Privacy policy
What Happylancing Directory collects, why, and the rights you have under the GDPR and US state privacy laws.
Last updated: October 20, 2026
Summary
- You can browse Happylancing Directory without an account. We set no tracking or advertising cookies, and our visitor statistics are cookieless.
- We only collect personal data you give us (newsletter, account, forms) or that is needed to run the site securely.
- We do not sell or share personal data, and we do not use it for targeted advertising.
- Sponsored placements are served without any profile of you.
Who is responsible
The controller under the General Data Protection Regulation (GDPR) is:
not configured: NEXT_PUBLIC_LEGAL_NAMEnot configured: NEXT_PUBLIC_LEGAL_STREET
not configured: NEXT_PUBLIC_LEGAL_CITY
not configured: NEXT_PUBLIC_LEGAL_COUNTRY
Email: support@happylancing.com. Full details are in the Impressum.
What we process, why, and for how long
Visiting the site
- Data
- IP address, date and time, requested URL, referrer, browser and operating system (user agent), and response status, in the server logs of our hosting provider.
- Purpose
- Delivering the site, keeping it secure and stable, and investigating errors and abuse.
- Legal basis
- Art. 6 (1) (f) GDPR: our legitimate interest in operating a secure website.
- Retention
- Request logs are kept only for the short log retention period of our hosting provider, then deleted automatically.
Visitor statistics
- Data
- Page visited, referrer, country, browser and device type. Vercel Web Analytics identifies a visit with a hash of the request that is discarded after 24 hours. It sets no cookies and stores nothing on your device. We also keep aggregate daily counters (page views per repository, search terms, outbound clicks) that contain no identifiers.
- Purpose
- Understanding which pages and repositories are useful, and measuring sponsor impressions and clicks in aggregate.
- Legal basis
- Art. 6 (1) (f) GDPR: our legitimate interest in improving the site and reporting to sponsors. No information is stored on or read from your device, so § 25 TDDDG does not require consent.
- Retention
- Visit hashes are discarded after 24 hours. Aggregate counters contain no personal data.
Abuse prevention
- Data
- A keyed one-way hash of your IP address when you use a form.
- Purpose
- Rate limiting, and detecting spam and repeated abusive submissions.
- Legal basis
- Art. 6 (1) (f) GDPR: our legitimate interest in protecting the service from abuse.
- Retention
- Rate-limit records are deleted after two days. A hash stored with a project submission is kept with that submission.
Accounts (optional, GitHub sign-in)
- Data
- Your name, email address and avatar URL from GitHub, your GitHub account ID, the tokens GitHub issues during sign-in, and the repositories you save.
- Purpose
- Signing you in and keeping your saved repositories.
- Legal basis
- Art. 6 (1) (b) GDPR: providing the account you asked for.
- Retention
- Until you ask us to delete your account. Sign-in sessions expire after 30 days.
Project submissions
- Data
- The repository URL, your note, whether you maintain the project, your email address if you give one, and a hash of your IP address.
- Purpose
- Reviewing the submission and, if you gave an email address, telling you the result.
- Legal basis
- Art. 6 (1) (f) GDPR: our legitimate interest in running a community submission queue. Giving an email address is optional.
- Retention
- Kept with the submission record. We delete your email address on request.
Contact and advertising inquiries
- Data
- Your name, email address, message and, for advertising inquiries, your company and budget range.
- Purpose
- Answering your message and, for advertisers, preparing an offer.
- Legal basis
- Art. 6 (1) (b) GDPR where your message concerns a contract or its preparation; otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering inquiries.
- Retention
- Deleted when the inquiry is resolved and no longer needed, unless commercial or tax law requires us to keep business correspondence (up to six years under § 257 HGB).
Payments (only when paid plans are offered)
- Data
- Customer and subscription IDs, plan, status and billing period from Stripe. Card details go directly to Stripe and never reach us.
- Purpose
- Selling and managing subscriptions.
- Legal basis
- Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (statutory bookkeeping duties).
- Retention
- For the life of the subscription, then for the statutory retention periods of commercial and tax law (up to ten years).
Public data about repository owners and X posts
- Data
- For listed repositories: the owner username, repository metadata, README excerpts and star history, collected from the public GitHub API. For X posts that link to a repository: only the post ID and the author handle, collected from the official X API. We do not store post text.
- Purpose
- Publishing an attributed, searchable directory of open-source software.
- Legal basis
- Art. 6 (1) (f) GDPR: our legitimate interest, and the public interest, in making publicly released open-source projects discoverable. This data was not collected from you (Art. 14 GDPR); its sources are GitHub and X.
- Retention
- While the repository is listed. Star snapshots are deleted after 400 days. Maintainers can request corrections or removal at any time.
Our fonts are bundled with the site and served from our own domain, so loading a page makes no request to Google or other font providers. Classification of repositories uses only public repository content and makes no decisions about people. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
Cookies and local storage
We use only what is strictly necessary: a sign-in cookie for signed-in users, short-lived cookies that protect the GitHub sign-in, and a local-storage entry that remembers your light or dark theme if you choose one. These are exempt from consent under § 25 (2) No. 2 TDDDG and Art. 5 (3) of the ePrivacy Directive, so there is no cookie banner. The full list is on the cookie page.
Service providers and recipients
We use these processors, bound by data processing agreements under Art. 28 GDPR. We do not pass personal data to anyone else unless the law requires it.
| Provider | Location | Purpose |
|---|---|---|
| Vercel Inc. | USA | Hosting, content delivery, server logs and Web Analytics |
| Our managed PostgreSQL provider | EU or USA, depending on deployment | Database hosting |
| Resend Inc. | USA | Sending confirmation and newsletter emails, reporting bounces and spam complaints |
| GitHub Inc. | USA | Sign-in (OAuth) and public repository data |
| Stripe Payments Europe Ltd. and Stripe Inc. | Ireland and USA | Payment processing, only when paid plans are offered |
| AI provider (Anthropic or OpenAI), when configured | USA | Classifying public repository data. No personal data about visitors or subscribers is sent. |
Transfers outside the EU
Several providers are based in the United States. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission adequacy decision of July 10, 2023 (Art. 45 GDPR). Otherwise it relies on the Standard Contractual Clauses adopted by the Commission (Art. 46 (2) (c) GDPR) with supplementary measures. You can ask us for a copy of the safeguards.
Your rights under the GDPR
You have the right to:
- access the personal data we hold about you (Art. 15),
- have it corrected (Art. 16) or deleted (Art. 17),
- restrict its processing (Art. 18),
- receive it in a portable format (Art. 20),
- withdraw consent at any time with effect for the future (Art. 7 (3)),
- lodge a complaint with a data protection supervisory authority (Art. 77), in particular in the EU member state where you live or work.
Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims.
To exercise any right, email support@happylancing.com or use the contact form. We answer within one month.
Providing personal data is neither a legal nor a contractual requirement. Without an email address we cannot send the newsletter or reply to you, and without GitHub sign-in you cannot save repositories. Everything else works without giving us any data.
Notice for US residents
This section supplements the policy above for residents of California and other US states with consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others). In the last 12 months we collected these categories of personal information, from the sources and for the purposes described above:
- Identifiers: email address, name, GitHub account ID and username, hashed IP address.
- Commercial information: subscription status, only when paid plans are offered.
- Internet or network activity: server logs and cookieless visitor statistics.
- Professional information: company name, if you send an advertising inquiry.
We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act (CCPA), and we have not done so in the last 12 months. We do not use personal information for targeted advertising or profiling, and we do not collect sensitive personal information to infer characteristics about you. Because there is nothing to opt out of, we treat a Global Privacy Control signal as already honored. We do not knowingly sell or share data of consumers under 16.
Depending on your state, you have the right to know what personal information we collect, use and disclose; to access it in a portable format; to correct it; to delete it; and not to be discriminated against for exercising these rights. Submit a request by email or through the contact form. We verify requests by confirming control of the email address involved. You can use an authorized agent, who must show your signed permission. If we decline your request, you can appeal by replying to our decision; we answer appeals within 60 days, and if you disagree you can contact your state attorney general.
California Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.
Do Not Track. We do not track visitors across third-party websites, so we treat every visitor the same whether or not the browser sends a Do Not Track signal.
Children
Happylancing Directory is a directory for software developers and is not directed at children. We do not knowingly collect personal data from children under 16, or from children under 13 as defined by the US Children's Online Privacy Protection Act (COPPA). If you believe a child has given us personal data, contact us and we will delete it.
Security
All traffic is encrypted with TLS. Confirmation tokens are stored only as hashes, IP addresses are stored only as keyed hashes, unsubscribe links are signed, and access to the admin area is checked against our database on every request.
Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. If a change requires your consent, we will ask for it.