Privacy

incubator.to is a same-origin site. This page names what the public marketing site loads, including the register and session API on this origin.

What this site loads

HTML, CSS, JavaScript, self-hosted fonts, and author photos from incubator.to. Page copy can be refreshed from /api/landing.json. The header asks /api/user/current.json for the current session. Those requests stay on this origin. Some demo changelog photos still load from placeholdr.dev. There are no analytics pixels, no font CDNs, and no advertising networks.

Session

When you register, the form posts project, repo, full_name, username, email and password as JSON to /api/project/register on this origin. Usernames are lowercase ASCII, at least six characters. A successful response sets an HttpOnly session cookie and redirects to the new project page. An error body is shown on the form. Logging in uses the document at /login. With JavaScript the form posts login and password as JSON to /api/session; without it, the same fields post as a form to /login. Both set the same HttpOnly session cookie. After you are signed in, the header reads session and user from /api/user/current.json. User fields are id, full_name, username, slug, created_at, updated_at and deleted_at. Logging out posts to /api/session/logout and clears the session cookie.

Project data

If you register a git repository, we clone it to generate changelog issues. The source stays under your license. Public feeds are published on incubator.to so readers can subscribe. Do not send private credentials in a public repo URL.

Contact

Questions about this policy: write to the operator of incubator.to through the account you create at /register.