Privacy Policy
Effective date: September 2, 2026 Last updated: September 2, 2026 Operator: Z K Enterprises ("Flought," "we," "us") at flought.com
This policy explains what data we collect, how we use it, who we share it with, and your choices. It applies to the Flought website, APIs, and related services. Contact: privacy@flought.com.
1. Data we collect
Account & profile
- Email address, display name, and authentication details (for example OAuth provider ID such as Google, or password hash if password auth is enabled)
- Optional maker profile fields (bio, social links)
- Domain verification records when you verify a domain
Listing data
- Product name, tagline, description, URLs, images, tags, and launch metadata
- Listing tier (free board row vs Flought Page)
Click & ranking data
When someone clicks Visit, we record a server-side redirect event to power organic rankings and fraud prevention. Typical fields include:
- Listing ID and timestamp
- Hashed IP address (hashed at ingest; we do not keep raw IPs as the long-term identifier for ranking)
- User-agent, referrer, placement tag (organic vs featured slot)
- Device/session fingerprint derived from cookies or similar for deduplication
- Fraud score and, if signed in, user ID (for self-click prevention)
We do not sell click data to third parties for advertising. Server redirect validation is the authoritative click signal for ranking.
Payments
Payments are processed by Dodo Payments (international) and/or Razorpay (India and supported regions). Flought may receive customer/order identifiers, payment status, amount, billing country, and limited billing metadata (such as last four digits of a card). Full card numbers are handled by the payment processor, not stored by Flought.
Dodo Payments and Razorpay may collect additional data under their own privacy policies when you complete checkout.
Cookies & similar tech
- Essential: session/auth, CSRF protection, fraud deduplication, auction session
- Analytics (optional): only if you accept analytics in our cookie banner — see Cookie Policy
Public social-proof stats
- Presence: the site may send a short-lived anonymous heartbeat (a random ID in session storage, refreshed about every minute while the tab is visible) so we can show an approximate “online now” count. Heartbeat keys expire in minutes and are not used for ranking.
- Visitors: we may count approximate unique browsers via a hashed IP + user-agent first-seen signal and a site-wide counter for public display. This is not the same as listing impressions, Visit clicks, or rank inputs.
Communications & logs
- Transactional email (receipts, auction notices, moderation)
- Support correspondence
- Server logs (paths, status codes, coarse geo from CDN) for security and abuse prevention
2. How we use data
- Provide accounts, listings, leaderboards, auctions, and redirects
- Compute organic rankings from validated clicks
- Detect and prevent click fraud and abuse
- Process Flought Page fees and auction payments via Dodo Payments and/or Razorpay
- Moderate content and enforce our Terms
- Send transactional messages
- Improve the product using aggregated usage patterns
- Show approximate public social-proof counts (online presence and unique visitors), which do not affect rankings
- Comply with law and respond to valid legal requests
3. Legal bases (where GDPR/UK GDPR apply)
- Contract — account, listings, and payment processing needed to provide the service
- Legitimate interests — click tracking for fair ranking and fraud prevention, with safeguards such as IP hashing and limited retention
- Consent — non-essential analytics cookies where required
- Legal obligation — tax, accounting, and lawful requests
4. Sharing
We share data with processors who help run Flought, such as:
- Dodo Payments — payment processing (international)
- Razorpay — payment processing (India and supported regions)
- Hosting / database / cache / email / job providers we use to operate the service (for example cloud hosting, database, Redis, transactional email, background jobs)
We do not sell personal information. We may disclose data when legally required, or in connection with a merger or sale (with continued protection of the data).
5. Retention
| Data | Typical retention |
|---|---|
| Account data | Life of account + ~30 days after closure (subject to legal holds) |
| Listing content | Life of listing + ~90 days (longer if removed for abuse investigation) |
| Raw click event logs / hashed visitor signals | Up to 90 days, then delete or aggregate |
| Aggregated click counts | Indefinite (tied to listing, not to visitors) |
| Presence heartbeat keys | Minutes (TTL ~5 minutes) |
| Site visitor first-seen keys / public visitor counter | Indefinite (aggregated social proof; not ranking) |
| Payment records | Up to 7 years where required for tax/accounting |
| Moderation records | Up to ~3 years |
| Server logs | ~30 days |
Fraudulent clicks may be removed from rankings for a short retro window (about 72 hours). Underlying logs are kept only as long as needed for that process within the limits above.
6. Cookies
Essential cookies are required for login, security, and fair click counting. Optional analytics cookies load only after you accept them in the cookie banner. Details: Cookie Policy. You can also control cookies through your browser settings; blocking essential cookies may break parts of the site.
7. Your rights & self-service
Depending on your location (including EU/UK GDPR, US state privacy laws, UAE PDPL, and similar regimes), you may have rights to access, correct, delete, restrict, or export your personal data, and to object to certain processing.
In your dashboard: use Download my data and Close account under Privacy & data.
By email: privacy@flought.com — we aim to respond within 30 days (or longer where the law allows).
We do not sell personal information. California residents: we do not sell or share personal information for cross-context behavioral advertising.
If we remove your content, we will provide a brief statement of reasons by email where practical. Appeals: appeals@flought.com within 14 days.
EU Digital Services Act authority contact: dsa@flought.com.
8. International transfers
Data may be processed in India, the United States, or other countries where our providers operate. Where required, we rely on appropriate transfer mechanisms (such as contractual safeguards with processors).
9. Security
We use TLS in transit, access controls, hashed credentials where applicable, rate limits, and short-lived signed redirect tokens. No method of transmission or storage is 100% secure.
10. Children
Flought is not directed to children under 16 (or under 13 where that is the applicable US standard). We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.
11. Changes
We may update this policy. Material changes will be announced by email and/or a site notice where practical, with advance notice when required. Continued use after the effective date means you accept the updated policy.
12. Contact
privacy@flought.com · Cookie Policy · Customer Support · Terms of Service · Rules · flought.com