We collect account basics (email, name if provided), usage data (queries, IP-derived location, user agent, timestamps), and authentication data via Supabase. We do not sell or rent data.

• Use of data. Provide and improve search, enforce rate limits, analyze accuracy, and comply with legal requirements.
• Storage & security. Supabase (DB/auth), Railway (hosting), Redis (cache); HTTPS/TLS, secure auth, rate limiting, regular updates.
• Sharing. Service providers only (Supabase, Railway, OpenAI for query understanding—no personal data, Cloudflare). Legal disclosures if required.

Your rights: access, correct, delete, export, opt-out, and object (where applicable). Contact us via the contact page. GDPR users: additional rights (erasure, portability, restriction, objection to automated decisions).

Cookies, retention, and children

Essential cookies for auth and rate limits; Plausible analytics (no cross-site tracking). Account data retained while active; search logs for 2 years; cached results indefinitely (no personal data); deleted accounts cleared within 30 days. Service not for children under 13.

International users consent to transfer where our providers operate. We may update this policy and will notify you of significant changes.