Privacy

StackCook, Ottawa, Canada. StackCook ranks AI tools and stacks for builders. We never sell rankings.

StackCook's Privacy contact (the site maintainer) is responsible for how we handle personal information. To access, correct or delete your data, withdraw consent, or ask a privacy question, use our privacy request form. We may need to confirm it's you before acting. We reply within 30 days.

Newsletter. If you subscribe on our newsletter page, we collect your email address and which signup form you used. We use double opt-in: we send you one confirmation email, and you aren't added to the list or sent the newsletter until you confirm. To meet Canada's Anti-Spam Legislation (CASL), we keep a record of your consent: the version of the consent text, when you agreed and confirmed, your IP address, and your browser user agent.

Sponsor inquiry form. If you contact us about sponsoring, we collect your work email, your name if you give it, your company and website, the offer and use case you pick, and your message. We use these to reply to you and to arrange a sponsorship if you go ahead. Your inquiry is emailed to our sponsor inbox, with your address as the reply-to. We also file a private internal ticket with your company, website, offer, use case and message. It leaves out your email and name, and the form doesn't accept email addresses or phone numbers in those fields. If the email can't be sent, nothing is kept and the form shows an error.

Privacy requests. If you use our privacy request form, we collect your email address, if you give it, the type of request and your message, and use them only to handle your request and reply to you. The request is emailed to our privacy inbox, with your address as the reply-to, if you gave one. It is never filed as a ticket. If the email can't be sent, nothing is kept and the form shows an error.

Build submissions, corrections and security reports. These forms don't ask for contact details. What you type in their free-text fields is filed exactly as written in a private internal ticket that only the people who run StackCook can see, so please don't include personal details or credentials. If you need a reply about your personal data, use the privacy request form.

Payments. If you buy a sponsorship, we send you a secure payment link after we've agreed the details. Our payment processor handles the payment and collects your card details and billing address; we never see or store your full card number. We get back your name, email, billing address, and what you bought, which we keep for invoices and tax records.

Analytics. We count page views and measure page speed with privacy-friendly analytics. They set no cookies and don't track you across sites. We see totals only (pages, referrers, country, browser, operating system and device type), never individual visitors. Visitors are counted using a hash of the request that resets every day.

Error logging. When something breaks, we record technical details such as the page, browser, and error message. Before an error report is sent, we drop request data, cookies, headers and query strings, don't attach your IP address, and scrub email addresses and IP addresses from messages. Your browser also sends our error-logging provider a short report directly when a page breaks one of our security rules. That report includes the page address and your browser details, and the provider sees your IP address when it arrives. We don't use session replay or performance tracing.

Bot protection. Our forms use a bot check to block spam. It runs in your browser only on pages that have a form, and when you submit, we send its token and your IP address to the bot-protection provider to verify it. It isn't used for advertising.

Security filtering. Our hosting provider screens every request, using your IP address and browser details, to block attacks and limit how often forms can be submitted.

We don't use advertising trackers, and we don't sell or rent your data.

We send the newsletter, reply to sponsor inquiries and handle privacy requests because you asked us to (your consent, or steps you requested). We process payments to fulfil a contract and to meet our legal duties. We protect the site and fix errors because we have a legitimate interest in keeping it working. We follow Canada's PIPEDA and CASL. If you're in the EU or UK, the GDPR also gives you the right to object, to restrict processing, to get a copy of your data in a portable format, and to complain to your local data protection authority.

We use a small number of service providers to run StackCook. We give each one only the data it needs for its job, and they may use it only to provide their service to us, except where noted:

• Hosting and delivery. Serves the website, runs our forms and filters out attacks. It receives every request, including your IP address and browser details, because it needs them to deliver pages and keep the site secure. It keeps short-lived request and security logs.
• Error logging. Receives technical error reports (page, browser, error message) so we can fix problems. Request data, cookies, headers and query strings are removed first, your IP address isn't attached, and email addresses and IP addresses are scrubbed from messages. It also receives the security-rule reports your browser sends directly (page address and browser details), and sees your IP address when it receives them.
• Privacy-friendly analytics. Receives page views and page-speed measurements without cookies, so we can see which pages are used and whether they load quickly. We only see totals.
• Email delivery. Sends the newsletter confirmation email and stores the subscriber list with each consent record. It also delivers sponsor inquiries (your name, email, company, website, offer, use case and message) and privacy requests (your email, the type of request and your message) to our inboxes.
• Email inbox. Forwards and stores the sponsor inquiries and privacy requests we receive, so we can reply to you.
• Payment processing. Handles sponsorship payments. It collects your card details, billing address, name and email; we receive your name, email, billing address and what you bought, but never your full card number. It also uses payment data under its own privacy policy to prevent fraud and meet its legal duties.
• Bot protection. Checks that form submissions come from a person. The check runs in your browser on pages with a form and looks at browser and device signals; when you submit, it receives the check token and your IP address. It may use these signals to improve its bot detection, but not for advertising.
• Internal ticketing. Holds private tickets for build submissions, corrections, security reports and sponsor inquiries so we can track them. Sponsor tickets contain only a fixed set of fields, without your email, name or phone number. Free-text fields on the build, corrections and security forms are filed exactly as you type them. Privacy requests never go into tickets.

Where data is processed. Our providers process and store data outside Canada, mainly in the United States, and possibly in other countries where they operate. While it's there, it's subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities. We use contracts and our providers' security commitments to protect it, and we remain responsible for it. For questions about how our providers handle your data, use our privacy request form.

• We never sell your personal data.
• We share it only with the providers above, as they need it to run the service, or when the law requires us to.
• We never show it publicly.
• Our site and forms use encryption in transit (HTTPS), and we limit who can access stored data. No system is perfectly secure, but we'll tell you and the regulator if a breach puts you at real risk of significant harm.
• We keep it to the minimum we need, for no longer than the periods below.
• You can ask us to delete it at any time through our privacy request form.

• Newsletter: while you're subscribed. If you unsubscribe, we keep your email address only to make sure you don't get emails again, together with your consent record, for 3 years so we can prove consent under CASL. After that, we delete both.
• Sponsor inquiries: 24 months after our last contact with you, unless you become a sponsor.
• Payment and invoice records: 6 years after the end of the tax year they relate to, as Canadian tax law requires.
• Internal tickets from forms: deleted or anonymized once they're resolved, and kept no longer than 24 months.
• Error logs: no longer than 90 days.
• Hosting and security logs: short-lived, under our hosting provider's standard log retention.
• Analytics: aggregated only, kept under our analytics provider's retention policy.

You can unsubscribe anytime from the unsubscribe link in any email, or with your mail app's unsubscribe button. You can also ask to see or correct your data, ask us to delete it, ask which providers have handled it, or withdraw your consent, through our privacy request form. We may need to confirm it's you before we act. We reply within 30 days. Withdrawing consent doesn't affect records the law requires us to keep, such as invoices. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

If we change this policy, we'll update the date at the top. If it's a significant change, we'll tell subscribers in the newsletter.