Privacy Policy

1. Scope

This Privacy Policy explains how replacemrr handles information when you use the website, the public API and the CLI.

2. Account information

You sign in with Google or GitHub. From them we receive your name, email address and profile picture, your GitHub username if you use GitHub, and your Google Workspace domain if your account has one. We use the sign-in tokens they issue to read those details, and we do not store them. Each session records its IP address and browser so it can be secured.

We do not collect passwords.

3. Stories and proof

When you submit a story, we store what you enter: the company and its domain, the vendor, the replacement, the costs, the stack, the go-live date, your summary and any source link. Stage changes and their notes are kept as the story's timeline.

To check a proof, we look up the token you publish on your domain, or use your Google Workspace domain, or read public GitHub information about the repo you name and your membership of its organization. We do not ask for payment credentials or your customers' data.

If we ask to see a redacted invoice during review, we look at it and delete it after review.

4. What is public

A published story is public, including its numbers, its dates, its timeline and the domain or repo used as proof. It appears on the website and through the API and the CLI, and it can be cached, shared and copied by others.

The story also shows its owner's name and GitHub username. If you signed in with a Google Workspace account on the company's domain, it shows the company instead.

Your email address is not public.

5. Unclaimed stories

We list public posts about replacing a vendor, with a link to the source and an Unclaimed label. If one is about your company, you can claim it, or use the report link or email us to correct or remove it.

6. Reports

When you report a story, we store your reason, along with your account if you are signed in or a hash of your IP address if you are not.

7. Cookies and analytics

We use one kind of cookie: the one that keeps you signed in. We do not use advertising cookies or cross-site tracking.

We count visits by recording the path of the page you opened, with no cookie and no IP address. Cloudflare Turnstile checks for bots when you submit a story or report one without signing in.

We also use OneDollarStats for site statistics. It uses no cookies. It receives the page you opened, the site that sent you here, any campaign tags in the link, and your IP address and browser details, which it hashes into a visitor ID that changes every day. It also reports your country, device, browser and operating system to us as totals.

8. How information is used

• Run replacemrr, including its leaderboard, boards, API and CLI.
• Check proofs and review stories, claims and reports.
• Prevent abuse and enforce our Terms of Service.
• Provide support, and comply with the law.

9. Service providers and disclosures

Cloudflare provides hosting, storage, security and DNS lookups. Google and GitHub provide sign-in, and OneDollarStats provides site statistics. They process information only as needed to provide their services to us.

We may also disclose information when required by law, to protect replacemrr or its users, or as part of a merger, financing, acquisition or sale of assets. We do not sell personal information.

10. Retention and security

We keep account and story information for as long as your account or story exists, and as long as needed afterwards to meet legal obligations, resolve disputes and prevent abuse. Hashed IP addresses used for rate limits are deleted after about a day. Hashes kept on reports stay with the report.

API keys are stored as hashes, so we cannot read them back. We use reasonable safeguards, but no online service can guarantee absolute security.

11. Your choices

You can ask for access to, correction of, or deletion of your personal information by emailing hello@replacemrr.com, subject to applicable law and legitimate retention needs. Deleting your account also removes the stories you own. You can also revoke replacemrr's access from your Google or GitHub account settings.

12. Children

replacemrr is intended for business users and is not directed to children under 16. We do not knowingly collect personal information from them.

13. Changes and contact

We may update this policy as replacemrr evolves, and the date at the top shows the latest revision. Send privacy questions and requests to hello@replacemrr.com.