Privacy Policy

Last updated: October 31, 2026

ToFinder (tofind.online) helps you find public posts and local businesses that look like they need the service you sell. This page explains, in plain language, what data we handle, where it goes, and who receives it.

What we collect

• Account: your email and a password. The password is stored only as a one-way hash — we can't read it. If you use the product as a guest, we create a temporary anonymous account instead.
• What you type: the service you sell and the searches you run (we call them missions). We store the search text and its results so you can reopen them later.
• Results and leads: the public posts and business details a mission finds (for example a name, a handle, a link, a company or a public post text), and the messages you draft or send through the tool (recipient, subject, body).
• Connected accounts (only if you connect them): your email login (SMTP/IMAP) or a social session, so the tool can send or read messages on your behalf. These credentials are stored encrypted.
• Billing: if you subscribe, Stripe gives us a customer ID and your plan and status. We never receive or store your card number.
• Anonymous usage counts: the day, the page, the event and the referring site. No IP address and no user-agent are stored for this.
• Security: the IP address used to create an account, to prevent abuse.

Journey analytics (optional)

If you accept analytics, we also store pseudonymous product-usage events: a random session id, the page path (without query strings), the event type, an explicit element identifier (for example a button name), the acquisition host, and the time the page was visible. For clicks we also store normalized on-screen coordinates and the scroll position at the click; for scrolling we store the maximum depth reached (percentage) and the 25/50/75/90/100% milestones. Inside the app, each screen change starts a new time measurement. This is first-party, sets no analytics cookies and keeps this data for up to 90 days. It never records passwords, form contents, private messages, contact data or tokens, and it does not use fingerprinting.

You can change this anytime in the app under Settings → Analytics consent.

Where it is stored

On our servers (hosted by Render, with the web front end on Vercel). Signing in uses HttpOnly cookies; the marketing pages set no tracking cookies. We keep your data while your account is active.

Who receives it

We do not sell your data. We share only the minimum needed to run the product:

• AI providers (for example Google, Groq, NVIDIA, Requesty or OpenRouter): the text needed to read posts and draft messages. When the tool drafts a cold email, that text can include the lead's name, company and email.
• Public data sources (Reddit, Hacker News, Product Hunt, Bluesky, OpenStreetMap, Google and public company registries): the search terms or city you enter, so they can return public results.
• Message providers (your own email server, Telegram): the messages you send and the address or handle they go to.
• Stripe: your email and payment details, to process subscriptions.
• Hosting: Vercel and Render process the requests.
• Google Fonts: our marketing pages load a web font from Google, which sees your IP address.

Your choices

• Use the tool as a guest without giving an email address.
• Disconnect any account you connected, and delete a mission's results.
• Ask us to delete your account and its data.

Who is responsible

Data controller: Nicolas Bezerra. Contact: contato@tofind.online.

Changes

We will update this page when what the product does with data changes.