Privacy Policy

Information we collect

We collect information in the following categories, depending on how you use FindOzi:

• Account and profile. When you register, we collect identifiers such as email address, username, and a password (stored as a password hash, not in plain text). We may also store optional profile fields such as first and last name, display name, avatar, short bio, skills, social link fields, and public profile options you choose, consistent with our user model.
• Authentication and security. We may issue a signed JSON Web Token (JWT) to your session after email/password sign-in, and we store per-device session records in our database, including a session id, and may store IP address and user agent string to help with security, fraud prevention, and sign-out. If you use Google sign-in, we may process profile identifiers provided by Google under our OAuth flow (as configured in the application) and link them to your account.
• Search and product usage. We may process search queries, filters, and category selections you use on the site. The application may also maintain aggregate usage counters (for example, search-related usage metrics tied to an account) and can record interaction events that support ranking, product improvement, and abuse prevention.
• Favorites, saved content, and preferences. We store tools you add to favorites (including any notes, tags, or collection names you add), saved prompts, roadmap items, and similar account-bound content. The user profile may also store category or keyword frequency preferences to personalize discovery.
• LearnLab activity. The application is designed to support a history of actions related to learn content, such as views, copy events, and tutorial progress, when those features are enabled for your account.
• Submissions and community. If you submit a tool, feedback, or other content, we process the data you provide (for example, tool name, website URL, description, and category) and may associate it with your account, status, and moderation outcomes.
• Payments and billing (Premium). If you purchase a paid plan, we process payment and subscription data through a payment service provider. We store subscription status, billing cycle, current period start and end, and references to the provider’s order and payment identifiers, along with a billing history array for receipts and support. We do not store full payment card numbers on our servers; card data is typically handled on the payment provider’s side.
• Email and transactional messages. We may use an email service provider to send verification, password reset, and account-related email. Those sends require processing your address and the content of the message.
• AI-powered features. When you use features that call our backend’s search or assistant flows, the service may send relevant portions of your request to an AI inference API (in our stack, Groq’s API is used in code with your query context) to generate or refine search responses. We do not use your payment card in that process.
• Server and operational logs. Like most sites, we may collect server logs, error logs, and similar diagnostic data, which can include IP address, user agent, timestamps, and request paths, for reliability and security.

How we use your information

We use the information we collect to:

• Provide, operate, and improve FindOzi, including search, the tool directory, LearnLab, and account features;
• Authenticate you, protect accounts, and enforce rate limits, fraud detection, and session invalidation (including at sign-out and password changes);
• Process payments and support billing questions through data returned by the payment provider;
• Send transactional email (for example, verification, password reset) through our email service provider, when you trigger those flows;
• Comply with law, respond to valid legal requests, and enforce our terms and acceptable use rules;
• Analyze product usage in aggregate to improve search quality, ranking, and user experience, and to develop new features.

Data storage and security

Data you provide is primarily stored in a MongoDB database associated with the deployment (as reflected in the application’s configuration, including MONGO_URI). We take reasonable technical and organizational measures to protect your information, including transport encryption (HTTPS) for the site, server-side access controls, and not storing full card details on our own database. No method of transmission or storage is completely secure. If a breach affects your data, we will act as required by applicable law and, where practicable, notify you.

Third-party services

FindOzi uses the following third-party services to operate. Each provider's use of your data is governed by their own privacy policies, which we encourage you to review.

• MongoDB (database). All user data, tool listings, payments, and application records are stored in MongoDB. MongoDB hosts our database infrastructure and processes data according to their data processing terms.
• Groq AI (search intelligence). When you use FindOzi's AI-powered search, your search query text is sent to Groq's API to extract intent, match tools, and generate smart recommendations. We do not send your name, email, or payment data to Groq. Your query is used only to improve the search result you receive.
• Razorpay (payments). All Premium subscription payments and tool launch credit purchases are processed through Razorpay. Razorpay handles card numbers, UPI details, and payment authentication directly — we do not store your full card number on our servers. We store order IDs, payment reference IDs, subscription status, and billing amounts for your records.
• Google OAuth (sign-in). If you choose to sign in with Google, Google authenticates your identity and shares your name and email address with us under your Google account's permission. We use this only to create or access your FindOzi account. We do not receive your Google password.
• Resend (transactional email). Verification emails, password reset links, and account-related notifications are sent via Resend. Your email address is shared with Resend only to deliver messages you have requested.
• Zoho (business email). FindOzi's support and contact emails ([email protected], [email protected]) are hosted on Zoho Mail. Messages you send to these addresses are stored on Zoho's servers according to Zoho's privacy policy.

Cookies and local storage

The web application may use browser local storage to persist a session token and a cached copy of basic user information for a smoother experience, including after refresh. The token is a signed JWT, not your raw password. When you sign out, the client is designed to clear those items. The server also maintains a record of sign-in sessions in the database, including a session id embedded in the token. The payment provider or authentication provider (for example, Razorpay’s hosted checkout or Google’s OAuth) may set their own cookies or storage in their own domains or iframes while you use their UIs. For more detail, see our Cookie Policy.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing. You can update some profile data in your account settings when available. For requests we cannot resolve in-product, or to exercise deletion, contact us at [email protected] and include enough detail to verify your identity.

Children’s privacy

FindOzi is not directed to children under 13 (or the age of digital consent in your region, if higher), and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will take appropriate steps, including deletion where required.

Changes to this policy

We may update this Privacy Policy to reflect product, legal, or security changes. We will post the new version on this page and adjust the “Last updated” line when we do. If a change is material, we will provide a clearer notice (for example, by email or in-product) where the law requires.

Contact

For privacy questions, data access requests, or deletion requests, contact us at [email protected]. We respond within 24 hours. Our registered address is Etawah, Uttar Pradesh, India.