Privacy Policy

This page explains how smm.directory handles your data. It covers the blog, the questions and answers, the tools directory, and visitor accounts. Effective July 5, 2026.

What we collect

• First-party analytics. We count page views, scroll depth, and time on a page with a small same-origin signal. No third-party analytics or ad trackers run on this site.
• A hashed visitor signal. To count unique readers we use a short, hashed value. It is not your name, and we do not store a raw IP address for analytics. It cannot identify you personally.
• Your account, if you create one. To claim a listing, save tools, or manage reviews you can register with an email and password. We store the email, a one-way hash of the password (never the password itself), and anything you add to your profile — a display name, company, website, short bio, and an avatar colour. If you turn on two-factor authentication we store the secret that generates your codes.
• What you send us. A directory review (name, text, a star rating and optional value/quality/speed/support/ease scores), a comment (name, an optional email, and your message), a report, a tool submission (domain, name, description), or a message through our contact form.
• Your saved tools. If you bookmark a tool while signed in, we store which tools you saved so your list is there next time.
• Outbound clicks. When you follow a "Visit", "Get deal", or similar link out to a tool, we count that click in aggregate so a listing's owner can see interest. It is a tally, not a profile of you.
• Server logs. Like any web server, ours records the request: IP address, browser, page, and time. We use these for security and to fix problems.

What we do not do

• No third-party trackers, ad networks, or cross-site profiles.
• No selling or renting your data.
• No external scripts — our content policy blocks them, and fonts load from our own server.
• No marketing email. We only send messages you ask for (see below).

Cookies

We keep cookies to a minimum and use none for advertising:

• Account session. If you sign in, a session cookie keeps you logged in. A second short-lived cookie is used only during two-step (2FA) sign-in.
• Voting. An opaque token so one visitor is not counted twice on a tool.
• Staff session. A separate cookie signs administrators in.
• Your preferences. Theme and contrast choices are kept in your browser only and are never sent to us.

Email we send

We send transactional email only: a password-reset link when you request one, and — if you opt in — a note when your listing receives a new review. There is no newsletter and no promotional mail.

Why we use your IP address

To rate-limit requests, to stop vote and report abuse, to lock out repeated failed logins, and to block attacks. We do not use it for advertising.

Keeping and removing data

Analytics are kept in aggregate. Reviews, comments, submissions, and account data are kept while we need them to run the directory. You can edit or delete a review you left, remove a bookmark, or ask us to close your account and erase its profile.

Your choices

You can read everything — the blog, the answers, and the whole directory — without an account. You can vote without registering. An account is only needed to save tools, claim a listing, or manage reviews. To ask about your data or close your account, contact us.

Illegal content scanning

Images and text you upload or submit may be automatically scanned to detect illegal material, including child sexual abuse material. Confirmed illegal content is removed and reported to the appropriate authorities, as described in our community rules.

Who is responsible for your data

The controller of personal data processed through this site is the site's operating company, identified in the footer. For any data question or request, contact us and we will respond.

Legal bases for processing

Where data-protection law (such as the UK GDPR / EU GDPR) applies, we process personal data on these bases: our legitimate interests in running, securing and improving the site and preventing abuse (analytics signals, server logs, anti-abuse checks, aggregate click counts); performance of a contract or steps taken at your request (your account, listings you manage, paid services); consent, where we ask for it (for example, review-notification email you opt into), which you may withdraw at any time; and legal obligation, where we must retain or disclose data to comply with the law.

How long we keep data

Analytics are kept only in aggregate. Server logs are kept for a limited period for security and troubleshooting, then discarded or anonymised. Account data, reviews, comments and submissions are kept while your account is active or while we need them to run the directory and meet legal or record-keeping obligations, and are then deleted or anonymised. You can delete a review you left, remove a bookmark, or ask us to close your account and erase its profile.

International transfers

Our infrastructure and email delivery may process data in countries outside your own. Where personal data is transferred internationally, we rely on appropriate safeguards recognised under applicable law (such as adequacy decisions or standard contractual clauses).

Your rights

Subject to applicable law, you may have the right to access the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to certain processing; to data portability; and to withdraw consent where processing is based on it. To exercise any of these, contact us — we may need to verify your identity first. If you believe we have mishandled your data, you may also lodge a complaint with your local data-protection supervisory authority.

Children

The site is not directed at children, and interactive features are intended for users aged 16 or older (or the age of digital consent in your country). We do not knowingly collect personal data from children below that age; if you believe we have, contact us and we will delete it.

Security

We take reasonable technical and organisational measures to protect your data — including password hashing, optional two-factor authentication, a strict content-security policy that blocks third-party scripts, encryption in transit, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time; the version published here is the one that applies. Material changes will be reflected by the "last updated" date.