Privacy
We use one analytics provider, PostHog, to see how the site is used and to catch errors — it sets its own cookie and records browser sessions. Our own cookie keeps you signed in. You can browse and download every design on the site without an account — an account is needed only to upload, comment or vote.
Who processes it
We use these providers to run the site. Each acts as a processor on our behalf.
Vercel
Hosting and delivery of the website
Neon
The database — accounts, designs, comments, votes
Cloudflare
Object storage for blueprint files and screenshots
Steam (Valve) / Google
Sign-in, if you choose one of them. We receive an account identifier, a display name and an avatar — never your password.
PostHog
Product analytics, session replay and error tracking. Receives your IP address, browser details, the pages you visit, the actions listed above, and — while you are signed in — your account ID, username and admin status.
What we store
Account
A display name, an avatar URL, and the identifier from whichever provider you signed in with — your SteamID, your Google account ID, or your email address. Email sign-ups also store a hashed password (scrypt); we never hold the password itself.
Sessions
A cookie holding a random token, and a matching server-side row so sessions can be revoked. The database stores only a SHA-256 of the token, never the token itself.
What you publish
Designs you upload: the blueprint file, screenshots, the name, notes, stats and build cost you entered, and your authorship of them. All of this is public by design.
Comments and votes
Comments are stored with your account and shown publicly. Votes are stored per account so a vote can be changed, and are only ever shown as totals.
View counts
A view is counted once per visitor per design per 12 hours. The visitor is identified by a SHA-256 hash of IP address, browser user-agent and a server-side secret — the raw address is never written down, and the table cannot be read back into a list of addresses. Signed-in users are keyed on their account ID instead, which involves no address at all.
Abuse limits
Sign-in, registration and upload attempts are rate-limited per address. The counters live in memory only and are never written to the database.
Server logs
Our hosting providers record requests, including IP addresses, as part of running the service.
Product analytics
We use PostHog to see how the site is actually used: page views, and ten specific actions — publishing, editing or deleting a design, downloading one, voting, posting, editing, deleting or reporting a comment, and decoding a blueprint in the inspector. These record that the action happened, not what was in it: no design names, no file names, no comment text, no report reasons.
Session replay and error reports
PostHog also records browser sessions so we can see how a page behaved, and captures JavaScript errors — the message, the stack trace and the page it happened on — so we can fix them.
Who the analytics are tied to
While you are signed in, analytics events are linked to your account ID, along with your username and whether you are an admin. Signing out unlinks them. If you are not signed in, PostHog identifies your browser with its own cookie instead.
How long we keep it
Accounts and published designs are kept until you ask us to remove them. Sessions expire on their own. View-dedupe rows are disposable and pruned once their 12-hour window has passed.
Deleted designs and comments are hidden from the site rather than erased immediately, so that moderation decisions stay reviewable. Ask us and they go for good.
Analytics events, session recordings and error reports are held by PostHog under their retention settings. Ask us and we will have yours deleted there too.
Your rights
- Ask what we hold about you
- Have it corrected
- Have it deleted
- Receive it in a portable form
- Object to how we use it
Email support@tramplist.pro and we will deal with it.
Contact
For anything on this page, or to have your account and everything on it removed, write to support@tramplist.pro. Who runs the site is on the contact page.