Skip to content
LN.STORE

What we store

This page lists what LN.STORE does today. It promises nothing beyond that and does not replace a legal privacy policy.

A profile is created on your first visit

So that you can rate, vote and write reviews without registering, a pseudo-profile is created for you the first time you open the site. This is a product decision and we say it plainly: it has no email address, no password and no name — only an identifier. Everything you do afterwards is attached to it.

If you later sign in by a real method, we offer to move what you have collected from the pseudo-profile into your account. If you decline or close that window, the pseudo-profile stays separate and after a while becomes unreachable.

What is attached to the profile

  • Ratings — a score from 1 to 5 for every resource you have rated.
  • Votes — an up or down vote on every resource.
  • Reviews — a title, free text up to 4000 characters, lists of pros and cons.
  • Review photos — the files you uploaded yourself.
  • Search queries — the literal text of every query, its language and how much was found.
  • Query chains — what you searched for after what, so search suggestions can improve.
  • Interests — a behavioural vector of 384 numbers and a click counter; the personal feed is built from it.
  • Devices — the raw User-Agent string up to 500 characters, device type, browser, operating system.
  • Visits — when a visit started and ended, country and city, language, day of the week, the A/B experiment group you were assigned to.
  • Analytics — card impressions, clicks, page views, clicks through to external sites.
  • Sign-in methods — email address, password hash, Lightning wallet keys, passkey, recovery code hash: only the ones you attached yourself. Neither the password nor the recovery code is stored: only a fingerprint of each is kept, and the original value cannot be recovered from it.
  • Email verification codes — the address and the six-digit code; used codes are kept for about an hour longer.
  • Promotion campaigns — the campaign settings, if you promote a resource of your own.
  • Session refresh tokens — so you do not have to sign in again on every visit.

Country and city are derived by a local MaxMind database from the address the request came from. Nothing leaves our machines to do it.

Three cookies

  • access_token — proves the request is yours. Not readable by page scripts.
  • refreshToken — renews the session. Not readable by page scripts.
  • deviceId — recognises your device, lives for a year. Readable by page scripts.

We do not keep your IP address

The address is in no table of the database — a deliberate decision, written down in the schema itself.

Protection against guessing passwords and codes does need a way to tell one visitor from another, so we compute an irreversible fingerprint from the address: HMAC-SHA256 under a key that is created afresh every day and lives only in the cache of the queue service. That key never reaches the database. The cache writes its contents to a file of its own on the server’s disk from time to time, so the key can outlive a restart — but not its own two-day lifetime, after which it is gone. The address cannot be recovered from the fingerprint. The key lives for two days precisely so that a request made around midnight still finds yesterday’s: which means that at the turn of the day the keys of two neighbouring days exist side by side for a while, and after that the older one is gone and there is nothing left to recompute the earlier fingerprints with.

The server logs record that same fingerprint in place of the address. For IPv6 addresses the second half is dropped before the fingerprint is computed: one household gets one fingerprint rather than a separate one per device.

The caveat without which this promise would be incomplete. A reverse proxy stands in front of our application, and it keeps an access log of its own with the entries a web server normally writes, the address among them. That log lives outside the application, and what is said above does not extend to it.

Who the data goes to

  • The email provider. Receives your email address at the moment a verification code is sent.
  • Google Maps. A map can open on the detail page of any resource. While that map is open, Google receives the address you came from, your User-Agent string and which page you are looking at. This happens only on pages with a map.

The browser calls no other external service: the MaxMind geolocation database sits on our own machines, and there is no third-party analytics on the site.

How to delete your data

Everything listed here hangs off the profile by cascade: deleting the profile deletes the rest with it. Write to us and we will delete the profile together with the ratings, votes, reviews, photos, queries and analytics.