Legal
Privacy Policy
Short version: an email if you sign in, a hashed network identifier for votes, no advertising trackers, and a delete button that works.
What this policy covers
This policy covers tier-list.org and the maker, vote panel, accounts and admin queue that run on it. It does not cover a third-party site you reach from a link.
What is stored
If you sign in: your email address, the time you created the account and the time you last signed in. If you save a list: the title, the board data and an edit token hash. If you vote: the item, the tier you chose and a hashed network identifier. If you use the site: coarse event counts such as “list saved” and “PNG exported”. Server logs may contain the request path, time and IP address for security and debugging.
What is not stored
No password (there is none), no social profile, no payment details (there is no checkout), and no raw IP address next to a vote. The vote identifier is an HMAC of the network address under a server secret; it cannot be reversed without the secret.
Cookies
One session cookie is set after a successful sign-in. It is HttpOnly, SameSite=Lax and Secure. There are no advertising cookies, no cross-site pixels and no third-party analytics script on the page.
Why it is stored
The email identifies an account and its saved lists. The hashed network identifier prevents one visitor from stuffing a vote. Event counts show which parts of the site are used. Logs are used to detect abuse and fix errors.
How long it is kept
Sign-in codes expire after five minutes and are deleted. Sessions expire after 30 days. Rate-limit counters are pruned after seven days. Event rows older than 90 days are removed on the daily maintenance run. A deleted account loses its email and sessions immediately; saved lists become unowned.
Third parties
Cloudflare hosts the Worker, D1 database and email delivery. Google Trends is queried for public trend data; no account data is sent with that query. There is no advertising network and no data broker.
Your choices
You can use the maker, vote and export a PNG without an account. You can delete an account from the account page. You can email the support address to ask what is stored or to request deletion if you cannot sign in.
Children
The site is not directed at children under 13 and does not knowingly collect their personal data. If you believe a child created an account, email the support address.
Changes
If this policy changes in a way that affects what is stored, the change will be dated on this page. A material change will also be noted on the about page.
Questions about this page: contact@tier-list.org.