Privacy

Reading infratoapp requires no account. If you sign in, we store your email address and what you choose to do while signed in: what you save, your progress and answers in the Academy, lab scores and certificates, and anything you contribute or submit. Every kind is listed below, and nothing is inferred about you. We sell nothing and run no advertising. We use Google Analytics to count visits; in the EU, EEA, UK and Switzerland it stays off until you allow it, and you can decline it anywhere.

We do count how many times each listing was viewed, clicks from a listing to the vendor’s site, per surface (website, docs, pricing page, repository, price source, comparison), and how often a sponsored card was at least half on screen or clicked. Each is a number per product (or sponsored placement) per day. For outbound clicks and sponsored placements, common automated user agents are not counted. These counters hold no identifier of any kind — no visitor id, no session, no IP, no cookie, no click id — so two people and one person reloading are indistinguishable to us by construction.

No account and no profile. Our host, Vercel, keeps ordinary server logs of requests — including IP address and user agent — which is how any website is served and protected from abuse. We do not link those logs to a person and do not use them for anything else.

We use Google Analytics 4 to count visits and see which pages are read, so we know what to improve. Google receives the page address, the referring page, your browser and device type, an approximate location derived from your IP address, and a random identifier stored in cookies named _ga and _ga_*, which last up to two years. We do not send Google your email address or anything that names you, and we have not turned on advertising features, Google signals or ad personalisation.

Your choice. In the EU, EEA, UK and Switzerland, analytics is off until you allow it: until then Google Analytics sets no cookie and stores no identifier. Elsewhere it is on by default. Anyone, anywhere, can change the answer with Cookie settings at the foot of every page; the choice is kept in your browser.

Separately, we count how many times each listing was viewed as a number per page per day, with no identifier of any kind. That counter is our own and is described above.

Some tool guides in the Academy embed videos from the tool maker’s own YouTube channel. Nothing is requested from YouTube when a page loads. If you press Play, the video loads from YouTube’s privacy-enhanced player (youtube-nocookie.com). From that moment Google, which runs YouTube, receives your IP address and browser details, and its player may store information in your browser under Google’s own policies, which we do not control. If you never press Play, none of this happens. Each video also has a link that opens it on YouTube directly.

We store your email address, the date the account was created, and when you last signed in. That is your sign-in record. What you then do while signed in is kept too, and the next section lists every kind. Nothing is inferred about you, and your account has no name field and no avatar.

Signing in sets a session cookie so the site knows you are you on the next page. It is required for the site to function, expires on its own, and is not used to follow you anywhere.

If you sign in with GitHub, GitHub tells us your email address and public profile, and nothing further — we do not request access to your repositories. We use the email to identify you and to attribute contributions you make.

Besides your sign-in record, these are the kinds of information the site ties to a signed-in person. A kind appears here only if the software stores it, and a test fails the build if a new one is added without being listed.

What you save, and your alerts

What you saved (the item, a label and an optional note) and which email alerts you turned on.

Optional details about you

Your job function and how you buy, if you chose to say. Today they are shown to nobody, and you can clear them from your account page at any time. If vendors are ever shown them, it will only be as a spread across readers with a minimum group size, never as a person, and this page will change first. The database also has room for an Academy profile (role, experience, main goal, weekly study time), but nothing on the site asks for it yet.

Your Academy learning record

Courses you started and finished, lessons you completed, your answers to final checks and your scores, what you write in practice exercises, the credentials you earned, and the skills your work shows. If you press Tell me when it opens on a planned certification program, which program and when; we email you once when it opens, and Remove me deletes it. If you are given access to a premium masterclass, which one, from when to when, and how it was given. If you submit a masterclass capstone, what you wrote, the links you gave, when, and the review: which rubric items were met, the reviewer's notes and their email address. If you buy a masterclass, the order from our payment provider: which masterclass, the amount and currency, the order number, the email on the order and the access it gave. Orders are financial records we must keep for accounting, so if you delete your account the order stays, no longer linked to your account. If you take a timed exam, which questions you were given, when you started and finished, and your score, but not your answers.

Your lab scores and certificates

Each practice round (counts by kind of error and how sure you said you were) and each certified attempt (which passages, your score and when). If you pass, a certificate: your score, the date, a certificate number and the name you typed on it. A certificate has a public page that anyone with its address can open; it is kept out of search. If an operator resets your attempt count, that is recorded with who did it. If you press Add to LinkedIn or Share, your browser opens LinkedIn with the certificate title, date, number and address in the link. We send LinkedIn nothing ourselves. The prompt-writing and data-cleaning labs, and the marked exercise on a course page, check what you type on our server and do not save it; if you are signed in and your answer is strong, they record which task and the day, so it counts towards your level. Their certified rounds store which tasks you were given and your score, never what you typed.

Academy AI usage counters

A credit balance and usage records for Academy AI features. No AI provider is called today, so what you write in the Academy is not sent to one. If that changes, this page changes first.

What you submit to the directory

Corrections and facts you add, disputes about a published value, reviews, suggested listings, benchmark results and requests to change a listing. Each is stored with your account so it has an author. Approved contributions are public, under a handle. Disputes and suggested listings also keep the email address you sent them from. When you give a web address with a submission, our server visits it once to check it exists; the site you named sees our server and the name infratoapp-verifier, nothing about you.

Times our staff looked at your account

When a member of our staff opened a read-only view of your account, how long it lasted and the reason they gave. A view shows your account details, seats, learning progress and what you sent us, and never what you saved or your sharing choices. It needs a reason, ends by itself after 30 minutes, and every one is listed on your own account page. The staff member is recorded in our internal audit log and is not shown to you.

Interest you chose to share

If you chose to tell a company you are interested in its product, that record, and whether you later withdrew it.

If you manage a listing

Your seat in the organisation, invitations sent to an email address, requests for access, the checks used to confirm you control a listing (including a GitHub account name and repository if you verify that way, and a hashed record of codes we sent), the vendor terms you accepted, and sponsored placements you created.

If an account is suspended

The reason, who suspended it and when.

A correction or an added fact is stored against your account so the change has an author, and so you can see what you have contributed. Contributions are intended to be public, and the record of who made one is kept because an unattributed change is not something a reader can weigh. Approved contributions are shown publicly under a handle, and a contributor page lists the answers published under that handle.

Claiming requires an email address at the organisation’s own domain, because holding an inbox there is the only thing we can actually check. We store that address and the listing it is attached to. It proves you hold an inbox at that domain — it is not a statement that you speak for the company.

You can also claim by proving ownership of the organisation’s GitHub account. We ask GitHub for no permissions, so it shares only what is public plus whether you can administer that organisation or repository. The one-time token is used for a few requests and then discarded, never stored. What we keep is the evidence of the check: GitHub identifiers and the permissions GitHub reported.

When you change a listing from the vendor workspace, we record which account made the change, when, and what the fields said before and after, and which version of the vendor terms that account accepted. The record is kept so a change can be traced and reverted; it is not shown publicly, though the listing says the words came from the company.

If you are signed in and press the “Interested in” button on a product page, we record that you did, for which product, when, and which version of the wording you were shown. The line under the button says it shares your email with the vendor and that you can stop any time; this is what that means. While you share, the vendor sees your email address, which product, and the date, in a leads list it can download. We hold no name for you, so it sees none. Stopping removes you from the list at once, but we cannot take back a copy a vendor has already downloaded. Each time a vendor opens or downloads the list we record which account did, when, and how many rows, never the addresses. If you shared before 15 October 2026, under the older wording, the vendor sees only a count of how many readers are sharing interest in its product — no names and no emails — and stays that way for that opt-in; to be named you stop and share again. Nothing you read before you pressed it is shared. The Sharing panel in your portal lists every product you share interest in, says for each whether the vendor sees your email or a count, and Stop sharing there stops it immediately. The record is kept until you delete your account, marked stopped, so we can show when you agreed and when you stopped.

Vendors also see aggregate touchpoints in a Buyer intent section, with every number under 5 shown as “<5”. That includes a total of how many times their product was saved to a list. They see only that floored total, never who saved it; your saved lists are not visible to any vendor.

6 providers, each doing one job:

• Supabase — stores the database and your account
• Vercel — serves the site and keeps request logs
• Cloudflare — serves logos and Academy videos from assets.infratoapp.com, so it sees the request for each file, as any web host does; it also runs DNS for infratoapp.com
• Resend — delivers sign-in emails, so it sees the address a link is sent to
• Google — Google Analytics, as described above, only with your consent where that is required; and YouTube, only if you press Play on an embedded video
• GitHub — serves the small project avatars in the MCP server and agent skill directories, so it sees a request for each one shown, as any image host does

Nobody else receives your data. We run no advertising and no third-party trackers other than Google Analytics, and YouTube when you press Play on an embedded video. The counters described above are our own and store no identifier. Vendors see them only as aggregates, with every number under 5 shown as “<5”: views, outbound clicks, sponsored placement counts, a total of saves, and a count of readers sharing interest. Never per person, and never who saved or who clicked, apart from the opt-in described above.

The directory describes products, not people. Our schema has room for vendor contact details, for telling a company its listing exists. That table is empty and no such contact has been collected. If that changes, this page changes with it, and anyone recorded will be able to have the record removed by writing to the address below.

Your account lasts until you ask us to delete it. Ask, and it goes — along with the link between you and anything you contributed. The contributed facts themselves remain, since other readers rely on them, but they stop being attributed to you.

What you saved, your alert settings, your optional details, your Academy learning record, your lab scores and your certificates are deleted with the account, and a certificate’s public page stops working. Records other people rely on, such as reviews, benchmark results, disputes, suggested listings, listing change requests and organisation records, stay, and the link to you is removed automatically when the account is deleted.

Write to privacy@growagent.dev and we will tell you everything we hold about you, correct it, or delete it. There is no form and no account tier — one email is enough. If you are in the UK or EU, those are your rights under the GDPR; we apply them to everyone.

This page describes what the software does today, and is updated when that changes rather than on a schedule. Last updated 18 October 2026.