Privacy Policy

boringweb.gallery (“boringweb”, “we”, “us”) is a curated gallery of websites for service businesses. It is run by Dexter Washington. This policy explains what we collect when you use the site or create an account, why, and what you can do about it.

The short version

We collect only what we need to give you an account: your email address, and your name, avatar and X handle if you sign in with Google or X.
We use it to sign you in, keep your boards and run your MCP key, and to send the weekly roundup if you ask for it.
We do not sell your data. We do not show ads based on it.
We never post, like, follow or message anyone on your behalf.
You can ask us to delete your account and data at any time.

What we collect

If you browse without an account: we do not ask for any personal information. Our hosting provider may keep standard server logs (such as IP address, browser type and pages requested) for security and to keep the site running.

If you create an account, we collect:

Email address. Accounts are identified by email. We use it to sign you in and, if needed, to contact you about your account.
Name and profile picture, if you sign in with Google or X, as provided by that service.
X handle (username) and X user ID, if you sign in with X.
Google account ID, if you sign in with Google.
Your boards: the sites, sections and screens you save to them, and when you saved them.
Your MCP key: a key made for your account so an AI agent can use the boringweb MCP server, and a count of the requests made with it, to apply its limits.
Weekly roundup, if you tick its box: your email address, to send it every Monday.
Sign-in records: one-time codes we send (stored briefly, then discarded) and session information that keeps you signed in.

We do not collect passwords. We do not collect your contacts, your posts, your followers or any other content from your Google or X account.

Email code. You enter your email and we send a one-time code to confirm you own it.
Google. We ask Google only for the basic openid, email and profile permissions. This gives us your name, email address and profile picture.
X. We ask X only for users.read, tweet.read and users.email. We use these to read who you are (name, handle, profile picture) and your confirmed email address. The tweet.read permission is required by X for sign-in; we do not read, store or use your posts. We cannot post on your behalf.
If X does not share a confirmed email, we ask you to enter an email address and send a code to confirm it. If that address already belongs to a boringweb account, confirming the code links your X sign-in to that account.

How we use your information

We use your information only to:

create and run your account and sign you in;
save and show your boards;
run your MCP key and its limits;
send the weekly roundup, if you asked for it;
keep the site secure and prevent abuse;
contact you about your account or important changes to these policies.

We do not sell, rent or trade your information. We do not use it for advertising. We do not use data from Google or X for any purpose other than signing you in and showing your profile on your account.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

We share information only with service providers that help us run the site, and only as much as they need:

Hosting and database providers, which store the site and account data: Cloudflare, which serves the site and its images, and Railway, which runs the database.
Email delivery provider, which sends sign-in codes and the weekly roundup: Resend.
Google and X, when you choose to sign in with them. Their own privacy policies apply to what they do: Google Privacy Policy, X Privacy Policy.

We may also disclose information if the law requires it, or to protect the site and its users from fraud or abuse.

Cookies and sessions

We use a small number of cookies that are needed for the site to work:

a session cookie that keeps you signed in;
short-lived security cookies used during Google or X sign-in to protect against forged requests.

We do not use advertising or cross-site tracking cookies.

How long we keep it

Account data, boards and your MCP key: for as long as your account exists.
Weekly roundup: until you ask us to stop sending it.
One-time sign-in codes: until used or expired, usually within minutes.
Sessions: until you sign out or the session expires.
Server logs: for a limited period, typically no more than 30 days.

When you delete your account, we delete your account data, boards and MCP key, and take you off the weekly roundup, within 30 days, except where we must keep something by law. Backups are overwritten on a normal schedule.

Your choices and rights

You can:

See or correct the information we hold about you;
Stop the weekly roundup at any time;
Delete your account and all associated data;
Disconnect Google or X at any time from your Google account settings or X’s connected apps settings;
Ask questions about how your data is handled.

To make a request, email hello@boringweb.gallery from the address on your account. We will respond within 30 days. Depending on where you live (for example the UK, EU or California), you may have further rights under local law, such as data portability or objecting to processing, and the right to complain to your local data protection authority.

Security

We use reasonable measures to protect your information, including encrypted connections (HTTPS) and limited access to account data. No system is perfectly secure, but we take care to keep what we hold small.

Children

boringweb is not intended for children under 13 (or the minimum age in your country). We do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

International transfers

Our service providers may store data in countries other than yours. Where required, we rely on appropriate safeguards for these transfers.

Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will tell signed-in users by email or on the site before it takes effect.