How Does Top Tens Protect My Privacy?

By Top Tens

The short answer

By collecting as little as it can, and by refusing the two things that make most free apps profitable: it does not use your data for advertising profiling, and it does not sell your personal information. Everything below comes from the Top Tens Privacy Policy itself (last updated October 8, 2026) — not from a marketing page.

What Top Tens collects — and why

• Email address — for passwordless login via one-time verification codes. No password is stored, so there is no password to steal. Your email is also the key to your account, so protecting access to it is on you.
• Your lists and list content — the rankings, items, and edits you create, including shared cards and challenge links. The app cannot work without storing these; they are the service.
• Account and subscription status — whether you hold an active paid subscription. Payment card details are processed by Square and are never stored on Top Tens’ servers.
• Technical logs — IP address, timestamps, request metadata, and authentication attempts, logged passively for security and operations. They are only searched when an issue needs resolving.
• Email delivery metadata — via Resend, so login codes actually arrive.
• Device and app data (mobile apps) — basic device type, OS version, and app version, used for troubleshooting and compatibility.

What it never does with your data

• No advertising profiling. Your data is not used to build an advertising profile of you.
• No selling your personal information. Not to advertisers, not to data brokers, not to anyone.
• No sharing with advertisers. Data is shared only to comply with the law, to protect the service or its users, or with the providers listed below as necessary to run the service.
• No marketing emails. The only emails Top Tens sends are login verification codes and account notifications, from yourtoptens@aol.com.

How it is protected technically

• Encrypted connections (HTTPS/TLS) for all traffic.
• Cloudflare security protections and secure Worker routing.
• Supabase Row Level Security, isolating one user’s data from another’s.
• Encrypted email delivery via Resend.
• Passwordless authentication — no stored passwords to steal.

No system is perfectly secure, and the policy says so plainly. What it promises is the design above, not invulnerability.

Who else is involved?

Cloudflare (hosting, DNS, backend Workers, security), Supabase (database and storage), Resend (email), Square (subscription billing), Amazon (some item reference links are affiliate links that may earn a commission), and Google Play / Apple App Store (distribution). They process data only as necessary to provide their services, under their own policies.

Your rights: correction, export, deletion

You can request deletion of your account and all associated data — from the in-app or website account settings where available, or by emailing yourtoptens@aol.com. When you delete your account, your email, lists, and associated content are deleted within a reasonable period, except where retention is required by law (for example, subscription records kept for billing and tax). You can also request correction of inaccurate information. Exporting data you placed on the platform is your responsibility, at your own expense. The service is not directed at children under 13, and you must be at least 13 to use it.

Frequently asked questions

Do I have to create an account?
Only to keep your own vault. You can browse the pre-seeded stock vault without an account, in which case only technical logs and cookies apply. Cookies are minimal: session cookies, security cookies, and Cloudflare’s security and performance cookies.

What happens if I submit abusive or illegal content?
The Terms reserve the right to forward that data for law-enforcement or civil-remediation purposes, and to remove the content or account. That is the one exception to the no-sharing rule — and it is written into the policy, not hidden.

Where do I ask a privacy question?
yourtoptens@aol.com. Top Tens is operated by Amanda’s Awards Co., New Brunswick, New Jersey.

The bottom line

Privacy protection here is not a slogan; it is a short list of refusals. No ad profiling. No data sales. No marketing email. Minimal collection, encrypted throughout, and a delete button that actually deletes. That is the whole policy — and it fits on a page you can read yourself.