Privacy Policy

1. What We Collect

Depending on how you use ToolifyNav, we may collect:

• Account data — email address, name or display name, password hash, email verification status, and session cookies. Authentication data is stored in a Cloudflare D1 database (not in Sanity CMS).
• Submission data — product name, URL, description, images, pricing notes, category/tags, and related metadata you provide when listing a tool.
• Payment metadata — Waffo order and checkout identifiers, plan selection, and payment status. Card numbers are handled by Waffo Pancake; we do not store full card details.
• Usage & analytics — pages viewed, referral source, approximate location from CDN edge, Google Analytics events (after consent), and approximate listing detail-page view counts we store to rank internal trending lists (not sold as advertising profiles).
• Abuse prevention — IP-based rate limit counters in Cloudflare KV for sensitive auth and API endpoints.
• Communications — messages you send via the contact form, and newsletter subscription email if you opt in (Resend audience; you can unsubscribe anytime).

2. How We Use It

We use personal data to operate accounts, review and publish listings, process payments, send transactional email (verification, password reset, submission and payment notices), improve the directory, and prevent abuse. Public listing content is shown in the directory so visitors can discover tools. We do not sell your personal data.

3. Cookies & Consent

Essential cookies keep you signed in and secure the session. Optional analytics cookies (for example Google Analytics when configured) load only after you grant consent via our cookie banner. You can change browser settings to block cookies; some account features require essential cookies to work.

4. Sub-processors, Subprocessor List & DPA

Subprocessor disclosure / sub-processor list / data processing agreement (DPA) summary: the vendors below process personal data on our behalf to operate ToolifyNav. Each processes data only as needed under their policies and contractual data-processing terms (DPA):

• Cloudflare — hosting (Workers), DNS, CDN, D1 database for auth sessions, KV for rate limits and session versioning.
• Sanity — content CMS for directory items, submissions, blogs, and media assets.
• Waffo Pancake — Checkout and billing for Premium Launch and Highlight. Legacy Stripe identifiers may remain on older submissions.
• Resend — transactional and newsletter email delivery.
• Google Analytics (optional) — product analytics after consent.
• AI providers (when autofill is used) — URL content may be sent to configured model APIs to draft listing fields; do not paste secrets into public tool pages.

5. Your Rights

You can update profile settings from the dashboard, request correction of listing data, unsubscribe from marketing email, and request account deletion. For privacy requests, email hello@toolifynav.com. Depending on your region, you may have additional rights under applicable law.

6. Data Retention

Account and listing data is retained while your account is active and as needed for legal, security, and operational purposes. Published directory content may remain public until you unpublish or we remove it for policy reasons. Newsletter audience membership lasts until you unsubscribe or request deletion. Logs and rate-limit records are retained for short operational windows. To request account deletion, email hello@toolifynav.com; we aim to complete reasonable deletion requests within 30 days unless law requires longer retention.

7. Updates

We may update this policy as the product evolves. Material changes will be reflected on this page with a new “Last updated” date. Related documents: Terms of Service.