Privacy Policy
Introduction
BSDirectory helps people discover software and helps founders submit and launch products in weekly editions.
Information we collect
The app may collect account email, name and profile image from Google sign-in, product submission information, launch scheduling details, payment status and Stripe identifiers, and basic technical logs needed to operate the service.
How we use information
We use data to provide access, authenticate users, process payments, schedule launches, review product submissions, publish approved listings, improve the product, prevent abuse, and provide support.
Payments
Payments are processed by Stripe. The app does not store full card details.
Account authentication
Email accounts use a password stored only as a salted, memory-hard hash. We send verification and password-reset emails using expiring, single-use tokens; only token hashes are stored. Pending registration password hashes and expired challenge records are removed during subsequent account requests after their short retention window. Password resets revoke existing account sessions. Login attempts are rate-limited using keyed hashes of the email or network identity; raw passwords are never included in analytics. Google sign-in remains available.
Product submissions
Information submitted through the product submission form may be reviewed and, when approved, published publicly on BSDirectory.
Advertising interest
If you register interest in Premium Spot, we save your contact email and product website for follow-up; interest alone creates no purchase. Premium Spot campaigns record the product, verified management access, review and administrative history, dates, payment/refund identifiers and aggregate measured impressions/clicks. Advertiser and authorized administrator views are private. Optional advertising measurements use the existing consented first-party visitor identifier, are filtered and deduplicated, and do not represent unique visitors. Per-event deduplication records are retained up to 400 days; aggregate campaign totals and commercial history remain for operational or legal needs. You can request removal through support.
Third-party services
BSDirectory may use Google OAuth, Stripe, an SMTP email provider, a hosting provider, and a database provider.
Data retention
Account and product data are kept while the account is active or as needed for operational or legal reasons.
User control
Users can request deletion of their account or data by contacting tim.chevalier@bonson-web-solutions.com.
Cookies
Authentication and session cookies keep users signed in. Optional product analytics and Google Analytics load only after you allow analytics. You can decline or change your choice using Cookie settings. The analytics choice is stored for up to 180 days. After consent, a signed, first-party visitor cookie lasts 24 hours and helps deduplicate product page views, launch impressions and outbound clicks. With consent, we also record whether the launch offer was viewed and which plan was selected. A random choice-session identifier may be linked to the product you submit to evaluate the approval and payment flow; it does not identify a unique person. Choice-session records and browser events are retained for up to 400 days; aggregate historical listing counters are retained with the listing. Hashed rate-limit buckets expire after one hour. Private submission links and contact emails are not included in analytics events.
Content measurement
With analytics consent, we record editorial page views, clicks from guides to product profiles, Submit CTA clicks and recognized search-referrer landings. These events use the same signed visitor cookie and 30-minute deduplication window. Referrer-based landings are incomplete and are not a count of verified organic sessions or unique people. An explicit Submit CTA can set a signed first-party content-source cookie for 30 minutes, linking a completed submission to that content; this does not establish that the submission came from organic search. The source cookie is removed when analytics consent is withdrawn. Private editorial drafts, research notes, contact details and private management tokens are excluded from these analytics events.
Acquisition and private reporting
With analytics consent, a signed first-party acquisition cookie lasts 30 minutes. It stores restricted campaign labels and the referring hostname, without raw referring URLs, query strings, IP addresses or private management tokens. A completed submission or new account may save this acquisition snapshot for up to 400 days to measure acquisition and related confirmed purchases. It never determines payment permissions or affiliate commissions. Withdrawing analytics consent removes the acquisition cookie and stops new optional measurement. Administrators alone can access aggregated business reports. Confirmed payments and refunds remain commercial records. Optional GA4 traffic reporting reads the existing analytics property; page views, sessions and users remain distinct measures. Configured Vislyt product links may carry explicit campaign labels and measured outbound referrals; no accounts, emails or cross-product subscriptions are synchronized.
Affiliate referrals
Affiliate attribution uses a separate optional referral consent choice. An approved partner referral can be remembered in a signed first-party HttpOnly cookie for 30 days; the first qualified submission consumes it. Without this consent, you can explicitly enter a partner code in Submit. Once saved, the referral relationship is an operational submission record and can qualify after later moderation and payment. No device fingerprinting is used. Partners see their own aggregate activity, commission amounts and payouts, not your private listing/contact or Stripe identifiers. Applications, attributed submissions, commission and payout records are retained as needed for program administration, disputes, accounting and applicable legal obligations. Use Cookie settings to withdraw referral tracking; this deletes the referral cookie. See affiliate terms for details.
Contact
Questions can be sent to tim.chevalier@bonson-web-solutions.com.