The whole list of what we keep.

Little Grebe Inc., a Delaware corporation, operator of honesty.market, is the controller of everything described below. Reach us through the form — see clause 10.

Outbound links run through honesty.market/go/<slug> so that the click can be attributed. For each visit we record, in full:

• the time, the product and the merchant, and the exact destination URL we sent you to;
• a salted hash of your IP address that changes every day — sha256(ip + secret salt + UTC date). We do not store the address itself, and yesterday’s hash of you does not match today’s;
• the country Vercel derives from that address at the edge — country only, never a finer location;
• the user-agent string, the browser family it resolves to, and the client hints sec-ch-ua, sec-ch-ua-platform and sec-ch-ua-mobile;
• the Accept-Language header, the referring page, and which page on our site carried the link;
• the hm_sid session cookie described in clause 4, and a dedupe key derived from the IP hash, the slug and the user-agent;
• a classification of the visitor — a person’s browser, a user-directed AI agent, or a crawler — the agent’s name where it declares one, and whether its IP fell inside that operator’s published ranges.

We do not store names, email addresses or raw IP addresses for link visits. We never see your payment details, because no payment happens here.

For reads of the feeds, the MCP endpoint and the UCP profile we record the time, the path and method, the status, the user-agent and its classification, the same daily IP hash, the platform profile URL the agent declares in meta["ucp-agent"].profile, and any bot-authentication signature header it sends. This is how the ledger can say which agents actually read the register — the point of the whole exercise.

We set a single first-party cookie, hm_sid, when you first follow a link. It lasts 30 days and is set HttpOnly, SameSite=Lax and Secure. Its value is a random identifier and it contains no personal data; its only job is to let repeat visits from the same browser be counted once rather than several times.

There are no third-party scripts on this site. No analytics SDK, no advertising pixel, no tag manager, no social embed, no session recorder. Nothing here reports you to anyone else.

The onboarding form is the one place we collect ordinary personal data, because you type it in: your name and email address, your company, brand, domain and platform, optionally your role, product categories, feed URL, affiliate programme, monthly order volume, what you are interested in and a free-text message. We also store your ticked consent, the daily IP hash and the user-agent of the submission. We use it to answer you and to assess the listing; we do not add you to a marketing list.

• Vercel — hosting and edge delivery; derives the country, sees request metadata in the ordinary course of serving the page.
• Supabase — the Postgres database holding the tables above, in the us-east-1 region of the United States.
• Resend — delivers the notification email when a form is submitted.
• Merchants — each can see the clicks attributed to their own listings: time, product, country, visitor class and agent name. They do not receive the IP hash, the session id or the user-agent string, and they never receive anything that identifies you as a person.

We do not sell or share personal information, in the sense the CCPA gives those words, and we have never done so. We disclose data otherwise only where the law compels it.

Following a link takes you to the merchant’s own site, which has its own privacy policy and its own cookies. Once you are there we are not involved. Each merchant’s policy is linked from their page in the register, and from Refunds & returns.

Our legitimate interests: attributing a click to the merchant who earned it, keeping a ledger that can be audited, enforcing rate limits and detecting abuse, and understanding which agents read the register. For the onboarding form, the basis is your consent, given by the tick box, plus the steps taken at your request before any agreement.

Click and agent-visit records are the register’s ledger, and we keep them for as long as we operate it; we have not set a fixed deletion schedule for them. Because the IP hash rotates daily and no name or address is attached, these rows stop being linkable to a person very quickly by design. Onboarding submissions are kept until you ask us to delete them, or until the enquiry is plainly dead.

If you are in California, the CCPA as amended by the CPRA gives you the right to know what we have collected, to have it deleted, to have it corrected, to opt out of sale or sharing — which we do not do — and not to be treated worse for asking. If you are in the EEA or the UK, you have equivalent rights of access, rectification, erasure, restriction, portability and objection.

One honest limit: for link visits and agent reads we hold no identifier that can be traced back to you. Given only a browser or an IP address, we usually cannot find your rows, and we will not demand more personal data than we already hold just to run a search. Where you can identify the data — a form submission, or a click whose hm_click id you still have — we can act on it in full.

The register is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us something through the form, tell us and we will delete it.

The date at the top is the last substantive change; the current text always sits at this URL. Exercise any right above, or ask anything about this policy, through the form. We publish no email address on purpose — an address on an agent-readable site is an invitation to harvesters — and the form is read by a person.