What Data We Collect

We collect information in several ways: information you provide directly to us, information collected automatically through your use of our services, and information we derive or infer from other data. The specific data we collect depends on how you interact with Finkkle — whether you use it as a signed-in user, a guest, or through an integrated third-party product.

Account & Profile Information

When you create an account with Finkkle, we collect the following personally identifiable information to establish and manage your account:

• First name and last name
• Email address
• Password (encrypted and managed by our authentication provider, Supabase; we never store plaintext passwords)
• Birthdate (day, month, year) — used for age verification and to comply with legal obligations concerning minors
• Gender — used for personalization features where applicable
• Profile picture (if uploaded) — stored securely and only accessible to you and Finkkle's systems

You are not required to provide all of this information to use Finkkle, but certain features may be unavailable if you choose not to complete your profile. Optional fields are clearly labeled in the account creation flow.

Authentication & Access Control

To authorize your requests to our services and ensure that only you can access your account, we collect and store:

• Bearer tokens: Access tokens used to authenticate API calls, transmitted in the Authorization header. These tokens are short-lived and expire automatically.
• Session tokens: HttpOnly cookies (cannot be accessed by JavaScript) to maintain your logged-in session across browser tabs and sessions. These are cryptographically signed and verified server-side on every request.
• Session context cookies: Signed, compact cookies containing recent queries, intent categories, and timestamps to enhance session-based search understanding. These are ephemeral and expire after 15 minutes of inactivity.
• Refresh tokens: Long-lived tokens used to obtain new access tokens without requiring you to log in again. These are stored securely and rotated on each use.

Search Data & User History

Search is the core of what Finkkle does, and we collect data about your searches to provide, personalize, and improve the service. Specifically, we collect and store:

• Search queries you enter, including the raw text and any refinements or follow-up queries
• Geographic data derived from your IP address or explicitly provided by you (country, region, city) — used to localize search results
• Timestamps of your searches, used to understand temporal search patterns and provide time-aware results
• Your user ID to associate searches with your account for history, personalization, and continuity across devices
• Device and session context at the time of the search, such as whether you were on mobile or desktop

This data is stored in our search_history table and is used to personalize search results, rank suggestions, build a personal history of your searches, and improve the relevance of future queries. You can view and delete your search history at any time from your account settings.

Interaction & Engagement Data

We track your interactions with search results and Finkkle's interface to understand how you engage with the product and to improve ranking, suggestions, and relevance:

• Suggestion clicks: What suggestions you click on, their position in the list, their type (e.g., trending, personalized, navigational), and metadata such as the originating query and timestamp
• Result clicks: Which search results you select, their rank position, the domain, and how long you spent on the resulting page before returning (if measurable)
• User sessions: Geographic and temporal session data to understand usage patterns, active periods, and geographic distribution — used to improve localization and capacity planning
• Query embeddings: Vectorized (numerical) representations of your queries used for semantic search, contextual ranking, and recommendation improvements. These are mathematical representations, not raw text.
• Scroll and dwell data: How far you scroll through results and how long you spend on the results page — used to infer result quality and relevance

Analytics Events

Front-end events are emitted to our analytics endpoints to help us understand how users interact with Finkkle at a product level. These events are used to make product decisions and are not shared with third-party advertisers. They include:

• Search interactions: query submission, filter usage, result pagination, query refinements
• Timing data: time to first result, time to click, total session duration
• Page navigation events: which sections of Finkkle you visit and in what order
• Feature usage and engagement metrics: which features are used, how often, and by what types of users
• Error events: client-side errors that affect your experience, including the context needed to reproduce and fix them

Indexed Content

To provide search results, we ingest and index publicly available web content. This includes:

• Page titles, URLs, and meta descriptions from crawled websites
• Structured metadata (e.g., schema.org markup, Open Graph tags) associated with indexed content
• Content signals used for ranking, such as inbound link counts, freshness scores, and topical classification

This data is not tied to your account unless you explicitly link it (for example, by saving a result or adding a URL to a personal Space). We respect standard web crawling exclusions such as robots.txt and meta robots directives.

Device & Network Data

Our servers automatically log standard request data as part of normal web server operations. This includes:

• IP addresses — used for geolocation, rate limiting, and abuse detection. IP addresses may be truncated before storage in analytics contexts.
• User-Agent strings — used to understand what browsers and devices are in use and to optimize the experience accordingly
• HTTP request metadata: method, path, referrer, response status codes, and request size
• Request timestamps and latency data — used for performance monitoring and incident investigation

Communications Data

If you contact Finkkle for support, submit feedback, or respond to surveys, we collect and retain the content of those communications along with your contact information. This includes email correspondence, feedback form submissions, and any attachments you provide. We use this data to respond to you and to improve our services.

Information from Third Parties

In some cases, we may receive information about you from third parties, such as:

• Authentication providers (e.g., if you sign in via a social login option, we may receive your name, email, and profile picture from that provider)
• Fraud and abuse prevention services that help us detect automated or malicious activity
• Publicly available sources that we use to enrich indexed content or improve our understanding of entities in search

Where Your Data Is Stored

Your data is stored across a small number of carefully selected infrastructure providers. We evaluate all storage vendors against security, compliance, and reliability standards before use. Below is a breakdown of where each category of data lives:

Data in transit is protected using TLS 1.2 or higher across all connections. All sensitive operations — including account changes, search history access, and data deletion — require valid authentication and authorization verification before processing.

We do not store personal data on local devices beyond what is necessary for authentication sessions (cookies) and cached results for performance. You can clear this local data at any time by logging out or clearing your browser cookies and storage.

How We Use Your Data

We use the data we collect for specific, defined purposes. We do not use your personal data in ways that are incompatible with the purposes described at the time of collection without first obtaining your consent.

Core Service Operations

• Authenticating you and managing your account securely
• Processing and responding to your search queries in real time
• Delivering search results, suggestions, and content recommendations
• Maintaining your session across browser tabs and page loads
• Communicating with you about your account status and service updates

Personalization & Ranking

• Building your search profile based on past queries, clicks, and stated preferences
• Ranking and reordering suggestions and results to improve their relevance to you specifically
• Understanding your search intent and topic interest clusters over time
• Learning your geographic preferences for localized and regionally relevant results
• Adapting the interface and feature visibility based on your usage patterns

Product Improvement

• Analyzing trending searches and popular queries in aggregate to improve index coverage
• Understanding user behavior, drop-off points, and friction in the search experience
• Testing and debugging new features in development and production environments
• Training and evaluating ranking models and semantic search algorithms using aggregated, de-identified data
• Improving suggestion quality, spelling correction, and query interpretation

Analytics & Reporting

• Measuring service performance, uptime, and latency benchmarks
• Generating aggregate usage statistics for internal reporting
• Detecting and preventing abuse, spam, scrapers, and security threats
• Monitoring for unusual access patterns that may indicate account compromise

Legal & Compliance

• Complying with applicable laws and regulations in the jurisdictions where we operate
• Responding to lawful requests from law enforcement or government authorities
• Enforcing our Terms of Service and other agreements
• Protecting the rights, property, and safety of Finkkle, our users, and the public

Communication

• Sending you important account updates, security alerts, and service notifications
• Responding to your support inquiries and feedback submissions
• Sending product announcements or feature updates (you may opt out at any time)

Legal Basis for Processing

For users in the European Union, European Economic Area, the United Kingdom, or other jurisdictions with similar data protection frameworks, we process your personal data on the following legal bases:

Contractual Necessity

The majority of data processing we perform is necessary for the performance of our contract with you — specifically, to provide the Finkkle search service as described in our Terms of Service. This includes processing your search queries, managing your account, delivering results, and maintaining your session. Without this processing, we would be unable to deliver the service you signed up for.

Legitimate Interests

Some processing is carried out based on our legitimate interests in operating, improving, and securing Finkkle, where those interests are not overridden by your fundamental rights and freedoms. This includes:

• Security monitoring and abuse detection
• Aggregate analytics for product improvement
• Server logging for performance and incident response
• Improving ranking algorithms using de-identified behavioral signals

Legal Obligation

In some cases, we are required by law to process or retain certain data — for example, to comply with tax, financial, or law enforcement obligations. We process only what is strictly required to fulfil such obligations.

Consent

Where we rely on consent as a legal basis — for example, for optional analytics tracking or non-essential cookies — we will obtain your explicit consent before processing begins. You may withdraw your consent at any time through your account settings or by contacting us. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law. When data is no longer needed, we delete or anonymize it securely.

When you delete your account, we initiate a deletion process that removes your personal data from our active systems within 30 days. Residual copies may exist in encrypted backups for up to 90 days following deletion, after which they are permanently purged as part of our standard backup rotation cycle.

Your Data Rights

Regardless of where you are located, we are committed to respecting your rights with respect to your personal data. Depending on your jurisdiction, you may have some or all of the rights described below.

Right to Access

You have the right to request a copy of all personal data we hold about you, along with information about how it is used and with whom it is shared. Submit a request to [email protected], and we will provide your data in a machine-readable format (JSON or CSV) within 30 days. We may ask you to verify your identity before fulfilling this request to protect against unauthorized access.

Right to Correction (Rectification)

You can update your account profile information — including your name, email address, birthdate, gender, and profile photo — directly in the Finkkle settings page. If you believe any other data we hold about you is inaccurate or incomplete, contact us and we will investigate and correct it where appropriate.

Right to Deletion (Erasure)

You can request the deletion of:

• Individual search history entries, via the History section in your account
• Your entire search history and usage data, via account settings
• Your complete account and all associated personal data

Some data may be retained after deletion if required by law or for legitimate business purposes such as fraud prevention. We will inform you of any such exceptions at the time of your request. Submit deletion requests through your account settings or by contacting [email protected].

Right to Data Portability

You can request your personal data in a structured, commonly used, and machine-readable format (JSON or CSV) so that you can transfer it to another service. Contact [email protected] to initiate a data export. We will provide the export within 30 days.

Right to Restrict Processing

You can request that we pause certain types of processing of your data — for example, if you believe the data is inaccurate and want us to stop using it while we investigate. You can also disable personalization from your privacy dashboard, which stops Finkkle from learning new preferences based on your behavior while retaining your existing account data.

Right to Object

You can object to certain types of processing, including processing based on legitimate interests and processing for direct marketing (if we ever introduce it). You can opt out of analytics tracking and personalization features through your account preferences. We will honor such objections except where we have a compelling legitimate interest that overrides your rights, or where processing is required by law.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time through your account settings or by contacting us. Withdrawal does not affect the lawfulness of any processing that occurred before withdrawal, but we will cease the relevant processing going forward.

Right Not to Be Subject to Automated Decision-Making

We use automated systems to personalize and rank search results. You have the right to request human review of any automated decision that significantly affects you, and to object to purely automated processing for high-stakes decisions. See the Automated Decisions section below for more detail.

How to Exercise Your Rights

1. Visit your account settings page for self-service options including history deletion, personalization controls, and data export
2. For requests that require identity verification or cannot be fulfilled self-service, email [email protected] with the subject line "Data Subject Request" and a clear description of your request
3. We will acknowledge your request within 5 business days and respond fully within 30 days (or within the timeframe required by applicable law)
4. If we are unable to fulfil your request in whole or in part, we will explain why and inform you of any avenue for appeal or complaint

We do not charge a fee for exercising your data rights, except in cases of manifestly unfounded or excessive requests, in which case we may charge a reasonable administrative fee or decline to act on the request.

Third-Party Data Sharing

We are committed to protecting your personal data and do not sell it, rent it, or trade it to any third party. We do not share your data with advertisers or marketing agencies. We share data with third parties only in the limited circumstances described below.

Infrastructure & Service Providers

We share data with carefully vetted third-party vendors who process data on our behalf to help us operate Finkkle. These vendors are bound by Data Processing Agreements and are only permitted to use your data as instructed by us.

Supabase — Authentication & Identity

• Data shared: Account credentials, email address, display name, profile photo, authentication claims and tokens
• Purpose: User authentication, identity verification, and session management
• Compliance: Supabase is a GDPR-compliant data processor and maintains Standard Contractual Clauses for international data transfers

Turso — Database Hosting

• Data shared: All user-generated data stored in our database: search history, sessions, query embeddings, suggestion interactions, and analytics events
• Purpose: Secure, scalable, and encrypted data storage and retrieval
• Compliance: Turso maintains enterprise-grade security standards, encryption at rest, and strict access controls

Optional Analytics Services

If you have opted in to enhanced analytics, we may share anonymized, aggregated event data with analytics platforms to help us understand product usage at scale. This data cannot be used to identify you individually. You can opt out of this sharing at any time through your account privacy settings.

Legal Disclosures

We may disclose your personal data to law enforcement agencies, government authorities, or other third parties if we believe disclosure is necessary or required to:

• Comply with a legal obligation, subpoena, court order, or other legal process
• Protect the rights, property, or safety of Finkkle, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues
• Enforce our Terms of Service or other agreements

Where we are legally permitted to do so, we will notify you of such requests before disclosing your data.

Business Transfers

In the event of a merger, acquisition, asset sale, or corporate restructuring, your personal data may be transferred as part of the transaction. We will notify you in advance of any such transfer and explain your rights and options at that time. The acquiring entity would be required to honor this Privacy Policy or provide you with a notice of any material changes.

No other third parties have access to your personal data without your explicit consent.

Cookies & Tracking Technologies

Finkkle uses a minimal set of cookies and similar tracking technologies to operate the service. We do not use advertising cookies, cross-site tracking pixels, or third-party cookie networks. Below is a complete description of the technologies we use.

Session Cookie

• Name: __Host-session_token (or session_token in non-secure contexts)
• Duration: Until logout or expiration (governed by auth policy)
• Purpose: Maintaining your authenticated login session across requests and browser tabs
• Type: HttpOnly — cannot be accessed or modified by JavaScript, protecting against XSS attacks
• Scope: Strictly necessary; cannot be disabled while signed in

Session Context Cookie

• Name: _ix_ctx
• Duration: 15 minutes (900 seconds); refreshed on activity
• Purpose: Stores a signed, compact session context payload containing recent query patterns, inferred intent categories, and a session timestamp. Used to improve search relevance within a single session without requiring a full server-side lookup on every request.
• Data: The payload is cryptographically signed with a server-side secret and cannot be read or tampered with by client scripts
• Type: HttpOnly
• Scope: Functional; disabling this cookie reduces within-session personalization quality but does not prevent basic search from working

Local Storage

In some cases, we may use the browser's localStorage API to store non-sensitive UI preferences (such as theme settings or dismissed notices) and cached access tokens. Access tokens stored in localStorage are short-lived and are not retained beyond the browser session in most configurations.

Do Not Track (DNT)

If your browser sends a DNT signal, we will respect it and minimize non-essential data collection for your session. We will not use your data for analytics or personalization beyond what is strictly necessary to serve your search requests. However, essential cookies required for authentication and basic service functionality will remain active regardless of your DNT setting.

Cookie Consent

Finkkle will present a cookie consent banner in an upcoming update. Once available, users will be able to accept or decline non-essential cookies while retaining access to the core search service. Until then, by using Finkkle you acknowledge that essential cookies as described above will be set.

How to Control Cookies

You can control cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Note that blocking session cookies will prevent you from staying signed in. For more information on cookie management, visit your browser's help documentation.

Data Security

We take the security of your personal data seriously and implement a range of technical, organizational, and procedural measures to protect it. Our security program is informed by industry standards including OWASP guidelines and is reviewed regularly.

In Transit

• All data transmitted to and from Finkkle uses TLS 1.2 or higher encryption
• We enforce HTTPS across all endpoints, including APIs, the web application, and third-party integrations
• HSTS (HTTP Strict Transport Security) headers prevent downgrade attacks
• Certificate pinning may be implemented in future mobile clients

At Rest

• Database encryption at rest is provided by Turso and Supabase using AES-256 or equivalent
• Passwords are never stored in plaintext — Supabase manages password hashing using bcrypt or similar strong one-way functions
• Session tokens and sensitive fields are encrypted or hashed at the application level in addition to database-level encryption
• Backup data is encrypted using the same standards as primary data

Access Controls

• Role-based access control (RBAC) limits which internal systems and personnel can access personal data
• API authentication is enforced via JWT tokens with short expiry windows
• All API requests are logged, monitored, and subject to anomaly detection
• Internal access to production data is restricted to a minimal set of authorized personnel and requires multi-factor authentication

Secret Management

• API keys, database credentials, and signing secrets are stored in secure secret management vaults — never in code or configuration files
• Secrets are rotated on a regular schedule and immediately upon suspected compromise
• Secrets are scoped to the minimum permissions required (principle of least privilege)

Vulnerability Management

• We maintain a process for identifying, prioritizing, and remediating security vulnerabilities in our codebase and infrastructure
• Dependencies are regularly audited and updated to patch known vulnerabilities
• We welcome responsible disclosure of security vulnerabilities — please contact [email protected] with any findings

Incident Response

In the event of a security incident involving personal data, we will:

1. Immediately contain and assess the scope and severity of the incident
2. Notify affected users within 72 hours of becoming aware of a breach (where legally required)
3. Provide clear guidance on protective measures, including whether password resets are necessary
4. Report to relevant regulatory authorities as required by applicable law (e.g., under GDPR Article 33)
5. Conduct a post-incident review to identify root causes and prevent recurrence

Children's Privacy

Finkkle is not designed for or directed at children under the age of 13, and we do not knowingly collect personal data from anyone under 13. Our service is intended for general audiences aged 13 and older, subject to any additional age requirements that may apply in your jurisdiction.

If we become aware that a child under 13 has created an account or provided personal data to us, we will take immediate steps to delete that data and terminate the child's account. If you are a parent or guardian and believe your child has provided personal data to Finkkle without your consent, please contact us at [email protected] and we will act promptly.

For users aged 13–17, the following additional considerations apply:

• In some jurisdictions (including the EU under GDPR and certain US states), parental or guardian consent may be required before a minor can create an account. We will implement appropriate consent flows as required by applicable law.
• We encourage parents and guardians to be involved in their children's use of Finkkle and to review this Privacy Policy with them.
• Certain features may be restricted or unavailable to users identified as minors, consistent with applicable law and our commitment to age-appropriate design.

We collect age information (birthdate) at account creation specifically to support these protections. This information is not used for any other purpose and is not shared with third parties except as required by law.

International Data Transfers

Finkkle is headquartered in the United States and operates infrastructure primarily in the United States. If you access Finkkle from outside the United States, your data may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. Data protection laws in these countries may differ from those in your home country.

We take steps to ensure that international transfers of personal data are conducted lawfully and that your data is protected to a standard comparable to that required in your home jurisdiction.

GDPR Compliance — EU/EEA and UK Users

For users in the European Union, European Economic Area, or the United Kingdom, the transfer of personal data to the United States is governed by appropriate safeguards:

• Supabase and Turso maintain Standard Contractual Clauses (SCCs) as approved by the European Commission for lawful international data transfers
• We only transfer data to countries or processors that provide an adequate level of data protection, or where appropriate safeguards are in place
• You have the right to lodge a complaint with your local supervisory authority (Data Protection Authority) if you believe your rights under GDPR have been violated
• Data transfers are carried out to the extent necessary for the performance of our service contract with you, or with your explicit consent

CCPA Compliance — California Residents

Residents of California have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• You have the right to know what personal information we collect, use, disclose, and sell about you
• You have the right to delete personal information we have collected about you, subject to certain exceptions
• You have the right to correct inaccurate personal information
• You have the right to opt out of the sale or sharing of your personal information (we do not sell or share personal information as defined by the CCPA)
• You have the right not to be discriminated against for exercising your CCPA rights
• You may designate an authorized agent to submit requests on your behalf

To exercise any of the above rights, please contact us at [email protected].

Other Jurisdictions

If you are located in a jurisdiction with specific data protection laws not covered above (such as Canada's PIPEDA, Brazil's LGPD, or Australia's Privacy Act), we will comply with those laws to the extent applicable to our processing of your data. Please contact us if you have questions about how your local laws apply to your use of Finkkle.

Automated Decision-Making & Profiling

Finkkle uses automated systems — including machine learning models and algorithmic ranking systems — to personalize your search experience. We believe it is important to be transparent about how these systems work and what decisions they make about you.

How Automated Personalization Works

When you use Finkkle with an account, our systems build a profile of your interests and search behavior over time. This profile is used to:

• Reorder search suggestions based on your predicted interests and past interactions
• Adjust the ranking of search results to surface content more relevant to your inferred preferences
• Classify your queries into topic categories to improve contextual understanding across a session
• Generate query embeddings (vector representations) to enable semantic and related-query search

Impact and Limitations

These automated systems affect which results and suggestions are shown to you, but they do not make decisions that produce significant legal effects or similarly significant impacts in the legal sense. Personalization is designed to improve search relevance, not to exclude you from information, discriminate against you, or deny access to services.

Your Controls

You have meaningful control over personalization:

• You can disable search personalization from your privacy dashboard, at which point results will be based on your query alone, without reference to your history
• You can delete your search history, which removes the data used to build your profile
• You can clear individual history entries to remove specific signals from your profile
• Guests (non-signed-in users) receive results without account-level personalization

If you have concerns about how automated personalization is affecting your experience, please contact us at [email protected] and we will investigate.

Third-Party Links & Services

Finkkle's search results will naturally include links to third-party websites and services. When you click on a search result and visit a third-party site, you leave Finkkle's environment and your interactions on that site are governed by that site's own privacy policy and terms of service.

We are not responsible for the privacy practices or content of any website that you visit via a link in Finkkle search results. We encourage you to read the privacy policies of any third-party sites you visit, particularly if you intend to share personal information with them.

Finkkle does not control how third-party websites handle data about the referral from our service. Where technically possible, we configure outbound links to minimize referrer information that is passed to third parties, but we cannot guarantee that all browsers or configurations will honor these settings.

Third-Party Integrations

In the future, Finkkle may offer integrations with third-party tools and services (for example, bookmarking tools, browser extensions, or collaboration platforms). If and when such integrations are introduced, we will update this Privacy Policy to describe the data sharing involved and provide you with an opportunity to consent before any integration is activated.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, technology, legal obligations, or business operations. We are committed to keeping you informed about such changes in a clear and timely manner.

When we make changes to this policy, we will:

1. Update the "Last Updated" date at the top of this page
2. Notify you via email at the address associated with your account if the changes materially affect your privacy rights or our data practices
3. Display a prominent notice within the Finkkle interface when significant policy changes take effect
4. Obtain your explicit consent for any changes that represent a material change in how we use your personal data, where required by applicable law

Your continued use of Finkkle following the posting of a revised Privacy Policy constitutes your acceptance of the changes, except where applicable law requires explicit consent. If you do not agree with the revised policy, you should discontinue your use of Finkkle and may request deletion of your account and associated data.

We encourage you to review this Privacy Policy regularly to stay informed about our practices. Previous versions of this policy are available upon request by contacting [email protected].