Privacy Policy

1. Data we collect

We collect only what is needed to run your radar.

• Account: email address, password (stored only as a scrypt hash), display name, language, country, time zone, plan and role. Guest accounts have no email.
• Your radar: items you track (names, manufacturer, model or version, identifiers such as GTIN/VIN/version, URLs of official pages you register, notes), workspace membership and invitations.
• Activity: alerts shown to you, read status, action status, notes, feedback (e.g. “not relevant”) and notification preferences.
• Notifications: web push subscription endpoint and keys for the browsers you enable.
• Developer features: API key names and hashed keys, webhook URLs and signing secrets, daily API request counts.
• Usage analytics: page path, language, referring site, country (from our CDN header), device type, browser and OS family, UTM tags and a visitor identifier that is a one-way hash of the IP address and user agent with a salt that rotates daily. We do not store raw IP addresses for analytics.
• Security logs: session records (hashed token, user agent, hashed IP), audit logs of sensitive actions, and short-lived server logs.

2. Data we do not collect

• Passwords or login tokens for any other service.
• Bank, card or payment details (the Service is free during beta).
• The contents of your email inbox or messages.
• Precise location, contacts, camera or microphone data.

3. Why we use it (purposes and legal bases)

• To provide the Service — matching your items to official change events, showing alerts and sending notifications you enabled (contract performance; GDPR Art. 6(1)(b)).
• To keep accounts secure and prevent abuse, including rate limits and fraud prevention (legitimate interests; Art. 6(1)(f)).
• To improve matching quality from feedback, first for your own radar and then, in aggregate, only when at least several different users independently agree; aggregated rules never identify who contributed (legitimate interests).
• To understand usage in aggregate and fix problems (legitimate interests; analytics use hashed identifiers only).
• To send service emails such as password resets, invitations and alerts you requested (contract). Marketing emails only with your opt-in consent (Art. 6(1)(a)), which you can withdraw at any time.

4. Retention

• Account and radar data: until you delete your account. Deletion is immediate and irreversible.
• Guest accounts: deleted automatically after 90 days of inactivity.
• Sessions: up to 30 days; password-reset and verification tokens: up to 24 hours.
• Usage analytics (page views): 400 days, then deleted.
• Source check logs: 90 days. Product event logs: 400 days.
• Data exports you request: available for 7 days.
• Audit logs of security-relevant actions: up to 1 year, unless a longer period is required by law.

5. Processors and international transfers

We do not sell or rent personal data and do not provide it to third parties for their own purposes. We entrust processing to the following service providers under contracts that require confidentiality and security:

• Cloudflare, Inc. (USA, global network) — website delivery, CDN and security.
• Railway Corp. (USA) — application servers and PostgreSQL database hosting.
• Resend (USA) — delivery of transactional and alert emails (email address, message content).
• Browser push services (Google, Mozilla, Apple, Microsoft) — delivery of web push messages you enabled (encrypted payload).
• OpenAI, L.L.C. (USA) — summarising public notices from official sources. Only public source text is sent; your account, items or other personal data are never sent.

These providers may process data outside your country, including in the United States. Where required, transfers rely on adequacy decisions, Standard Contractual Clauses or your consent. Under PIPA, the items transferred, destination country, timing (when you use the Service, via network), recipient and purpose are as listed above; you may refuse by not using the relevant feature or by deleting your account.

6. Your rights

You can access, correct, export (JSON or CSV) and delete your data directly in Settings → Data. You may also object to or restrict processing, withdraw consent, and lodge a complaint with your data protection authority (in Korea: the Personal Information Protection Commission, or the KISA privacy center at 118). California residents have the right to know, delete and correct, and the right not to be discriminated against; we do not sell or share personal information for cross-context behavioural advertising. Contact us at the address below and we will respond within 30 days (10 days for PIPA requests where required).

7. Cookies and local storage

We use one strictly necessary cookie (rr_session) to keep you signed in. We store a few preferences (such as theme, language and dismissed banners) in your browser’s local storage. We do not use advertising or third-party tracking cookies, so no consent banner is needed for them.

8. Destruction

When the retention period ends or you delete your account, data is deleted from the live database immediately using methods that prevent recovery; database backups held by our hosting provider expire on their rolling schedule (at most 30 days).

9. Security

We use encryption in transit (TLS/HSTS), hashed passwords and session tokens, server-side ownership checks for every request, a strict Content Security Policy, rate limiting, least-privilege access and SSRF protection for pages you register. No system is perfectly secure; we will notify you and the authorities of a breach as required by law.

10. Children

The Service is not directed to children. Users in Korea must be 14 or older, users in the United States 13 or older, and users in the EU at least the age of digital consent in their country (13–16). If we learn that we collected data from a child below these ages, we will delete it.

11. Privacy officer and contact

Privacy officer: Reality Radar privacy team, Project Team For You. Email: projectteamforyou@gmail.com. We handle privacy requests and complaints in Korean and English.

12. Changes

We will announce material changes on this page and by email or in-app notice at least 7 days before they take effect (30 days for changes unfavourable to you).