Privacy at Forkshelf
Effective date: 24 October 2026
Who we are
Forkshelf is a directory of self-hosted, open source alternatives to paid software. The controller is Forkshelf. You can reach us at sponsors@forkshelf.com.
What we collect when you submit a tool
The submit form asks for Tool name, Repository URL, Paid tool it replaces and an Optional note. These are details about the project.
Your email. We use it only to tell you the outcome or about your priority request. The email field is required. You don't have to give it by law, but without it we can't reply to you.
If you send the form from the Request priority review page, we note that you asked for priority review. Sending it charges nothing.
Why we use it, and on what basis
We use these details to review your submission, list the tool if it meets our rules, and reply to you. If you asked for priority review, we also email you about that request.
Our replies about your submission are messages you asked for. We do not add marketing to them. We do not sell or share your email for marketing.
If you are in the UK or the EU and give us an email that identifies you, we treat it as personal data. Our basis is legitimate interests: replying to a submission you chose to send. This is the same whether you give a work email or a personal one. If you are in Singapore and give us a business email, it is usually treated as business contact information. If you give us a personal email, you give it so we can reply to you, so we treat you as agreeing to that use.
We don't make automated decisions about you. A person reviews every request.
What we collect when you ask about sponsoring
The sponsor form asks for Company, Website, Page wanted, Email and a note.
We use these details to read your request, check whether the product and page fit our sponsor rules, and reply to you by email. We approve each sponsor before we send a payment link, and that link comes by email. Sending the form never charges anything. Paying for a sponsor slot never changes any listing, label, ranking, order or count. Sponsors get only a clearly marked sponsor slot.
Your email is usually a work email. If you are in the UK or the EU and it identifies you, we treat it as personal data, and our basis is legitimate interests: replying to a request you chose to send. If you are in Singapore, a work email is usually treated as business contact information. If you give us a personal email, you give it so we can reply to you, so we treat you as agreeing to that use.
We keep sponsor requests for 12 months after our decision. We delete them sooner if you ask.
Who handles your data
- Hosting: Cloudflare, Inc. (USA) hosts the site and stores submissions for us. Pages and form posts may be processed in any Cloudflare data centre worldwide.
- Submissions: stored in a Cloudflare D1 database. We make no promise about the country where they are stored.
- Email: our inbox, sponsors@forkshelf.com, receives email through Amazon Simple Email Service (Amazon SES) in the US East (N. Virginia) region (us-east-1). Mail sent to sponsors@forkshelf.com is forwarded by Cloudflare Email Routing. We have not yet confirmed which transfer safeguard covers these email services. If you are in the EU or UK and would rather not email us, you can still use the site without contacting us.
- Payments: if you take up priority review or a sponsor slot, Stripe handles payment through a link we send separately, after we approve the request. The site itself never asks for card details.
- Regions and transfers: Cloudflare, Inc. in the USA receives this data under its data processing agreement, which includes the 2021 Standard Contractual Clauses and, for UK data, the UK Addendum. You can read Cloudflare's agreement at https://www.cloudflare.com/cloudflare-customer-dpa/ and its list of subprocessors at https://www.cloudflare.com/gdpr/subprocessors/ .
How long we keep it
We keep your email and submission for 12 months after we send the review result. We delete them sooner if you ask. Listed project details stay on the site while the tool is listed.
Your rights
You can ask us to stop emailing you at any time, and we will stop. You can also ask us:
- for a copy of the personal data we hold about you;
- to correct it if it is wrong or incomplete;
- to delete it; and
- to limit how we use it while a question about it is sorted out (UK and EU).
Data portability: this right applies only when we rely on your consent or a contract. We rely on legitimate interests, so it does not apply to the data we hold about you.
If we correct or delete your data, we tell anyone we shared it with, unless that is impossible or takes disproportionate effort.
If you are in the UK or the EU, we reply within one month. If a request is complex, we may take up to two more months, and we will tell you within the first month. If you are in Singapore, we reply as soon as we reasonably can. For a request to see or correct your data, if we cannot reply within 30 days, we will tell you in writing within that time when we will.
To make a request, email sponsors@forkshelf.com from the address you used and tell us what you want.
Your right to object
You can object to our use of your details for marketing at any time. If you do, we will stop. There is no reason we can refuse.
If you are in the UK or the EU, you can also object to how we use your details to handle your submission or sponsor request, because of your own situation. We will then stop, unless we have strong legitimate reasons that override your interests, or we need the data for a legal claim.
Complaints
You can complain to a data protection authority at any time. You can also contact us first if you want to, but you don't have to.
If you are in the UK, you can complain to us about how we use your data by email to sponsors@forkshelf.com with "Complaint" in the subject. We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome.
The authorities are:
- UK: the Information Commission (from 30 Sep 2026) at ico.org.uk.
- EU: the data protection authority in the country where you live, work, or where you think the problem happened. The EU authorities are listed at edpb.europa.eu.
- Singapore: the Personal Data Protection Commission at pdpc.gov.sg. If you can, contact us first. PDPC suggests allowing 10 business days, or 30 business days for access or correction requests.
Cookies and analytics
Forkshelf sets no cookies of its own and uses no analytics tools. Sponsor links go through forkshelf.com/go/ so we can count clicks for the sponsor. We store only the sponsor link, the page you came from and the date. We store nothing that identifies you. Cloudflare, which hosts the site, may set a strictly necessary security cookie if it needs to check traffic for abuse.
Changes
If this page changes, we will update the effective date above.