Privacy Policy

1. Who is responsible for your data

listofwebsitesusing.com is published by Shared Authority, a business run by Syed Kashif and Bilal Javed in Pakistan. For the purposes of data-protection law, Shared Authority is the data controller for the personal data described below.

Questions, requests and complaints about privacy all go to the same place: hello@listofwebsitesusing.com.

2. What we collect, and when

If you only browse the site

You can read every public page without an account and without identifying yourself. That includes the network lists, the niche pages and the methodology. What we do record is the minimum needed to keep the service standing up:

• Your IP address and the time of the request, used to enforce rate limits. These are stored as short-lived counters against a time window, not as a browsing history, and they are not linked to any account.
• Ordinary server logs generated by our host and our CDN: IP address, user agent, the URL requested, the response status.

We do not build a profile of you, we do not follow you between sites, and we do not record which listings you looked at.

If you create an account

• Your email address. It identifies your account, it is where security notices go, and it is how you reset your password.
• Your password, as a one-way hash. Password handling is managed by our authentication provider. We cannot read your password, and neither can anyone with access to our database.
• Your plan and role, meaning whether the account is free or Pro, and the date the account was created.

If you subscribe to new-site alerts

The alert list is separate from an account, and joining it does not create one. We store your email address, which networks you chose to follow, which kinds of email you asked for, and the date, time and IP address of the request. That last part is the record of your consent: if you ever tell us you did not sign up, it is how we can check rather than argue.

Nothing is sent until you confirm. Signing up stores the address as unconfirmed and sends one email containing a confirmation link. If that link is never clicked, you never hear from us again. This is what stops somebody else entering your address and starting mail you did not ask for.

Every alert carries a one-click unsubscribe link, and your mail client's own unsubscribe button works too. Unsubscribing marks the address as opted out and keeps that record rather than deleting the row — deleting it would lose the fact that you asked us to stop, and the next time the address was entered it would be added again. If you would rather the record went entirely, ask us and it will be erased.

If you subscribe to Pro

Payments are handled entirely by Lemon Squeezy, which acts as the merchant of record. Card numbers and billing addresses never reach our servers and we have no way to retrieve them. What we store is only what we need in order to know your subscription is valid: a customer reference, a subscription reference, the plan status, and the date the current period ends.

If you export data as a Pro subscriber, we record the export: the time, how many rows, and the filters used. That is how the monthly allowance is counted, and how we spot a single subscription being used to bulk-copy the database.

Analytics, if you accept it

If you accept analytics in the banner, we record which pages were viewed, how long the page was open, how far down it was scrolled, which site you arrived from, and whether the page showed you a shortened list because of your access tier. Each visit gets a random session number that expires after thirty minutes. It is not your name, it is not your account, and it is not kept long enough to build a picture of you.

If you decline, none of that is stored on your device and no session number is created. We still add the page view to a daily total, which records that a page was read and nothing about who read it.

Accepting also loads Google Analytics, which is described in sections 6 and 7. If you decline, Google's tag is instructed through its own consent signal to store nothing.

Security and abuse records

Protecting accounts means keeping a little more than we otherwise would. We record sign-in attempts, meaning the email address tried, the IP address and whether it succeeded, so we can lock out brute-force attacks. We email you when your password changes or your account is used from a new device. Those notifications include the IP address and browser user agent involved, so you can tell at a glance whether it was you. Administrative actions on the site are written to an audit log.

3. What we never do

• No heatmaps and no session recording. Nothing on this site replays your mouse movements, your keystrokes or your screen.
• No advertising or profiling scripts today. If that changes we will say so on this page and in the cookie notice before it goes live, not after.
• No analytics at all unless you accept it. Declining is one click and it costs you nothing on this site.
• We do not sell, rent or trade personal data. There is no circumstance in which your email address reaches a data broker or an advertiser.
• No marketing email you did not ask for. Account holders get transactional and security mail. The only other email we send is the new-site alert described above, which requires you to confirm the address first and can be stopped in one click. We do not add account holders to it, and we do not buy or import lists.
• No harvesting of personal contact details from the websites we list. See section 9.

4. Cookies

We set a small number of strictly necessary cookies, which keep you signed in and protect forms against cross-site request forgery. Analytics cookies are set only if you accept them in the banner, and one further cookie records that answer so you are not asked again. There are no advertising cookies on the site at present. The full list, including lifetimes, is set out in our cookie notice.

5. Why we are allowed to hold it

Where the UK GDPR, EU GDPR or a comparable regime applies to you, these are the lawful bases we rely on.

6. Who else processes it

We keep the list of companies that touch your data deliberately short. Each is engaged as a processor, under contract, and none may use your data for their own purposes.

7. International transfers

The site is operated from Pakistan and the providers above are principally in the United States, so your data is processed outside your own country. If you are in the UK or the EEA, those transfers rely on the standard contractual clauses included in each provider's data-processing terms.

Google Analytics is the one transfer you control directly. It runs only if you accept analytics, and declining stops it before any data leaves your browser.

8. How long we keep it

Deleting your account removes your profile and the records attached to it. Billing records are the exception. We are required to keep proof of a sale, so those are retained in a minimised form for as long as tax law requires.

9. Information about the websites we list

This part is worth being precise about, because it is what the site is for. Our listings describe websites, not people. A row records a domain name, the advertising technology detected on it, a subject category, and when it was last checked. All of it comes from advertising configuration the site itself publishes. See our methodology for exactly how.

We do not collect, store or publish email addresses, phone numbers, names of staff or any other personal contact detail scraped from a listed site. The "contact" link on each row is the conventional /contact path on that domain, constructed rather than harvested.

We recognise that for a one-person publisher, a domain can amount to personal data. If you run a listed site and want the entry corrected or removed, you do not need to prove a legal basis and we will not argue with you about it. Use the removals and corrections page.

10. Your rights

You can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything inaccurate;
• delete your account and the data attached to it;
• stop processing that relies on legitimate interests, where you object to it;
• hand over your data in a portable, machine-readable form.

Email hello@listofwebsitesusing.com from the address on the account. We answer within 30 days, and there is no charge. We may ask you to confirm you control the account before acting on a deletion request. That is not friction for its own sake: acting on an unverified request is itself a breach.

If you are in the UK or the EEA and you think we have handled your data badly, you are entitled to complain to your national data-protection authority. We would rather you told us first and gave us the chance to put it right.

11. Security

Traffic is encrypted in transit. Passwords are stored only as one-way hashes. The database enforces access control at row level, so the key used by your browser cannot read the dataset at all, and every query is authorised on the server. The administrative interface is unlinked, rate-limited and protected by two-factor authentication. No system is perfect, and we would rather describe ours accurately than promise it is unbreakable.

12. Children

This is a business research tool. It is not directed at children and we do not knowingly create accounts for anyone under 16. If you believe a child has made an account, tell us and we will remove it.

13. Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change materially affects what we collect or who we share it with, introducing advertising for example, we will email account holders rather than quietly editing the page.

14. Contact

Shared Authority · hello@listofwebsitesusing.com · contact page

See also: About List of Websites Using · Methodology · Terms · Privacy · Cookies · Removals · Contact