Privacy Policy

shouldseethis.com is a curated directory of interesting, fun, useful, weird, and useless websites. We are an independent project, not a corporation. When we say "we", we mean the team behind shouldseethis.com.

For any privacy-related questions, email us at hello@shouldseethis.com.

A. Your Anonymous Identity (created when you give your first beer, pick a name or submit a website)

There are no accounts and no sign-up on shouldseethis.com. Visiting the site does not create an identity. When you give your first beer, pick a name or submit a website, we create an anonymous identity for your browser:

• A random session token, kept in a cookie in your browser. We store only a hash of it (a one-way fingerprint), never the token itself
• A random internal ID for your identity, plus when it was created and last used
• Which websites you've given a beer (our like system). That list is only shown to you; everyone else sees only the public total for each website
• Optional: a display name you choose (2 to 32 characters, and unique)
• Optional: if you create a recovery link, a hash of its secret key. The link is shown to you once and we cannot recover it for you
• Optional: if you add a passkey, its public key, its ID, a sign-in counter and the nickname you gave it. Your fingerprint, face or PIN never leave your device

B. Websites You Submit

When you suggest a website on the Submit page, we store what you typed in the form, tied to your anonymous identity:

• The website's address, title, category and description
• Whether you ticked that you made the website yourself
• Optional: a note to the site owner (up to 500 characters). It is private: only the site's admins see it in the review queue, and it is never published
• Optional: a screenshot (PNG, JPEG or WebP, up to 2 MB). It is kept in Cloudflare storage and only the site's admins can see it; it is not shown publicly
• Optional: a display name. If your identity has none yet, the name you type in the form becomes your display name (see Section 2A)
• When you submitted it, whether it is pending, approved or rejected, when it was reviewed, and the reason if it was rejected (you can see that reason on /me/)

Submissions are reviewed by hand. An approved submission becomes a normal listing on the site and is linked to your identity. Listings are public; your note and screenshot are not. Our admins' review actions are logged internally with the internal ID of the admin who took them.

C. Usage Data (via Analytics)

• Pages visited and time spent on each page
• Referring website (how you found us)
• Browser type, operating system, and screen size
• Country-level location (not precise location)
• Clicks on website links and navigation elements

Analytics data is aggregated and anonymized where possible. We use it to understand which websites people love and improve the site. We do not build individual profiles.

D. Advertising Data

We display ads to help keep the site free. Our advertising partners may use cookies and similar technologies to show you relevant ads based on your browsing behavior across websites. This is standard practice in online advertising. See Section 6 for how to opt out.

E. Security Data

To keep bots and abuse out, we limit how often requests can be made. For that we make a hash of your IP address mixed with a secret salt and the current date (UTC), so the hash changes every day and cannot be matched across days. We do not store your raw IP address in our database. We keep only counters tied to that hash (or, for beers, name changes and submissions, to your internal identity ID). The first time you give a beer, pick a name or submit a website, Cloudflare Turnstile checks that you are a person; Cloudflare receives your IP address for that check (see Section 5).

F. What We Do NOT Collect

• Your email address or a password (we don't ask for either)
• Your real name (a display name is optional and can be anything you like; if you choose one, it is public, see Section 3)
• Fingerprint, face or other biometric data (passkeys are checked on your own device)
• Phone number
• Precise GPS location
• Payment information (we don't sell anything directly)
• Your browsing history outside of shouldseethis.com

• Beer feature: to remember which sites you've beered and display accurate public totals
• Identity: to recognise your browser on your next visit, and to let you come back on another device with a recovery link or a passkey
• Submissions: to review the websites you suggest, to show you their status on /me/, and, once one is approved, to publish it and credit you by display name if you have one
• Abuse prevention: to rate-limit requests and keep bots out (IP hashes and Turnstile)
• Analytics: to understand site usage, improve curation, and fix broken things
• Advertising: to display relevant ads that help fund the site
• Communication: if you contact us, to respond to you

We do not:

• Sell your data to third parties
• Use your data to send you marketing emails (we don't have a mailing list unless you subscribed)
• Show anyone else which websites you've beered: the public sees totals only
• Publish your note to the site owner or your screenshot

What is public:

• Your display name, if you have one, appears on the page of every website listed from your submissions (as "Submitted by …"), and on the Top Submitters page (/top-submitters/) when those listings have collected beers, next to the total beers and the number of listings. If you have no display name, you are not named anywhere
• The pages of the site are generated ahead of time, so a new, changed or removed name shows up on a listing page the next time the site is rebuilt. The Top Submitters page first shows a snapshot taken when the site was last built, so a name can stay there until the next site rebuild; it then refreshes its ranking live (cached for a few minutes)

Strictly necessary:

• __Host-sst cookie: our identity cookie. It holds the random session token described in Section 2 and nothing else. It is HttpOnly (page scripts cannot read it), Secure and SameSite=Lax, and lasts 400 days. It is set when you give your first beer, pick a name or submit a website, restore a recovery link or sign in with a passkey, and removed when you sign out
• sessionStorage entry: the public Cloudflare Turnstile site key, kept for the life of the tab so the bot check does not have to look it up again

Analytics cookies:

• Set by our analytics provider to distinguish unique visits and measure traffic
• Typically expire after 2 years

Advertising cookies:

• Set by advertising partners, including Google AdSense, to serve relevant ads
• Used to measure ad performance and prevent showing the same ad repeatedly
• You can opt out — see Section 6

• Personalized ads: Visit aboutads.info or the National Advertising Initiative opt-out page to opt out of interest-based ads
• Google Analytics: Install the Google Analytics opt-out add-on
• Cookies: Use your browser settings to block or delete cookies (note: deleting the identity cookie signs this browser out of its anonymous identity, and the only way back in is a recovery link or a passkey)
• Beers: Click a beer again to take it away
• Sign out: The Sign Out button in Your Cabinet (the /me/ page) deletes this browser's session from our database and clears the cookie
• Deletion: To delete your identity, email us at hello@shouldseethis.com with the ID shown on the Your ID line in Your Cabinet (the /me/ page). That ID is not public, so it shows the request comes from you. We then delete the identity: its beers (they come off the public totals), display name (the name is free for anyone to take), passkeys, recovery-link hash, sessions and all of your submissions (pending, approved and rejected, including your notes and screenshots). Websites already published from your submissions stay on the site, but without your name attached; pages already generated may show the name until the next rebuild. This cannot be undone. We hold no email address for you, so we cannot delete an identity by display name or email: only the ID works

• Your anonymous identity, its beers, display name, recovery-link hash and passkeys are kept until you ask us to delete the identity (see Deletion above; you can also take away individual beers and passkeys yourself)
• A submission (its details and your private note) is kept after review until your identity is deleted. A screenshot is kept while the submission is pending. Screenshots of reviewed submissions are scheduled for deletion 30 days after review. Deleting your identity removes your screenshots immediately, pending or not. In rare cases of a storage error, removal can take longer
• A browser session expires 400 days after it was created; signing out deletes it straight away. Expired sessions are then deleted automatically, usually within a couple of days
• Rate-limit counters (tied to a daily IP hash or to your internal identity ID) and expired sign-in challenges are deleted automatically, usually within a couple of days
• Analytics data is retained per our analytics provider's policy (typically 26 months)

shouldseethis.com is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this policy occasionally. Significant changes will be noted with a new "Last updated" date at the top. Continued use of the site after changes constitutes acceptance of the new policy.

For any privacy questions or concerns, email us at hello@shouldseethis.com. We aim to respond within 5 business days.