Privacy policy
Findings · Version 1.1 · 29 September 2026
Findings is made by YINDOR. This page says what we store, why, for how long, and what you can ask of us. It is short because we store little.
1. Who we are
YINDOR, Torenallee 20, 5617 BC Eindhoven, the Netherlands. Chamber of Commerce (KvK) 42120380. VAT NL005510443B52.
Privacy questions and requests: privacy@yindor.com. We answer within one month.
2. Two roles, depending on who you are
- You have a Findings account. Your data stays yours. YINDOR looks after it, uses it only to run Findings for you, and answers to you for how it is handled. In legal terms we are the controller, and this policy applies to you in full.
- You pressed the Findings button on someone else's website or app. Your report belongs with that website. YINDOR keeps it safe on their behalf and uses it for nothing else. In legal terms they are the controller and we are their processor, so their privacy notice applies. Send your request to them. If you send it to us, we pass it on to them. Section 7 says what we store for them.
3. What we store about account holders
| What | Why | Legal basis | Kept |
|---|---|---|---|
| Email address, password (only as a hash, never the password itself), name if you give one, last sign-in time | To run your account | Contract (GDPR art. 6(1)(b)) | Until you delete your account |
| Your answer to "how many sites or apps do you run?" and the link that brought you (a UTM tag) | To learn which launch channels work and who Findings suits | Legitimate interest (art. 6(1)(f)) | Until you delete your account |
| Your answer to "what would make you pay?", if you give one | To set a fair price | Legitimate interest | Until you delete your account |
| A salted hash of the IP address you signed up from | To stop abuse | Legitimate interest | Until you delete your account |
| A hash of your session cookie and your browser's user agent | To keep you signed in, and to let you recognize your sessions | Contract | 30 days after last use |
| Sign-in attempts: the email typed and a salted hash of the IP address | To stop password guessing | Legitimate interest | 7 days |
| The Pro list: your email, the price band you chose, the launch link, a salted IP hash | To tell you when Pro opens and to set its price | Consent (art. 6(1)(a)), which you can withdraw at any time | Until you ask us to remove you |
You must give an email address and a password to open an account. Everything else is optional or created by using the service.
4. What we do not do
- No screenshots, no session replay, no recording of page content.
- No analytics, no advertising, no tracking cookies. We sell nothing to anybody.
- No raw IP addresses are stored. Where we need to recognize repeated requests, we keep only a salted hash, and only for the periods above.
- No automated decisions about you.
- No email from the service. If we write to you, a person does it, from a yindor.com address.
5. Cookies and local storage
findings.dev sets four cookies. Each is strictly necessary for something you asked for, so we do not ask for consent. None tracks you, none is shared, and all are marked HttpOnly, so no script on the page can read them.
| Cookie | What it does | Kept |
|---|---|---|
f_session | Keeps you signed in | 30 days after last use |
f_view | Remembers whether you chose cards or a table on your overview | 1 year |
f_last_product | Remembers which product you last filed a find on, so the add form starts there | 1 year |
f_metoo_<product> | On a public product page, remembers which cards you pressed "me too" on, so a second press is not counted twice. Only the card numbers, nothing about you | 1 year |
The Findings button on a website stores up to three things in the visitor's own browser (localStorage): where the button sits on the screen, reports waiting to be sent while the device is offline, and, on a site with no sign-in, the tester link the site owner gave you. These stay on the device. They leave it only when a report is sent.
6. Where your data is and who helps us
Everything is stored in the European Union.
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH, Germany | The server and the database | Helsinki, Finland |
| Hetzner Online GmbH, Germany | Encrypted daily backups | Falkenstein, Germany |
| Migadu-Mail GmbH, Switzerland | The mailbox that receives mail to privacy@yindor.com | Switzerland (EU adequacy decision) |
Backups are encrypted before they leave the server. Hetzner cannot read them. We have a data processing agreement with Hetzner. We do not transfer your data outside the EU, except for mail you send us, which is held in Switzerland.
7. What we store for the websites that use Findings
When someone presses the button on a customer's site, we store for that customer:
- the sentence typed, the page path, the screen size, the browser's user agent, the build and environment, and the date;
- an email address, only if the person is signed in on that site or typed one into the optional field;
- for signed-in people, the email and role the site passed to us, for 12 hours;
- a salted hash of the IP address, for 7 days, to limit abuse.
The customer keeps a report until they delete it, the site or their account. The customer's own privacy notice covers this. Our processor agreement with them sets the rules.
8. How long backups keep deleted data
When you delete your account, it is removed from the live database at once. Copies can remain in encrypted backups for up to 6 months until those backups expire. We never restore a deleted account from a backup unless we have to restore the whole service after a failure. If that happens, we delete your account again.
9. Your rights
You can ask to see, correct, delete or receive a copy of your data, to restrict or object to how we use it, or to withdraw your consent for the Pro list. You can delete your account yourself on findings.dev. For anything else, write to privacy@yindor.com. There is no self-service export yet, so we send your data by hand.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would prefer to hear it from you first.
10. Changes
If this policy changes in a way that matters to you, we say so on findings.dev at least 30 days before the change takes effect. The version and date are at the top.