Plain-language policy
Privacy
Effective August 20, 2026
Last updated: August 21, 2026
We collect the information needed to review referral-code submissions, prevent abuse, secure administrator access, count aggregate referral-link uses, and understand general site traffic. We do not use advertising trackers or sell visitor data.
Referral submissions
If you submit a referral code, we collect the display name and referral code you provide, your consent to publish them, and the submission status used for moderation. Approved names and codes appear publicly. A submission does not become public until an administrator approves it.
Aggregate code use
When someone follows a referral link, we update only an aggregate use counter for that code. We do not store a visitor's raw IP address, user agent, city, or country in our referral-code database.
Website analytics
Public pages use Tinylytics, a privacy-focused analytics service, to measure page views, pages visited, referring sites, countries, browsers, and platforms. Tinylytics is cookie-free and does not use fingerprinting. It may use a visitor's IP address to determine a country, then discards the raw address rather than storing it with the visit. User-agent data is retained temporarily by Tinylytics and automatically removed after seven days. The site owner can set a browser-only local storage flag to exclude their own visits; ordinary visitors are not assigned a persistent local identifier.
Short-lived security data
To slow automated abuse, the server uses a one-way hash derived from the connection IP address in temporary rate-limit files. Event timestamps expire after the applicable window, such as one minute for API traffic or one hour for submissions. The hash is not used for advertising or cross-site tracking.
Cookies and sessions
Most public pages do not start a session. The submission page uses a secure, HttpOnly, SameSite cookie so the server can verify the form. Administrators use a secure session cookie for authentication and TOTP verification. There are no advertising cookies.
Third-party services and destinations
Public pages connect to Tinylytics for the limited site analytics described above. Following a referral link takes you to Rivian, whose privacy terms then apply. Links to GitHub and other external services are also governed by those services.
Retention and requests
Approved submissions remain until removed or no longer useful. Rejected submissions may be deleted during routine maintenance. Temporary rate-limit events expire automatically. To request correction or removal of your name and code, email zak@winnick.io.