Privacy Policy

Effective date: August 29, 2026 Last updated: August 29, 2026 Operator: Flought ("Flought," "we," "us") at flought.com

This policy explains what data we collect, how we use it, and your choices. It applies to the Flought website, APIs, and related services. Contact: privacy@flought.com.

1. Data we collect

Account & profile

• Email address, display name, and authentication details (for example OAuth provider ID such as Google, or password hash if password auth is enabled)
• Optional maker profile fields (bio, social links)
• Domain verification records when you verify a domain

Listing data

• Product name, tagline, description, URLs, images, tags, and launch metadata
• Listing tier (free vs Verified Launch)

Click & ranking data

When someone clicks Visit, we record a server-side redirect event to power organic rankings and fraud prevention. Typical fields include:

• Listing ID and timestamp
• Hashed IP address (hashed at ingest; we do not keep raw IPs as the long-term identifier for ranking)
• User-agent, referrer, placement tag (organic vs featured slot)
• Device/session fingerprint derived from cookies or similar for deduplication
• Fraud score and, if signed in, user ID (for self-click prevention)

We do not sell click data to third parties for advertising. Server redirect validation is the authoritative click signal for ranking.

Payments

Payments are processed by Razorpay. Flought may receive customer/order identifiers, payment status, amount, and limited billing metadata. Full card numbers are handled by Razorpay, not stored by Flought.

Cookies & similar tech

• Essential: session/auth, CSRF protection, fraud deduplication, auction session
• Analytics (if enabled): usage statistics; non-essential analytics should only run with consent where required

Public social-proof stats

• Presence: the site may send a short-lived anonymous heartbeat (a random ID in session storage, refreshed about every minute while the tab is visible) so we can show an approximate “online now” count. Heartbeat keys expire in minutes and are not used for ranking.
• Visitors: we may count approximate unique browsers via a hashed IP + user-agent first-seen signal and a site-wide counter for public display. This is not the same as listing impressions, Visit clicks, or rank inputs.

Communications & logs

• Transactional email (receipts, auction notices, moderation)
• Support correspondence
• Server logs (paths, status codes, coarse geo from CDN) for security and abuse prevention

2. How we use data

• Provide accounts, listings, leaderboards, auctions, and redirects
• Compute organic rankings from validated clicks
• Detect and prevent click fraud and abuse
• Process Verified Launch fees and auction payments via Razorpay
• Moderate content and enforce our Terms
• Send transactional messages
• Improve the product using aggregated usage patterns
• Show approximate public social-proof counts (online presence and unique visitors), which do not affect rankings
• Comply with law and respond to valid legal requests

3. Legal bases (where GDPR/UK GDPR apply)

• Contract — account, listings, and payment processing needed to provide the service
• Legitimate interests — click tracking for fair ranking and fraud prevention, with safeguards such as IP hashing and limited retention
• Consent — non-essential analytics cookies where required
• Legal obligation — tax, accounting, and lawful requests

4. Sharing

We share data with processors who help run Flought, such as:

• Razorpay — payments
• Hosting / database / cache / email / job providers we use to operate the service (for example cloud hosting, database, Redis, transactional email, background jobs)

We do not sell personal information. We may disclose data when legally required, or in connection with a merger or sale (with continued protection of the data).

5. Retention

Fraudulent clicks may be removed from rankings for a short retro window (about 72 hours). Underlying logs are kept only as long as needed for that process within the limits above.

6. Cookies

Essential cookies are required for login, security, and fair click counting. Analytics or marketing cookies, if introduced, will require consent in regions that mandate it. You can control cookies through your browser settings; blocking essential cookies may break parts of the site.

7. International transfers

Data may be processed in India, the United States, or other countries where our providers operate. Where required, we rely on appropriate transfer mechanisms (such as contractual safeguards with processors).

8. Security

We use TLS in transit, access controls, hashed credentials where applicable, rate limits, and short-lived signed redirect tokens. No method of transmission or storage is 100% secure.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or export your personal data, and to object to certain processing. California and similar US state laws may provide rights to know, delete, and correct, and we do not sell personal information.

To exercise rights, email privacy@flought.com. We aim to respond within 30 days (or longer where the law allows, such as CCPA timelines). You may also complain to a data protection authority where applicable.

10. Children

Flought is not directed to children under 16 (or under 13 where that is the applicable US standard). We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.

11. Changes

We may update this policy. Material changes will be announced by email and/or a site notice where practical, with advance notice when required. Continued use after the effective date means you accept the updated policy.

12. Contact

privacy@flought.com · Terms of Service · Rules · flought.com