoice, and refund records are retained for the applicable statutory accounting and tax periods. Records needed for an unresolved transaction or legal claim are restricted to that purpose and kept until the matter and any required retention period end. The operator reviews completed submission-notification records together with the related listing. Hosting, email, payment, and authentication providers also retain operational records and backups under their own applicable policies and legal obligations; deleting an app record does not immediately erase every provider backup.

Google Analytics measurement relies on your consent. A private account marker distinguishes a new registration from a later login; it is removed if the account is deleted. Sign-in measurement receipts expire after five minutes and are consumed once. Analytics client and session identifiers are removed from the purchase delivery queue after successful dispatch, withdrawal, or expiry. Failed purchase events are retried for at most 72 hours after payment; unused checkout context is cleared by the scheduled cleanup after seven days. Delivery markers remain to prevent duplicate purchase events. Google’s own data retention is controlled by the Analytics property settings.

Your requests

For a privacy question or to request access, correction, restriction, or deletion, email support@neatlittleapps.com, preferably from your account email address. The operator handles requests personally and may ask only for information reasonably needed to verify your identity and locate the records. Do not send identification documents unless specifically requested through an appropriate secure channel. We respond without undue delay and normally within one month; if a lawful extension is necessary, we explain it within that first month.

Depending on the processing and applicable law, you may also have rights to receive a portable copy of your data and to withdraw consent. You may object to processing based on legitimate interests for reasons relating to your particular situation. You can complain to a data-protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the alleged infringement. A list of authorities is available from the European Data Protection Board.