Privacy policy

Last updated: November 2, 2026

Who is responsible

The controller under the GDPR is the operator named in the legal notice: Florian Stehle, Menckestraße 39, 04155 Leipzig. Email: hello@toporslop.app.

Short version: no ads, no tracking cookies, no third-party analytics. We count visits ourselves, without cookies. You can play without an account. We don't store IP addresses.

Visiting the site

The site runs on Cloudflare. To deliver it and to slow down abuse, Cloudflare processes your IP address, browser type and the pages you request. We use the IP address only for a moment as a key for rate limits; we don't store or log it. Legal basis: our legitimate interest in a secure, working site (Art. 6(1)(f) GDPR).

Visitor statistics

To know how many people use the site, our server counts page loads. Nothing is stored on your device for this and no script runs; we count on the server when it delivers a page. We store per day: how often each page was loaded and, if you came from another website, that website's domain (for example x.com). To count visitors once per day, the server computes a one-way hash of your IP address and browser type together with a random value that changes every day. The IP address and browser type are not stored. After the day is over we delete the random value and all hashes of that day and keep only the number of visitors. Page counts and domains are deleted after 90 days. Nothing is shared with third parties. Legal basis: Art. 6(1)(f) GDPR (knowing how the site is used).

What we store when you swipe

A cookie named tos_d with a random device ID, valid for one year. It keeps your device from voting twice and is strictly necessary for the game (§ 25(2) no. 2 TDDDG). Your votes and reasons are stored with that random ID, never with your IP address. With each vote we also note how long the card was shown and whether you opened the page's details or clicked through to it; a page's owner only sees totals. We keep votes as long as the site runs, because results and rankings are built from them. Legal basis: Art. 6(1)(f) GDPR (running the game you chose to play, keeping it fair).

Some settings stay in your browser only (local and session storage) and are never sent to us: your swipe count and agreement rate (tos_stats), hints you've seen (tos_hints, tos_coached), when to ask you why (tos_ask_*), the sign-in card (tos_join), your last submission (tos_sub) and the private manage links of pages you submitted or took over (tos_manage_…) and the code of a takeover you started (tos_takeover_…). You can delete them in your browser's settings.

Bot protection

Before your votes count and before you submit a page, Cloudflare Turnstile checks that you're a person. For this, Cloudflare processes technical data from your browser. Legal basis: Art. 6(1)(f) GDPR (keeping bots and vote manipulation out).

What we store when you submit

The URL, your one-liner and "looking for" text, your maker profiles if you add them, screenshots of the page, facts we read from the public page (price, free trial, template patterns), the random ID of the submitting device and a hash of your private manage link. To take the screenshots we request your page with our own user agent, TopOrSlopBot/1.0 (+https://toporslop.app/about), and open it in a headless browser. The page stays listed until you or we remove it. When a page is removed, we delete its screenshots right away and the maker profiles with it; we keep the address, name and votes so the same site can't be resubmitted again and again. Maker profiles of rejected pages are deleted after 30 days. Legal basis: Art. 6(1)(b) GDPR (you asked us to list the page) and Art. 6(1)(f) GDPR.

Safety check

Before a page is listed, and when its owner changes its texts, we send its screenshots, its page text and the texts you entered to Anthropic, PBC (USA), which runs the AI model Claude. The model checks for adult content, hate, scams, gambling and pages that aren't landing pages. Anthropic acts as our processor and doesn't use this data for training. The transfer to the USA is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR) in Anthropic's data processing addendum. The check only decides whether a page is listed; if you think it got it wrong, write to us and a person will look at it.

Result emails

If you leave your email address, we first send one email asking you to confirm it. Only after you confirm do we send up to two emails about your page: when the first results are in and when it's ranked. We delete the address after the second email, when you remove the address or your page, when you unsubscribe, after 90 days at the latest, and after 7 days if you never confirm it. We send these emails through Cloudflare Email Service. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link in each email or on your page's manage page.

Accounts (optional)

You can play without an account. If you sign in with Google or GitHub, we store your email address, the name and user ID your provider sends us and, for GitHub, your username. We don't store your profile picture. Your device's votes and pages are then linked to your account, so we can count your points and stop double votes from your other devices. We never show your name or email address. The judges board only shows the handles you add yourself, and only if you turn it on. Signing in sets two more cookies (tos.session_token and tos.session_data) that keep you signed in; they are strictly necessary. If you allow it, we email you when one of your pages is Page of the day, nothing else. You can delete your account at any time on your account page; your votes then stay without any link to you. Legal basis: Art. 6(1)(b) GDPR. For the sign-in itself, Google (Google Ireland Ltd.) and GitHub (GitHub, Inc., USA) process your data under their own privacy policies.

Reports

If you report a page, we store the reason with your random device ID. We delete reports after 180 days. Legal basis: Art. 6(1)(f) GDPR and our duties under the EU Digital Services Act.

Starter pages

To get the game going, the deck includes public landing pages we picked ourselves (Art. 14 GDPR). We store their address, a name and short description taken from the page, and screenshots. They may show names of companies or people. They never show up in rankings. Legal basis: Art. 6(1)(f) GDPR (a useful deck from the first day). You can object at any time: write to remove@toporslop.app and we remove the page.

Emails to us

If you write to us, we use your address and message to answer and delete them when the matter is settled, unless we have to keep them longer by law. Legal basis: Art. 6(1)(f) GDPR.

Who gets data

• Cloudflare, Inc. (USA; data stored in the EU): hosting, database, file storage, email sending, Turnstile. Processor under a data processing agreement.
• Anthropic, PBC (USA): the safety check described above. Processor under a data processing agreement.
• Google and GitHub: only if you choose to sign in with them.

We don't sell data and don't share it with advertisers.

Your rights

You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future. You can object at any time to processing based on our legitimate interests (Art. 21 GDPR). Write to hello@toporslop.app. Because we don't know who you are, tell us your page's address or, for votes, open the site on the device you used so we can find its random ID. You can also complain to a data protection authority, for example the one responsible for us: Sächsische Datenschutz- und Transparenzbeauftragte (Saxony), Maternistraße 17, 01067 Dresden, www.datenschutz.sachsen.de.

We make no automated decisions that have legal effects on you.