Privacy

• No account, no tracking cookies.
• Page-view counts come from Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you.
• Error reports go to Sentry when a page breaks. They carry the error and the page's path, nothing else: no account, no cookies, no request headers, no query string.
• Hosting logs. The site runs on Cloudflare, which sees your IP address and browser details to serve the page, as any host does. I don't store your IP address in PortfolioRank's database. Where the site limits how often a network can do something, it stores only a one-way hash of the address, never the address itself, and deletes those counters within a day.

There is no cookie banner because nothing here tracks you: every cookie is needed for something you asked for. The same list is on the Settings page, which can also forget your saved preferences.

• Sign-in session: keeps you signed in, only after you sign in with GitHub, plus two short-lived helpers used during sign-in.
• Browser id: a random, signed id so a vote, poll answer or quiz counts once, set the first time you vote, play or grade.
• Your reports: which grade reports this browser asked for, so only you see a report's owner tools.
• Print pass: a one-hour pass to print a portfolio's report.
• Face-off intro seen: so the how-to-play card doesn't show again.

Saved only in your browser, never sent to the site: your theme (only if you pick Light or Dark), the auto-open setting, whether the face-off shows scores, and which reports already celebrated. A few notes last only while the tab is open, such as whether the sign-in reminder was shown, and, if you grade with your own Gemini key, that key until the grade is done.

The bot check on some forms (Cloudflare Turnstile) sets no cookies on this site.

You get a few practice votes before signing in. The site sets one cookie holding a random id, signed so it can't be forged. Your practice votes and the pairs you were shown are stored against that id, with the time. If you sign in afterwards, those votes can move to your account.

GitHub tells PortfolioRank your GitHub id number, username, display name, email, avatar and the date your GitHub account was created.

• Your session lives in a signed, encrypted cookie in your browser, not in my database.
• What I store is keyed by your GitHub id number: your votes, your likes, your lists, and counters that limit how many pairs you can draw.
• Your lists can be shared by link; a list marked public can be opened by anyone who has the link.
• I don't store your GitHub email or display name in the database.
• The account creation date is used only to tell whether a vote counts when a minimum account age is set.

Votes are kept for as long as the site runs, because the leaderboard is computed from the full vote log. That goes for practice votes too: they're tied only to the random id in your cookie. If the comparison log is ever published, it will show which kind of voter cast each vote (a person or the AI), never who.

PortfolioRank lists portfolios from the public community list emmabostian/developer-portfolios, plus sites people submit. For each listed site I store:

• the name and address from the list;
• screenshots of the public page;
• up to 4,000 characters of the page's visible text;
• facts a script measures (links to a resume, GitHub or contact, whether project links load, own domain, footer year, whether it matches a known template);
• speed and accessibility scores from Google PageSpeed Insights;
• an AI grade from Google's Gemini (see below), and the site's rating and votes.

If your site leaves the list, its screenshots and stored page data are deleted 30 days later. Its past votes stay in the vote log but are no longer shown. To take it off yourself, see Your choices; to stay listed but never be named in posts, see Remove or don't name me.

• Claiming needs a GitHub sign-in. I store your GitHub id number and username with the portfolio's address, how the claim was verified, and a note if you write one.
• To verify, the site fetches your portfolio's public home page (to find a link to your GitHub profile or the verification code) and your public GitHub profile (for your current username).
• Every claim and owner action (removing the site, hiding its grade, asking for a re-grade) goes into an audit log with your GitHub id number and the time, so a removal can always be traced to whoever asked for it.
• If you remove your portfolio, it disappears from the site 24 hours later (you can cancel until then, and I'm told about it, so a removal by someone who isn't the owner can be stopped). Its address then goes on the public removals list in the site's repository, marked “owner request”, without your name; the removed portfolios page only counts these.
• If you ask for a report link by email, your address is used to send that one email and is not stored; only a one-way hash of it counts how many emails it got that day.

• Each vote is stored with your account id (or the random id from your practice-vote cookie) and a signed browser id, so each person votes once.
• No page or API ever shows who voted for what; results are totals.
• Individual poll votes are deleted 30 days after the poll closes; the totals stay.

• Your quiz answers are stored with your account id, or the random id from your practice-vote cookie, with the time and the percentiles they were scored against.
• Badges you earn are stored the same way, with what they need: how many times you shared a result, and which portfolios you opened (at most 50).
• "Your eye" (how often you agree with the crowd and the AI) is worked out from your own votes and answers; nobody else sees it.
• If you sign in afterwards, your quizzes and badges move to your account. Challenge links share the five portfolios of a quiz, never your answers.

Checking and grading a site are opening soon; this is how they work.

Checking a site adds it to PortfolioRank; you can ask for removal at any time. A site that is already listed gets its results refreshed. Any other site waits, privately, to be graded: it's shown on PortfolioRank only once it's graded, and never if it turns out not to be a portfolio.

• I store the address you submit, its screenshots, page text, measured facts and the report.
• To stop abuse, I count requests per browser and per network. Both are stored only as one-way hashes, with the request.
• If you ask for the report by email, your address is used only to send it: it's erased as soon as the email goes out, or after 30 days if it never does. Report links in those emails stop working after 7 days.
• A grade request, its hashes, its report and its screenshots are deleted 180 days after the request.

PortfolioRank only works with portfolios their owners published for the public to see. It uses Google's Gemini API to grade them and to help write blog posts from the site's data.

• What goes to Gemini: screenshots and page text of portfolio sites, with email addresses and phone numbers swapped for placeholders first, the measured facts, and aggregate numbers from the site.
• What never goes to Gemini: anything about voters, accounts or the people who check a site.

PortfolioRank uses Gemini's free tier. Under Google's terms for unpaid services, Google may use what is sent to improve its products, and human reviewers may read it. Only public web pages and aggregate data are sent, so I'm comfortable with that, but you should know. If you grade with your own Gemini key, the request goes to Google under your key's terms instead.

None of them get your data to sell, and neither do I.

The nightly backup is a copy of the database in private storage. Anything deleted from the database can stay in a backup until that backup expires, so every deletion on this page is complete within 35 days.

These are self-serve on the Settings page and take effect at once.

• Download my data: signed in, one click gives you a JSON file of everything stored against your account: votes, likes, lists, badges, quiz plays, poll votes, claims, the portfolio actions you took and the grades you asked for while signed in.
• Delete my account: signed in, type your GitHub username to confirm. Your votes, likes, lists, badges, quiz plays, poll votes, claims and the grades you asked for while signed in are deleted together in one step, and you are signed out. The leaderboard drops your votes at its next recompute. Kept, because they name no one: anonymous counts, and a portfolio's own state, so a removal or a hidden grade you made stays in force with your account struck from the record of who made it.
• Remove my portfolio: on the claim page, prove the site is yours with a code you put on the page (or a claim I've reviewed), then hide its grade or remove it. A removal takes effect a day later and can be cancelled until then. For a site that isn't listed yet, including one still waiting to be graded, email me (see Remove or don't name me).
• Forget my preferences: clears what's saved in your browser.
• Block cookies in your browser: you can still browse, but not vote or sign in.

Anything else, including a request about data that isn't tied to an account: email nate@n8builds.dev. I answer data requests within 30 days.

PortfolioRank is not meant for anyone under 16.

When this page changes, the date at the top changes too, and big changes get a note on the site. Governing law: California, United States.