Privacy

The short version

You can swipe on Roasty without telling us anything. We don't run advertising trackers, we don't sell anything to anyone, and we never store your IP address.

Cookies

Two, both ours, both set to be unreadable by scripts:

• A voting cookie — a random id, kept for a year. It is how the deck knows you have already judged a card, and it is not tied to a name or an address unless you sign in.
• A sign-in cookie — only if you make an account. It holds your account id and an expiry, signed so it cannot be edited, and lasts 60 days.

No third-party cookies, and nothing from an ad network. The tiles beside the deck are plain links we host.

What gets recorded

• Your swipes — which card, roast or toast, and the voting cookie that cast it.
• Pages and clicks — the path you visited without its query string, and the host of the site that sent you, never the full link. Kept 60 days, then deleted.
• Your network, as a fingerprint — we take your IP address, mix it with a secret and hash it, and keep only the hash. It lets us spot one person voting a hundred times. The address itself is never written down, and the hash cannot be turned back into one.
• Your account, if you make one — your email address, and the name and picture Google gives us if you sign in that way.

Founders and their addresses

The deck is built from launches published on Product Hunt, Indie Hackers and Y Combinator. When we add a startup we look for a contact address the same way anyone could: on the product's own website, its launch page, or the contact and legal pages it links to. We use it for one thing — telling the founder their startup is being judged here and how it is doing.

Every one of those emails has a one-click unsubscribe, and it works immediately. If you would rather the card was not here at all, email us from your company domain and it is gone within a day, no questions asked.

Who else sees it

• Payments go through Stripe. Card details are typed on Stripe's page, not ours — we never see or hold them. We keep what Stripe tells us: the amount, the reference, and the email you paid with.
• Email goes out through Resend, Brevo, SendGrid, MailerSend or Mailjet, whichever has room that day.
• The site runs on Vercel, with the database on Supabase in the EU.
• We post a daily verdict on X naming the most roasted and most toasted startups, and tagging the public handles listed on their launch pages.

Nobody buys this data from us, because we do not sell it.