What we collect, what we deliberately do not, and who else touches it.
Last updated 18 August 2026
There are no accounts. You can read the whole site, and write a review, without ever telling us who you are.
We store the smallest thing that makes a feature work. Where a one-way hash does the job, that is what is kept instead of the real value — a hash is enough to compare against, and useless to anyone who steals the database.
The review itself: the product, your score, whether you would recommend it, your headline and text, any tags, use cases, category ratings and feature requests you added, and the display name and optional role you typed. All of this is public by design — it is the point of the site.
An anonymous identifier. The first time you interact, your browser is given a random token in a cookie. We store only a SHA-256 hash of it. It is what enforces one review per product per person and the daily submission limit. It is not tied to your name, email, or anything you did anywhere else.
A hash of the review text, used to detect the same text being posted repeatedly.
Verifying your email is optional. If you do it, we send one six-digit code and store a SHA-256 hash of the address plus a hash of the code — never the address itself and never the code in readable form. The hash exists to rate-limit codes and to stop one address verifying endlessly.
We cannot email you. There is no mailing list, no newsletter, and no way to recover the address from what we keep.
If you forward a receipt to verify a paid relationship, that email arrives in an inbox we control and is read only to check who signed it. We do not keep what you paid.
By default we do not collect them. Optional per-IP rate limiting can be switched on, and when it is, only a salted SHA-256 hash is stored — never the address. The salt matters: IPv4 is small enough that an unsalted hash is reversible, which would make storing it equivalent to storing the address.
Our hosting provider processes IP addresses to serve requests, as any web host must.
We use Vercel Web Analytics, which is aggregate and does not use cookies or build a profile of you across sites. We do not run advertising or cross-site tracking of any kind.
Vercel — hosting, aggregate analytics, and storage for product logos.
Neon — the database where reviews and the hashes described above are stored.
Resend — sends the verification code, and therefore handles the address you type at the moment it is sent.
Cloudflare Turnstile — the bot check on submission forms, where enabled.
Stripe — only if you buy a sponsor slot. Payment details go to Stripe and never reach us.
Published reviews stay until they are removed. Verification records are consumed when the review they belong to is submitted.
The anonymous cookie lasts a year unless you clear it. Clearing it does not delete reviews you already wrote — it just means this browser is no longer recognised as their author.
Because there are no accounts, we cannot show you a list of your reviews. Email team@ratemyai.app with the product and roughly when you posted, and we will find and delete it.
You can also report any review — including your own — from the review itself. See the guidelines for how moderation works.
If this policy changes in a way that affects what we collect, the revision date above changes with it.