Koko Lists

Privacy Policy

Last updated August 25, 2026

What we collect

When you create an account, we collect your email address, username, and password (stored as a one-way hash — we never store or can see your actual password). If you add a home location to personalize recommendations, that's stored too, and you can remove it at any time.

When you use the site, we store the votes, reviews, comments (“barks”), business claims, and place suggestions you submit, along with the derived preferences (a “taste profile”) built from that activity — this is what lets a preference you expressed voting on a list in one city carry over to a similar list in another city.

We keep a short-lived, IP-address-based record of requests to certain actions (signup, login, voting, and similar) purely to enforce rate limits against automated abuse. These records aren't tied to your account and aren't used for anything beyond that.

Cookies

We use a single session cookie to keep you logged in. It's required for the site to know who you are between page loads, can't be read by JavaScript (it's marked httpOnly), and expires automatically.

Third parties that process data on our behalf

Running this site means some data necessarily passes through a small number of infrastructure providers, each bound by their own privacy terms: our hosting provider (which serves every page request), our database provider (which stores the data described above), Cloudflare Turnstile (which checks that signup and login attempts are coming from a human, not a bot), and — only for emails we send you, like a password reset link — our transactional email provider. If photo uploads are enabled, an object storage provider hosts those image files.

Your choices

You can delete your reviews, comments, and suggestions at any time from within the site.