The short version, first.

Last updated: September 22, 2026

What we collect

Standard server logs. When you visit MySaaSCards, our host records your IP address, browser user-agent, and the URL you requested. These logs exist for security, abuse prevention, and debugging. Cloudflare (our host) retains them for a limited window; we don't ship them anywhere else or analyze them for marketing.

Anonymous analytics. We use privacy-friendly analytics (Plausible / PostHog with no cookies) to see which pages are popular and where visitors come from. No personal identifiers are collected. No cross-site tracking. You can view our public analytics dashboard on request.

Submissions & contact forms. When you submit a SaaS via /submit or email [email protected], we retain the information you send us to process the submission and reply. We do not add you to any mailing list without explicit opt-in.

What we don't collect

• No account is required to use the site. There is no login system that would collect credentials.
• No third-party ad networks. No Facebook Pixel, no Google Ads tag, no LinkedIn Insight tag.
• No cross-site tracking cookies. No fingerprinting.
• No sale of personal data. No data brokers.

Cookies

The site uses a single localStorage entry to remember your dark-mode preference. That's it — it never leaves your browser. There is no cookie consent banner because there are no cookies that would require one under GDPR.

Third-party services

MySaaSCards embeds or calls out to a few third-party services. When you click an outbound link, the destination site becomes responsible for its own privacy handling. Specifically:

• Cloudflare hosts the site. See Cloudflare's privacy policy.
• Clearbit / Google Favicon serve product logos on card pages. Your IP is visible to those services when the logo image loads. Neither service is passed any additional identifying information.
• Affiliate links. When you click a "Visit" button on a card page that has an affiliate parameter, we redirect through /go/[slug] which then forwards to the merchant. The merchant may set its own cookies at that point.

Live Signals API calls

Live Signals fetches (GitHub, Hacker News, Reddit, Product Hunt, RSS) happen server-side from our Cloudflare edge functions. Your browser never talks to those APIs directly; only our server does. That means those third parties see our server's IP, not yours.

Data retention

Server logs: rotated per Cloudflare's default retention (30 days). Submissions: retained indefinitely for editorial reference; can be deleted on request. Contact emails: retained in our regular inbox until the thread is resolved and then archived per Google Workspace defaults.

Your rights (GDPR, CCPA)

You have the right to request access to any personal data we hold about you, to correct it, or to delete it. Since we don't collect much, most of these requests will resolve as "we don't have anything of yours to show, correct, or delete." Reach us at [email protected] with the subject line "Privacy request" and we'll respond within 30 days.

California residents have specific rights under CCPA/CPRA, including the right to know what personal data is collected and the right to opt out of data sale. We do not sell personal data, so the sale opt-out has no effect, but the right to know is honored via the same email process.

Children

MySaaSCards is not directed at children under 13. We don't knowingly collect data from children. If you believe a child has submitted data through our forms, contact us and we'll delete it.

Changes to this policy

If we make material changes to this policy, we'll update the "last updated" date at the top and, where material to existing users, note the change on the homepage for at least a week. Minor edits (typos, links) may happen without notice.

Contact

Privacy questions and requests: [email protected]. General questions welcome at the same address.