Privacy
What we collect, and why
CitedIndex is built to need very little of your data. This page lists everything the site collects, where it goes and how to get it corrected or deleted, in plain language, because that is how a privacy policy should read.
The short version
- No third-party ad trackers or analytics scripts. Visits are counted with our own cookieless statistics.
- The only cookies are essential ones: session cookies when you sign in. That is why there is no cookie banner: there is nothing to consent to.
- We store what you choose to give us (an account, a subscription, a submission, a purchase) and use it only to run CitedIndex.
- We never sell personal data. It leaves us only via the processors that run the site, or when you explicitly ask a listed provider to contact you.
- Email support@citedindex.com to see, fix, export or delete your data.
Visiting the site
When you browse, our server counts the visit in our own first-party analytics: the page, the referring site, your country and a technical visitor code. That code is a one-way hash of the current day, your IP address and browser signature. We never store the raw IP address with it, it cannot be reversed to identify you, and it changes every day, so it cannot follow you over time. No analytics script runs in your browser and no analytics cookie is ever set.
Outbound “visit site” links route through our own /go counter so tool owners see honest click totals. The click is stored with no identity attached.
Cookies
Signing in sets session cookies: they keep you signed in and do nothing else. The submit form runs Cloudflare Turnstile to keep bots out, which may set its own functional state while it solves the check. That is the whole list: no advertising, tracking or cross-site cookies.
Your account
An account stores your email address, your name and your password, held only as a salted hash, never in plain text. We send account email only when the account needs it: sign-in verification, password resets, receipts and renewal notices. If you sign in with Google, Google shares your name, email address and profile picture with us; we never see your Google password and never post or act on your behalf.
Saved tools: as a guest, your shortlist lives in your own browser and never reaches our servers. With an account, it is stored alongside the account so it follows you across devices.
The newsletter
Subscribing stores your email address, the moment you consented and any topics you picked, and sends a short welcome note. Every email we send carries a working one-click unsubscribe link, and the preference centre lets you change topics or leave entirely. Unsubscribing stops mail immediately and places your address on a suppression list, so nothing can accidentally re-add you later.
Submitting or claiming a listing
A submission stores what you send us (the tool’s details and your contact email) and becomes input to our research (see how we rank). An anonymous submission requires an email address so the listing has an owner who can manage it.
Asking to be contacted
Some listings carry a contact form. That form exists to pass your request on: your name, email, company and message are delivered to the provider(s) you asked to hear from, and only with the consent box ticked. We keep a copy of the request to police spam and settle billing disputes.
Paying for a placement
Checkout runs on Stripe. Your card details go to Stripe and never touch our servers; we store only the settlement facts (what was bought, when, and for which listing) for billing and tax.
Who touches data on our behalf
- Cloudflare: hosting, storage, content delivery, email routing and the anti-bot check. The whole site runs on their network.
- Stripe: payment processing.
- Resend: sending our email.
- Google: only if you choose to sign in with Google.
No ad networks, no data brokers, no resale. The only time your data reaches anyone who is not a processor for us is when you submit a listing’s contact form. Then it goes to the provider you chose, which is the point of the form.
How long we keep things
Account data lives as long as the account does. Newsletter data lives until you unsubscribe; the suppression entry is kept afterwards so you stay unsubscribed. Submission and contact-request records are kept while the listing or billing they belong to needs them. Analytics are counts, not personal profiles. Backups exist for disaster recovery only and are cycled automatically.
Your rights
CitedIndex is operated from the European Union, so the GDPR is our baseline for everyone, wherever you are. You can ask for a copy of your data, corrections, deletion, a portable export, or object to any processing; email support@citedindex.com from the address in question and we’ll handle it.
Our legal bases, in plain words: running what you signed up for (accounts, purchases, submissions, under contract), your consent (the newsletter, contact forms), and our legitimate interest in keeping the site working, counting visits without identifying anyone, and preventing abuse. If you believe we have handled your data badly, you can complain to your data-protection authority.
Who is responsible, and changes
The data controller is the operator of CitedIndex (Cited·Index), reachable at support@citedindex.com. If this policy changes, the date at the top changes with it. The date above always reflects the current version.