No passwords
You sign in with X, GitHub or LinkedIn. Your password never touches this site. We get back a handle, a display name and an avatar. Enough to know it’s you next time, nothing more.
Privacy
What we keep
We keep very little: a handle and your votes.
Votes aren't tied to your IP address
Signed in, a vote is stored against your account. Signed out, it’s stored against a one-way hash of a random number in your browser. Neither holds an IP address. No column in this database does.
A cookie only when you vote
Reading the boards sets nothing. The first time you vote while signed out, we write sixteen random bytes to a first-party cookie, so the same browser can't vote twice on one listing. Sign in first and you never get one.
No fingerprinting
No canvas probe, no font list, no screen-size profile, no device graph. Your anonymous identity is a random number we gave you. Clear the cookie and we can't recognise you.
Listings use public info only
Names, handles, avatars, repos, follower counts, star counts: all read from public sources anyone can open. A contact address only appears if the person published it themselves, in their bio or on their site. Nothing is inferred, and nothing is bought from a data broker.
Analytics
Page analytics run through Google Tag Manager, and only on ailead.space itself. Preview builds and local copies carry no analytics. It counts pages, not people.
We never see your card details
Stripe handles payments. Card numbers, the name on the card and any billing address go to Stripe under their privacy policy. They are never sent to or stored by this site. We keep the payment’s reference numbers, the amount, the currency and its status. Enough to say what was bought and when, and nothing that identifies you beyond your account.
Delete your account any time
Delete your account and your profile goes with it. Your votes stay on the boards with your name removed. That’s on purpose: if leaving undid every vote, anyone could rewrite a board by leaving.
What we store
Just reading the boards stores nothing.
Your account
A handle, a display name, an avatar link, and the day you joined. The email you signed in with stays in the sign-in system and is never shown on the site.
Your votes
Which listing, when, what the vote counted for, and one identity: your account, or the hash. Set-aside votes are kept, not deleted, so a wrong call can be undone.
What you typed
A submission is what's on the form: a name, a link, a line, and a contact address where the board asks for one. A claim also keeps the proof you gave, so the decision can be checked again later.
Your purchases
What was bought, when, for how much, and the payment provider's reference. No card number, no billing address, no name on the card. Those stay with Stripe and are never sent here.
Nothing else
No location, no device profile, no record of which pages you read, no profile built across other sites. Nothing is sold to anyone.
The cookies
Three at most, and two need you to do something first. A voting cookie appears the first time you vote while signed out, and lasts a year. A session cookie appears when you sign in and goes when you sign out. Google’s analytics cookies come with the tag manager on the live site. Read the boards without voting or signing in and the site sets none of its own.
Who else sees it
Six services, one job each. None is an ad network, and none is paid in data.
Supabase
The database, and the sign-in in front of it. Every row on this page lives there.
Vercel
Serves the pages and keeps the ordinary server logs every host keeps. Those logs are the one place a raw IP address exists. They aren’t part of the site’s own data.
Stripe
Takes the payment for a featured spot, and is the only one that sees a card. It holds the cardholder’s details under its own policy. This site keeps only the reference and the amount.
Vercel AI Gateway
Reads the words you write on your own listing once, before they go live, to check for spam and abuse. Only that text is sent, and it’s text meant for a public page. The model provider makes no promise not to train on it.
Google Tag Manager
Counts pages on the live site. It’s the only third-party script on the page.
X, GitHub, LinkedIn
Whichever one you pick signs you in and hands over a handle, a name and an avatar. Their own policies cover their side.
We don’t report your visits to anyone
The numbers behind a rank are collected on a schedule, from a server, from public APIs. The same call for everyone, whether or not anyone is reading. Which pages you open is never reported to the platforms a listing was measured from.
Your own listing
Every listing is built from public numbers, and a listing about a person matters most here. The fastest way to change one is to claim it. Proving it’s yours gives you the name, the words, the logo and the takedown. The website and handles stay ours to correct, because they’re what the listing is measured on. Ask, and a person will. What you can do with a listing once it’s yours is on the terms page.
Contact
Questions, corrections, or a listing you want taken down: DM @prateekkathal on X. That’s also the route when a listing is yours but has no channel you can prove.
Last changed 28 August 2026