Privacy Policy
Last upadated on Thu Sep 03
Product Rally is operated by Craftwork, a company registered in the Republic of Armenia, which is the controller of the data described here. We collect as little as the site needs to work, we sell nothing, and we do not track you across the web. This page says exactly what is stored, where it sits and how to get rid of it. Questions and requests: hello@craftwork.design.
What we store
- Account. Your email, your name, your picture, the public handle your hunter page lives at, and the Google account id if you sign in with Google.
- Activity. The products you hunt, your votes, your comments, the invites you own and redeem, the claims you start, the products you bookmark, the problems you report.
- Emails you gave us. Newsletter subscribers and the waitlist.
- Pro status. Whether a subscription is active and until when. Card details never reach our servers: Lemon Squeezy is the merchant of record and handles the payment end to end.
Signing in
Two ways in, and both store as little as possible.
- Google. We ask for
openid email profileand nothing else, so we can read your email, your name and your picture at the moment you sign in. We cannot see your mail, your files or anything else in the account. The picture is copied once into our own storage and served from our CDN, never hotlinked from Google, and a photo you upload yourself is never overwritten by a later sign in. - A link in an email. The token behind it lives 15 minutes, is single use, and is stored hashed, so a leaked database gives nobody a way in.
Cookies
One cookie keeps you signed in: pr_session, 30 days, httpOnly, SameSite=Lax,
and Secure in production. The database holds only a sha256 of the token, never
the token itself. Two more cookies live for a few minutes during a Google sign
in to carry the PKCE verifier and the state check. That is the whole list.
Local storage holds two things of ours: whether the newsletter popup already asked you (45 days) and whether the admin left the inline controls on. No third-party advertising cookies, ever.
Analytics
PostHog, on their EU cloud, reached through a path on our own domain
(/ingest) rather than a third-party script host. We look at which pages get
read and which buttons get used, to make the product better. We do not build
advertising profiles and we do not sell or share the data.
Bot protection
The waitlist, the sign-in form and the sponsor booking form run a Cloudflare Turnstile check. Cloudflare receives the challenge token and your IP address to tell a person from a script. It is not used for anything else.
Where the data sits
| Who | What they hold | Where |
|---|---|---|
| Neon | the database | Frankfurt, EU |
| Vercel | hosting and logs | EU and US edge |
| Bunny | images and uploads | Frankfurt, replicated to New York, Los Angeles and Singapore |
| Resend | outgoing email | EU and US |
| Cloudflare | DNS and Turnstile | global |
| PostHog | product analytics | EU cloud |
| Lemon Squeezy | payments, merchant of record | US |
The database itself never leaves Frankfurt. Image files do: covers, product logos and account photos are replicated to the United States and Singapore so they load quickly, which means those files are transferred outside the EU. Card data and invoices are handled by Lemon Squeezy under their own policy.
What is public
Your name, your picture, your handle, the hunts you posted and the comments you wrote. A hunter page exists only once you have a published hunt. The launch badge is a public image anyone can embed, and it shows the product and its vote count.
Never public: your email, who invited you, whom you invited, and what you voted for. The vote counter is a number, not a list of names.
How long we keep it
- Sessions expire after 30 days, and signing out drops them at once.
- Sign-in link tokens die after 15 minutes.
- Unsubscribing keeps the row with the date, so that we can prove you asked and never mail you again. Resubscribing clears it.
- Sensitive admin actions and a self deletion are written to an audit log, and that record keeps the email address it acted on. We keep it because a club that hands out membership has to be able to answer for it.
Deleting your account
The button is on /dashboard, and it works immediately without asking us.
It removes your account, your votes and every open session. Products you hunted
stay on the board without your name on them, because other people’s votes,
comments and collections are built on top of them.
If you want the audit record gone too, or a copy of everything we hold, write to hello@craftwork.design and we will do it by hand.
Your rights
Ask us for a copy of your data, a correction, a deletion or an export, or object to a use of it, at hello@craftwork.design. We answer within 30 days. If we ever say no, we will say why. Our registration details are available on request to anyone who needs them for a complaint.
Age
Product Rally is not meant for anyone under 16, and we do not knowingly keep accounts for them.
Changes
We will announce a meaningful change on the site rather than quietly editing this page.