Privacy policy

1. Controller and contact

The controller of personal data processed in FigurAlert is [to be completed], [to be completed]. For anything about your data, write to [to be completed]. Below we describe exactly what the site stores, why, on what legal basis (GDPR) and for how long.

2. Account

If you create an account, we process:

• your email address and password (the password is stored, hashed, by our authentication provider Supabase Auth; we never see it in plain text);
• an optional display name, the account language (for account pages and alert emails) and your consent to alert emails;
• a random unsubscribe token (so the link in an email can turn alerts off without logging in);
• watched figures, your alerts (kind, threshold, settings) and the history of notifications sent (which offer, price, time, delivery status).

If you sign in with Google, Google passes us your email address and basic profile data (name, picture) within the email, profile and openid scopes. Legal basis: performance of the contract for providing the account (Art. 6(1)(b) GDPR).

In account settings you can download all this data as a JSON file (right to data portability, Art. 20 GDPR) and permanently delete your account. Deletion removes the account and all related data (profile, watchlist, alerts, notification history) at once and cannot be undone.

3. Email alerts

Alert emails and login emails (address confirmation, password reset, login link) are sent through Resend, an email delivery provider. Every alert email has a one-click unsubscribe link (also in the List-Unsubscribe header), which works without logging in. You can turn emails back on in account settings.

4. Login security

To stop password guessing we count login, sign-up and password reset attempts. The counter key is a SHA-256 hash of the email address or of the IP address, not the address itself, and records are deleted after a day. Legal basis: our legitimate interest in protecting accounts (Art. 6(1)(f) GDPR).

5. Going to shops (/go links)

"Go to shop" buttons lead through our address /go/..., which counts the click and redirects you to the shop. For a click we store: the offer, the figure, the shop, where on the site the click came from, the time and a random click token. We don't store your IP address or your account ID, so a click cannot be linked to you.

The click token is a random identifier drawn anew for every redirect. It is not derived from your IP address, session or account. For affiliate links we pass it to the affiliate network as a "subID", so that a commission in the network's report can be matched to a click. The network does not receive any other data from us.

To limit fake clicks, a daily hash of your IP address is counted only in the server's memory for a short time and is never written to the database. After the redirect you are on the shop's or affiliate network's site: they may set their own cookies (e.g. to attribute a commission) under their own privacy policies. FigurAlert does not set or read those cookies.

6. Visit statistics

We count page views by people (not bots) without cookies and without localStorage. A short script sends a single request only after your first interaction with the page (scroll, click, key press). For a page view we store:

• the page path without query parameters, the language version, the day and time;
• the traffic source category (direct, search, social, email, campaign, referral) and the host of the referring site (without the full address or search terms);
• utm_source, utm_medium and utm_campaign parameters, if the link had them;
• flags "first view by this visitor today" and "first view of this page by this visitor today".

We don't store your IP address, account ID, browser user agent or device features (screen, time zone etc.). To compute the flags, a daily hash of the IP address (SHA-256 with a secret salt and the date, changing every day) is kept in a separate table for at most 2 days, then deleted. Logged-in site administrators are not counted. Legal basis: our legitimate interest in knowing site traffic, also for affiliate programmes (Art. 6(1)(f) GDPR).

7. Server logs

For every request the server writes one log line: method, path (without query parameters), response status and time, the browser user agent (up to 160 characters), a daily IP hash and technical signals from request headers (e.g. whether the browser sent a language header), used to tell people from bots. The raw IP address is not logged. Logs are kept for 14 days. Purpose: security, failure diagnosis and protection against bots (Art. 6(1)(f) GDPR).

8. Cookies

We only use cookies that are strictly necessary for logging in:

• sb-...-auth-token (may be split into parts): the login session, set only after you log in, valid for up to 30 days without a visit;
• fa-recovery: set during password reset, valid for 15 minutes.

We don't use analytics or advertising cookies, and fonts are served from our own server (no requests to Google Fonts). Cookies of shops and affiliate networks are described in section 5.

9. Recipients and processors

Data is processed on our behalf by service providers:

• Amazon Web Services: hosting of the site and logs (EU, Frankfurt region) and the CloudFront content delivery network;
• Supabase: database and user authentication;
• Resend: email delivery;
• Google: only if you choose to sign in with Google;
• Cloudflare: domain handling.

Affiliate networks and shops receive only the random click token, which is not personal data. If a provider transfers data outside the European Economic Area, it does so on the basis of the European Commission's standard contractual clauses or an adequacy decision (e.g. the EU-US Data Privacy Framework).

10. How long we keep data

• account data, watchlist, alerts and notification history: until you delete your account;
• login attempt counters: up to a day;
• daily IP hash for visit statistics: up to 2 days;
• server logs: 14 days;
• clicks and page views (no personal data): as long as needed for statistics and affiliate settlements;
• session cookie: up to 30 days; password reset cookie: 15 minutes.

11. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability and to object to processing based on our legitimate interest (Art. 6(1)(f) GDPR). Most of this you can do yourself in account settings; otherwise write to the address in section 1. You also have the right to lodge a complaint with the supervisory authority, in Poland the President of the Personal Data Protection Office (Prezes UODO).

12. Profiling and changes

We don't profile users and make no automated decisions that have legal effects. When the site changes what data it collects, we update this policy and its date. The rules for using the site are in the terms of service.