Privacy

Enough data to run the loop. No more.

XBoost uses account, listing, and short-lived attribution data to operate the service and reduce leaderboard abuse.

Account data

Sign-in is optional. If you choose Sign in with X, Firebase Authentication provides XBoost with a provider user ID, display name, X handle, and possibly an email address. The handle is kept in your browser for connected-account display; the provider user ID powers the public X profile link. We do not receive your X password.

Listing data

We store the site URL and category you submit, plus the public page title, meta description, and hostname we read from that destination. We use the hostname to request a favicon for display. We also store traffic totals and operational timestamps. Anonymous listings are not attached to an account. If you are signed in, we also store your account ID, display name, and X provider user ID so the listing can appear on your public maker portfolio and link back to your X profile.

Submission protection

For anonymous submissions, the server combines request signals with a private salt and stores only a one-way fingerprint, a short-lived count, and expiry time. This enforces the daily submission limit without storing the raw IP address in the XBoost database.

Traffic attribution

Your browser stores a random visitor identifier. For site-wide visit counting, short-lived online presence, campaign attribution, and deduplication, the server combines it with request signals and a private salt, then stores only a one-way hash with timing and source data. Campaign visits also use a separate one-way fingerprint of the server-observed public network address without the stored visitor identifier. Both fingerprints must be new for a campaign visit to count, which may group visitors sharing a public network. Open sessions refresh their presence periodically and fall out of the online count shortly after activity stops. Direct landings and presence never contribute to a listing's rank. XBoost application code does not store the raw IP address in its database.

Service providers and retention

Firebase stores authentication and database records, and Vercel hosts and delivers the site. Short-lived deduplication records are designed to expire after the ranking window; aggregate listing totals remain while a listing is active.

Your choices

You may browse and submit a site without signing in. Sign in with X only if you want the listing attached to your identity and public portfolio. Blocking local storage can prevent a visit from qualifying. Account and listing deletion requests will be supported through the site operator.

Effective 30 August 2026 · This notice will be updated as XBoost adds operator contact and account controls.