Privacy policy

Last updated: 9 October 2026.

This policy covers everything at bunny.directory: the site, the dashboard, the free tools, the email we send you and the MCP endpoint. The controller responsible for it, and the address to write to, are in section 10.

1. What we collect

What you give us. Your email address and password, stored hashed and never in the clear — or, if you sign in by magic link, just the address. A display name and an avatar if you set one. Everything you submit: launches, logos, screenshots, comments, claims, report messages, newsletter sign-ups, and whatever you write to us in an email.

What a purchase creates. A Quick pass is paid through Stripe, which collects and holds your card details; we never receive them. We send Stripe the email address on your account, to fill in the checkout, and which listing the payment is for. What comes back to us is the checkout session reference, the amount, the currency and the status, the name and email address given at checkout — which we use to match the payment to your account and listing — and any refund or dispute against it. Stripe also records that you accepted our Terms at checkout. Your billing address and tax details, where required, stay with Stripe, which issues the receipt and the invoice.

What is public by design. A published launch and its content, your display name and avatar beside a launch or a comment, and the carrots (upvotes) a launch has collected. Treat anything in a listing as published to the world, search engines and AI crawlers included.

What we collect automatically. Server logs — IP address, user agent, the URL requested, timestamps, error traces — kept for security and debugging. A session cookie once you sign in. Aggregate analytics: page views, referrers, approximate country, device class. Counts that feed ranking: listing views, upvotes, streak days, and reads of our MCP endpoint. Rate limiting keeps short-lived counters keyed to an IP address.

What we fetch about a submitted product. When a launch is submitted we visit its URL to take a screenshot and read publicly available details about the product. That is a request to a public website rather than a collection of your personal data, but it is worth knowing it happens.

We do not knowingly collect special-category data, and none should be put into a listing or a comment.

2. Why we use it, and on what basis

• Running your account and publishing your launches — performance of the contract in our Terms of Service (Art. 6(1)(b) GDPR).
• Taking payment, issuing receipts, handling refunds and disputes — contract, and our legal obligation to keep accounting records (Art. 6(1)(b) and (c)).
• Service email — sign-in links, receipts, review outcomes, badge warnings, expiry notices: contract. Not marketing, and not switchable off while you hold a listing or an account.
• Newsletter and product announcements — your consent, withdrawable any time from the unsubscribe link in every such email (Art. 6(1)(a)).
• Moderation, anti-fraud, anti-manipulation and security — our legitimate interest in a directory that is not gamed (Art. 6(1)(f)).
• Analytics and improving the site — your consent where local law requires it for the cookies involved (the EEA, the UK and Switzerland, where the tag stays denied until you accept), and legitimate interest in aggregate measurement everywhere else (Art. 6(1)(a) and (f)).
• Bringing or defending legal claims — legitimate interest (Art. 6(1)(f)).

We do not sell personal data, we do not pass it to data brokers, and we do not use it to train models.

3. Cookies, and the choice you get

We use a small number of cookies and similar local storage. The session cookie that keeps you signed in, and the cookies that protect forms from abuse, are strictly necessary and cannot be turned off without breaking the site. Your browser can block or clear any of them; blocking the necessary ones means you cannot stay signed in.

Analytics is the only optional part, and today the site ships without an analytics tag at all. When one is switched on it runs under Google Consent Mode: in the EEA, the UK and Switzerland it starts denied and stays that way until you accept on the cookie banner, so nothing is stored on your device for analytics before that. Elsewhere it starts granted and "Essential only" on the banner turns it off. The choice is kept on your own device, and "Cookie settings" in the footer takes it back at any time. Advertising signals are denied for everyone, always.

We set no advertising or cross-site tracking cookies, and we show no adverts.

When you pay, you do so on Stripe's own checkout page, which sets its own cookies to take the payment and to prevent fraud, under Stripe's privacy policy.

4. Who processes it for us

Each provider is bound by a data processing agreement and gets only what its job needs:

• Hosting and database — a virtual server in the EU running the application and its Postgres database.
• Stripe — payments, refunds, disputes, receipts and invoices. For its own purposes, such as preventing fraud and meeting its legal duties, Stripe decides how it uses payment data as a separate controller, under its own privacy policy.
• Resend — transactional and newsletter email; beehiiv where the newsletter is mirrored to it.
• Object storage (S3-compatible) — logos, screenshots and uploaded images.
• Google Analytics 4 or Plausible Analytics — aggregate traffic measurement, if and when one is configured. Neither is running today.
• Screenshot and page-reading services — capturing a listing's screenshot and reading its public page.

Beyond those, we disclose data only where the law requires it, where it is necessary to investigate abuse or fraud, or where a business transfer moves the Service to a new operator — in which case this policy travels with it and you will be told.

5. Transfers outside the EEA

Some of those providers are established in the United States or process data there. Those transfers rely on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the provider is certified under it. Ask and we will tell you which mechanism covers which provider.

6. How long we keep it

• Account data — while the account exists, then deleted or anonymised within 30 days of closure.
• Published launches — while they are published. A deleted listing is removed from the site; copies may survive in search-engine caches and web archives we do not control.
• Orders and invoices — five years from the end of the accounting year, because Polish tax law requires it. This survives account deletion.
• Server logs — up to 90 days.
• Email records and support threads — up to 24 months.
• Moderation records of a ban or a fraud finding — as long as the decision needs to stay enforceable.

7. Your rights

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, or have it handed to you in a portable format. Where we rely on consent you can withdraw it at any time, which does not affect what was lawful before. Where we rely on legitimate interest you can object, and we stop unless we have grounds that override yours.

Write to [email protected]. We answer within 30 days. We may ask you to confirm you control the account's email address first — not to obstruct, but because handing an account's data to the wrong person is the worse failure.

If you think we have got this wrong, complain to the Polish supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw — or to the authority where you live.

8. Security

Traffic is served over HTTPS. Passwords are stored hashed. Access to the server and the database is restricted to the operator. Card data never reaches our systems: payments are handled by Stripe, which is certified to PCI DSS Level 1. No service is perfectly secure and we will not claim otherwise; if a breach affects your data and is likely to put you at risk, we will tell you and the supervisory authority, as the GDPR requires.

9. Children

The Service is not for anyone under 16. We do not knowingly collect their data and we delete an account we learn belongs to a child.

10. Who is responsible

The controller of personal data collected through bunny.directory is Piotr Boroń, conducting unregistered business activity under Article 5 of the Polish Entrepreneurs' Law Act of 6 March 2018, al. Solidarności 68/121, 00-240 Warsaw, Poland. Contact: [email protected] — the same address as every request in section 7.

The Service is operated from Poland and falls under the General Data Protection Regulation (GDPR). There is no data protection officer; the operator handles these requests directly.

11. Changes

We may update this policy. The date at the top says when it last changed, and material changes are announced by email or on the site before they take effect.