Privacy Policy

The short version

QuestStack measures site visits, tool discovery, outbound clicks and maker activity by default using twelvebit and its own analytics, plus Google Analytics when configured. It also stores an attribution record in your browser.

Vendor links are direct; see the link policy.

Information we handle

• Maker accounts: signing in stores your email address, verified status and session records. We store the listing content you submit and its ownership, bump history and moderation records to operate the directory. Your email address is not displayed on the public listing.
• Essential request and security data: hosting and security systems may process IP address, request time, requested path, and browser information to deliver and protect the site.
• Tool page views: when a tool page loads, your browser asks us to count one view. We count at most one view per visitor, tool and day, without a cookie. To do this we store a keyed hash of your IP address, browser information, the tool and the date, with the tool ID and time. The hash changes every day, and we do not store the raw IP address. Known bots, prefetches and the listing owner’s views are excluded. View records are retained for 35 days through scheduled cleanup. Only a sitewide 30-day total is public.
• QuestStack Chrome extension: the extension reads the address of the current tab only when you click its icon. It sends the host name of that address, such as notion.so, to QuestStack to look up the tool. It does not send the full address, page content or cookies, and it stores nothing in your browser. QuestStack does not keep these lookups. Our hosting and security systems process each request like any other request, as described above.
• Human verification: when you request a sign-in link, publish a tool or request a free bump, Cloudflare Turnstile processes browser and network signals to help detect automated requests. We validate its response on our server and keep temporary per-account request counters. This security check operates independently of analytics.
• Outbound measurement: a random 24-hour cookie helps deduplicate clicks per tool in fixed ten-minute buckets. We store a keyed hash, tool ID, time and a bounded source label, not raw IP addresses or the cookie value in click records. Known bots, prefetches and the listing owner’s clicks are excluded. These are filtered click events, not unique visitors or sales. Raw click records are retained for 35 days through scheduled cleanup. Sitewide 24-hour totals are public; per-tool 7/28-day totals are private to its owner.
• Google Analytics: if configured, Google Analytics may receive page views, interaction events, page titles, and general browser or device information. Page URLs are reduced to the path and an approved set of UTM campaign parameters; arbitrary query parameters such as email addresses, tokens, and search values are removed.
• twelvebit analytics: twelvebit receives page views, selected tool links, completed shortlists and successful listing actions, along with referral, device and approximate location data. It uses first-party visitor and session cookies to measure visits. We do not send email addresses or names in event properties.
• Attribution: we create a random visitor identifier and remember first- and last-touch source, medium, campaign, external referrer host, a sanitized landing path, and time. This record is stored in your browser for up to 90 days.

Why we use it

We use analytics and attribution to understand which pages are useful, how visitors discover tools, and how to improve recommendations. We use other data to operate, secure, and troubleshoot QuestStack.

Service providers and transfers

QuestStack uses hosting and security providers, Google Analytics and twelvebit. These providers process data for the services they supply and may process it in countries outside yours under their contractual and legal transfer safeguards. We do not sell personal data.

• Cloudflare privacy policy
• Google privacy policy
• twelvebit privacy information
• Vercel privacy policy

Retention and your choices

Browser attribution expires after 90 days. Analytics and operational records are retained only for the configured service period and as needed for security, accounting, or legal obligations.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal data, and to object or complain to a data-protection authority. Email [email protected] for requests about your data or analytics.

Security, children, and changes

We use reasonable technical and organizational safeguards, but no internet service can promise absolute security. QuestStack is intended for adults looking for useful software and is not directed to children. We may update this notice when our practices or providers change; material changes will be reflected by a new effective date.