Privacy

Last updated 1 September 2026.

This describes what buildinpublik stores, why, and what you can remove. It is written to be checked against the code rather than to sound reassuring.

What the tracking snippet stores

If you paste our snippet on your site, each pageview sends us one record. That record contains:

• the project id the snippet was issued for
• the path of the page, truncated
• the host of the referring site, host only, never the full referring URL
• a visitor day hash, which is a one way hash of the visitor IP address, the user agent string, the project id, the current UTC date, and a secret held on our server

We do not store the raw IP address. We do not store the raw user agent. The snippet sets no cookie and reads no cookie, and it stores nothing in the visitor's browser. The visitor day hash exists so we can count how many distinct people visited on a day without being able to identify any of them, and because the UTC date is part of the input, the same visitor produces a different hash tomorrow.

Being honest about the limit: the hashing secret is currently a single static value, not rotated daily. A daily rotation would make yesterday's hashes permanently unlinkable to today's. Until we rotate it, anyone holding both the secret and a candidate IP and user agent could confirm a guess. We are stating that rather than describing the hash as anonymous.

What a connected revenue provider gives us

If you connect Stripe, Dodo Payments, Polar, Paddle, or RevenueCat, you give us a read only key. We use it to read subscription and payment totals, and we store aggregates: monthly recurring revenue, the number of active paying subscriptions, a 30 day revenue total, and the currencies involved.

We do not store your customers. No names, no email addresses, no payment methods, no individual transactions, no customer identifiers. The key itself is encrypted before it is stored and is only ever decrypted inside the worker that calls the provider.

Your account

We store your email address, the OAuth handles you connect (GitHub, X), and the projects you create. Authentication is handled by Supabase. Sign in sets a session cookie, which is functional and not used for tracking.

Analytics on this site

This site uses PostHog to count page views, so we can tell which pages founders actually use. It records the page you are on, the referring site, your approximate location derived from your IP address, and your browser and device type, and it sets a cookie and a localStorage entry so repeat visits from the same browser count as one person rather than several.

We have turned off autocapture, so it does not record your clicks, keystrokes, or anything you type into a form, and we do not record sessions or replay them. PostHog is a processor for us and does not sell this data. If your browser sends a Do Not Track or Global Privacy Control signal, or you use a content blocker, this collection does not happen and the site works exactly the same.

This is separate from the tracking snippet above. That one runs on your site and measures your traffic for your rank. This one runs on ours.

What is public

A published project shows its name, tagline, website, rank, verified MRR, and paying customer count on the board, on its profile, on its share card, and on its badge. Unpublishing removes the public numbers: the project leaves the board and its profile, card, and badge stop showing rank, revenue, and customers. Your history stays in our database so that republishing does not reset your rank, and deleting the project removes it.

Contact

Questions, corrections, or a deletion request: reply to any email we have sent you, or open an issue on the repository.

For your own policy

If you paste our snippet on your site, you can paste this into your own privacy policy:

We use buildinpublik to count visits to this site. It records the page path, the referring site's host, and a daily one way hash of your IP address and browser, so that visits can be counted without identifying you.

It does not set cookies and does not store your IP address.

It does not follow you to other sites.

You can block it with any content blocker without affecting this site.