Privacy policy
We collect as little as possible, store no IP addresses, run no advertising trackers, and sell nothing.
Last updated: 1 October 2026
The short version
- We collect the minimum needed to run a leaderboard and a credit economy.
- We never store raw IP addresses.
- We set one cookie: your session. It is HTTP-only, Secure and SameSite=Lax.
- We run no third-party advertising or analytics trackers.
- We do not sell or rent your data to anybody, ever.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Username, email address, country (optional) | Account identity and account recovery | Life of the account |
| Password | Authentication — hashed with PBKDF2-SHA256 at 120,000 iterations, never stored in plain text and never transmitted anywhere after sign-in | Life of the account |
| Listing details (title, URL, descriptions, category, tags) | Displayed publicly on the leaderboard | Life of the listing |
| Visitor fingerprint hash | Deduplicating visits so one person is credited once per day | Indefinite as an aggregate; unlinkable to any individual after the day rotates |
| Country of visitor (derived from Cloudflare's edge, not from you) | Reporting a listing's audience by region | Aggregate only |
| Session record (session id, user agent, hashed IP) | Keeping you signed in and detecting hijacked sessions | 30 days, then deleted |
| Server logs | Security and abuse prevention | Retained by our hosting provider under its own policy |
What we do not collect
- Your raw IP address (it is hashed inside the request and discarded).
- Advertising identifiers or cross-site tracking cookies.
- Your browsing history on other websites.
- Payment information — the platform has no paid tier.
The visitor fingerprint, precisely
When you click a listing or arrive through a promotional link, we compute:
sha256(ip + user_agent + accept_language + utc_day + platform_secret)[0:32]Only the resulting 32-character value is stored. Because the UTC day is part of the input and the value is truncated, the stored hash cannot be reversed to an IP address and cannot be linked across days. We use it for exactly one purpose: refusing to award a second credit to the same person on the same day.
Cookies
- topwapi_session — required. Holds a signed token identifying your session. HTTP-only, Secure, SameSite=Lax. Expires after 30 days or on sign out.
- topwapi:theme — a local storage value, not a cookie, remembering whether you prefer light or dark. Purely cosmetic.
There are no analytics or advertising cookies.
Legal bases
Where GDPR or similar law applies: we process account data to perform our contract with you; visitor fingerprints and aggregate statistics under legitimate interests (operating a fair credit economy and preventing abuse); and any optional communications on the basis of your consent.
Your rights
You may request access to, correction of, or deletion of your personal data, and you may object to processing based on legitimate interests. Use the contact form with the subject "Privacy request". We respond within 30 days.
Data retention
Deleting your listing removes its promotional link and its click history. Closing your account removes your profile, listing and sessions. Aggregate statistics that no longer identify any individual may be retained to keep historical platform reporting accurate.
Sub-processors
TopWapi runs on Cloudflare (Pages, Functions and D1). Cloudflare processes request metadata on our behalf under its own data processing terms. We use no other sub-processor to handle personal data.
Security
All traffic is encrypted in transit with TLS. Passwords use PBKDF2-SHA256 at 120,000 iterations. Session tokens are HMAC-signed and stored in HTTP-only cookies. Database access is restricted to the application binding, and a Content Security Policy plus standard hardening headers are set on every response.
Children
TopWapi is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
Contact
For any privacy question: contact form, subject "Privacy request".