Privacy Policy

FindWaldois operated by 【legal entity name and registered address】 (“we”), the data controller for the personal data described here. For any privacy question or to exercise your rights, contact us at privacy@findwaldo.xyz.

Account data — your name, email address, and a securely hashed password (or, for Google or GitHub sign-in, your name and email from that provider). Used to create and secure your account. Legal basis: performance of a contract.

Interest / watcher data— when you register interest in a name, the platform (X, Discord, or Telegram) and handle you provide. This is shown to other signed-in users so a name’s owner can contact you. Registering interest may also trigger an automated public post on our X (Twitter) account naming the domain and how many people are watching it — never you or your handle. Legal basis: performance of a contract / your submission of the data.

Ownership / listing data — when you claim a domain you own, we store the name, your chosen contact method and any asking price, and a verification token you publish (in DNS/Handshake or ENS) to prove control. A verified listing and its price are public; your contact is shown to signed-in users. Legal basis: performance of a contract / your submission of the data.

Technical data — your IP address is processed transiently to rate-limit sign-in attempts and prevent abuse. It is held only in memory for a short window and is not stored. Legal basis: our legitimate interest in security.

Analytics data — only if you accept analytics cookies, Google Analytics collects usage data (pages viewed, approximate location, device/browser). Legal basis: consent, which you can withdraw at any time.

Essential — a secure, http-only token cookie keeps you signed in, and a small amount of local storage holds your display name and your cookie choice. These are required for the site to function and are always on.

Analytics — Google Analytics sets _gacookies. These load only after you choose “Accept” on the cookie banner, and never before.

Managing your choice — you can change or withdraw analytics consent at any time; declining also expires the analytics cookies already set.

We use the following processors, each under a data-processing agreement:

• MongoDB Atlas — database hosting (region: EU (Germany)).
• Nodemailer over our SMTP provider — sending verification emails.
• Google — sign-in (OAuth) and, with consent, Google Analytics.
• GitHub — sign-in (OAuth).

We do not sell your personal data.

Some processors (for example Google) may process data outside the EEA. Where that happens, transfers are covered by Standard Contractual Clauses (and, for Google, the EU–US Data Privacy Framework).

We keep account data for as long as your account is active, and delete it when you delete your account. Unverified accounts (created but never activated via the email link) are removed after 90 days. Watcher entries and listings are kept until you remove them or delete your account. Rate-limiting data is discarded within minutes.

You have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, and to withdraw analytics consent at any time. You can delete your account yourself at any time from the account menu, which permanently erases your profile along with your watcher entries, favourites and listings. To exercise the other rights, contact privacy@findwaldo.xyz. You also have the right to lodge a complaint with your local data protection authority.

We may update this policy from time to time. Material changes will be reflected in the “last updated” date above.