Privacy
Last updated: 2 September 2026
This page says exactly what Listicler collects, which companies receive it, and how long each kind of data is kept. It is written to be checkable rather than reassuring — if something below is vague, that is a bug, and the contact form is at the bottom.
Your choice about analytics
Google Analytics and Sentry session replay do not load at all until you allow them. Nothing about you reaches either company before you answer the banner, and declining is one click. We ask everyone, not only visitors in Europe: we cannot reliably tell where you are, and we would rather ask than guess.
Your answer is stored in your own browser, on this device only. Clearing your site data clears it, and we are asked again.
Who receives what
| Service | What it receives | Runs |
|---|---|---|
Google Analytics 4 Google Ireland Limited (and Google LLC, United States) Counting visits and seeing which pages people arrive on and leave from. Their privacy policy | Your IP address, browser and device details, the pages you open on this site, the site you came from, and a cookie that recognises your browser on later visits. | Only with your consent |
Sentry — error reports Functional Software, Inc., United States Telling us when the site throws an error, so it can be fixed. Their privacy policy | The error and the code that produced it, the page URL, your browser and operating system version, and your IP address. Roughly one page load in twenty also sends a performance timing. | Always |
Sentry — session replay Functional Software, Inc., United States Showing what happened on screen in the moments before an error. Their privacy policy | A masked recording of the page around an error, for about one error in ten. Nothing is recorded unless an error occurs. | Only with your consent |
Brandfetch Brandfetch AG, Switzerland Serving the product logos shown on tool and comparison pages. Their privacy policy | Your IP address, your browser details, and the fact that a Listicler page requested a particular company's logo. It runs on every page that shows a logo, because without it the page has no logos. | Always |
Railway Railway Corporation, United States Hosting the site and the database behind it. Their privacy policy | Every request you make to this site, including your IP address, as any web host must in order to serve a page. | Always |
Upstash Upstash, Inc., United States Holding the counters that stop one person flooding the forms or the click tracker. Their privacy policy | A hash of your network address as a counter name — not the address itself — and a number. Each counter deletes itself automatically; the longest-lived one is set to expire a little over two hours after it is created. | Always |
Affiliate networks and vendors The operator of whichever product you click through to Attributing a referral so this site earns a commission. | Whatever the destination site collects once you arrive, which is outside our control and governed by their policy. We send them nothing about you beyond the fact that the visit came from Listicler. | Only when you click through |
Fonts are served from this site, not from Google Fonts, so no request for a font leaves for a third party. There is no advertising network on this site and no data is sold to anyone.
How long each kind of data is kept
A job deletes and erases the rows below on the periods stated. Two honest details about it: the periods are what the job does when it is run, and nothing runs it automatically today — a person runs it, monthly. So treat the figures below as the rule we apply rather than as a countdown that starts the moment you close the tab. If that changes and a scheduler takes over, this paragraph changes with it.
| Data | What it is | Kept for |
|---|---|---|
| Page views — people | The page path, the referring site, your device type, browser and operating system. | 400 days, then deleted. |
| Page views — crawlers | The same, for requests that identify themselves as search-engine or AI crawlers. | 30 days, then deleted. |
| Affiliate clicks — people | Which tool link was clicked, from which article, and when. | 2 years, then deleted. Affiliate commissions are reconciled and disputed over a long tail, and this record is the evidence. |
| Affiliate clicks — crawlers | The same, for requests that identify themselves as crawlers. | 30 days, then deleted. |
| Affiliate clicks — suspected fraud | Clicks arriving from one network address on one product faster than a person clicks. Kept with the address intact, so a discounted click can be explained to the affiliate network. | 180 days, then deleted. |
| Network address (page views and clicks) | Stored as a keyed hash, never as the address. See “How we handle your IP address” below. | 90 days, then erased from the row, which is kept. Suspected-fraud clicks keep theirs for the 180 days above. |
| Full browser identification string | The long “user agent” string your browser sends. It is detailed enough to help single a person out, which the device and browser labels we keep are not. | 30 days, then erased. The device, browser and OS labels derived from it stay. |
| Contact messages and tool suggestions | Your name, email address, and whatever you wrote. | Kept until the request is dealt with and for 2 years afterwards, so we can pick up a thread you return to. Ask us and it goes sooner. |
How we handle your IP address
We do not store your IP address. We store a keyed hash of it: your address is combined with a secret key that only this site holds and with the current date, and the result is what goes in the database.
This is pseudonymisation, not anonymisation, and we are not going to call it anonymous. Anyone holding that key could work back from the stored value to an address, because there are only about four billion IPv4 addresses and checking all of them takes minutes. What the hash does buy you is real: the stored column on its own tells nobody anything, a database copy that leaked without the key would be useless, and because the date is part of the recipe, the same visitor on two days looks like two different people. Changing the key breaks every link to everything recorded before the change, and we can do that at any time.
Your unhashed address is still seen, in the moment, by the companies marked “Always” in the table above — a web host and a content delivery network cannot serve you a page without it.
What we collect ourselves
- Page views. The path you opened, the site you came from, and your device type, browser and operating system. Stored on our own database and never shared. This one is not behind the consent banner: it is first-party, it does not follow you off this site, the address is hashed, and it is the minimum needed to know which pages work.
- Affiliate clicks. When you click a link to a product, we record which product, from which article, and when, before sending you on. That record is how we know which articles are worth writing.
- What you send us. The name, email address and message on the contact and tool-suggestion forms. We use them to reply and to decide what to add to the site.
Affiliate links
Some links to products earn us a commission if you sign up, at no extra cost to you. That is disclosed on the pages where it applies. It does not change which products we recommend, and the click record described above is the only thing we keep about it.
Cookies and similar storage
The site sets no cookie of its own for visitors, and no cookie at all until you allow analytics. Your consent answer is kept in your browser's local storage rather than a cookie, so it is never sent to us. If you allow analytics, Google Analytics sets its own cookies, described in its policy linked above. Signing in to the admin area sets a session cookie, which applies to the site's operators and not to readers.
Your rights
Depending on where you live you can ask us for a copy of what we hold about you, ask us to correct or delete it, or object to us processing it. Ask through the contact form and we will answer.
One honest limitation: because addresses are stored as a keyed hash rather than as addresses, we cannot search the page-view or click tables for “your” rows from an address alone with any confidence, and the hash changes daily. In practice the retention periods above are the mechanism that removes that data, and they apply whether or not anyone asks — though, as that section says, someone has to run the job for them to take effect. Anything you sent us through a form — your name, email and message — we can find and delete on request.
Children
This site is for people choosing software at work. It is not aimed at children under 13 and we do not knowingly collect anything from them. Tell us if you think we have and it will be deleted.
Changes and contact
If this page changes, the date at the top changes with it, and a change to which companies receive your data resets the consent banner so you are asked again. Questions go through the contact form.