Privacy

What we collect

• Email address: when you submit a product, claim a listing, subscribe to the newsletter, request investor access or ask about sponsorship.
• Submission data: the product URL and the copy you or we drafted from the public page.
• First-touch attribution, when you submit a product: the referring site’s hostname (e.g. chatgpt.com) and any utm campaign tags you arrived with, so we know which channels bring submissions. Captured once per session, client-side, on the first page you land on.
• A vote signature: a one-way hash of your network address and browser string, used to stop the same person voting twice. We do not store the address or the browser string themselves and the hash cannot be reversed.
• An audit record: for writes, which action ran, against which listing, and when. This is what makes rate limits and abuse investigation possible.
• Email operations: message and link identifiers, the address contacted, the destination of an ordinary tracked link, delivery, bounce and complaint events, and whether a link request looked automated. We store a hash of the link token and browser string rather than the raw values. A link request is not treated as proof that a person clicked it.
• Support recovery: a case status, a short operational summary and any reply draft an operator prepares. Support replies are reviewed and sent by a person.

We measure site traffic with Umami, self-hosted on our own infrastructure: it is cookieless, sets no cookies and does not track you across sites, does not store your IP address in the clear, and produces aggregate statistics only, which we alone see and which are never sold or shared with advertisers. We run no advertising pixels and no third-party cookies.

While we test our pricing page we may set two first-party cookies, ab099_vid and ab099_arm, on a visitor who is not signed in. They hold a random identifier and which of two versions of the Plus pricing you were shown, so you see the same version each time and we can compare how many visitors start and complete a checkout. They last 90 days, are HttpOnly, are never shared and contain no email address. We keep the identifier with the arm, the landing page, the referrer and any utm tags, and, if you buy, with your checkout and invoice amounts. You can clear the cookies in your browser at any time; signed-in members and existing customers are not entered in the test.

When you follow an ordinary link in a Toolfound email, Toolfound may set a first-party, opaque attribution cookie for up to 28 days. It connects that email link request to a later authenticated Plus checkout or payment without putting your email address or the destination URL in the cookie. Verification, claim, password-reset and unsubscribe links stay direct; completed verification, claim and unsubscribe actions may be recorded using a one-way hash of the secret token. You can clear the attribution cookie in your browser at any time.

Badge referrer registry: when a page you embed a Toolfound badge on is viewed, we record the hostname the badge was requested from (for example example.com), a product slug and a date, so we can show a public list of the sites that embed a badge at toolfound.com/found-on. We never store the full URL, the path, the query string, the user agent or your visitors’ IP addresses. The same hostname, slug and date decide the optional badge partner tag described at toolfound.com/badge. A badge is never required for a listing or a link on Toolfound.

Public discovery plugin

Toolfound’s public ChatGPT plugin provides read-only access to public directory information. Depending on the tool you use, it processes a search query, product slug, time period or calendar horizon. It returns public product and launch information from Toolfound, with links back to the relevant public pages. Product copy and other listing claims can come from the product’s submitted or public source material; Toolfound does not independently verify every such claim. When the plugin reports maker verification, that field describes Toolfound’s separate ownership-verification status.

The public plugin does not require an account and does not ask for your name, email address, credentials or conversation history. Its discovery tools do not create audit records, send email, change listings or write analytics events. Requests still pass through our hosting infrastructure. If a request produces application diagnostic output, local operational logs may contain standard request information such as network address, user agent, requested endpoint and time. These files have no fixed-day retention period: each service keeps at most three files of 10 MB and deletes older data as those files rotate. The proxy does not keep an access log. If an unexpected application error reaches our error-monitoring provider, Sentry, it may process related diagnostic request metadata for up to 30 days. You can ask us to delete information linked to you using the contact below.

Toolfound also has an older MCP integration with write actions for submissions, claims and listing management. When you choose one of those actions, its audit records may contain a one-way network actor hash and action metadata such as an email address, product URL or listing slug. Those audit records are covered by the twelve-month period below. This data is not collected by the public discovery tools.

Save to Toolfound Chrome extension

The Save to Toolfound extension for Chrome does not require an account and does not read page content, cookies, browsing history or form data. When you open its popup, it reads the address of the tab you are on and sends only that site’s origin (for example https://example.com, without the path or query) to toolfound.com to check whether the site is listed. If you use its right-click menu, it opens a Toolfound page in a new tab with the site’s origin or the text you selected (up to 100 characters) in the address. Links it opens carry campaign tags so we can count visits from the extension. The extension stores nothing on your device and talks to no service other than toolfound.com. It asks for three Chrome permissions: activeTab (to read the current tab’s address only when you use it), contextMenus (for the right-click items) and access to toolfound.com/api/mcp (for the listing check). Those requests are handled like the public plugin requests described above.

Connected data sources

A maker who owns a verified listing can connect a payment provider to show verified revenue. Today that is Stripe, through a restricted read-only API key the maker creates and pastes in.

What we read: totals only. Active subscriptions, their prices and quantities, the count of paying customers, and the account’s business name and website. We never read or store customer names, emails, card data or individual payments.

What we store: the key, encrypted at rest (AES-256-GCM); the derived figures (monthly recurring revenue, number of active subscriptions, number of paying customers and the share of the largest customer); and a daily history of those figures.

What we show: by default a revenue range (for example “$1k-5k MRR”) with “Verified via Stripe” and the date we last read it. The maker chooses hidden, range or exact. A figure is only labelled verified when we fetched it ourselves within the last 7 days; after that it disappears from the page and the badge.

We also check some public signals ourselves, with no key: whether the product website responds, GitHub stars and the latest release for a linked repository, and the App Store rating for a linked app. These come from public endpoints and are shown with the date checked. “Stated by the maker” labels mark anything typed in by the maker.

Removal: the maker can remove the key at any time from the dashboard. Removal deletes the key, the figures and the history immediately. Delisting or deleting the account does the same. A key the maker deletes in Stripe stops working for us straight away.

Basis and use: we process this on the maker’s request (performance of the listing service) and use it only to display the figures where the maker chose, including over the public API and MCP. We never use it for advertising, resale or model training. A breach affecting connector data is reported to affected makers within 72 hours. The controller is the same as for the rest of this policy.

Why we collect it

Contract, for anything you asked us to do (sending a verification link, holding a queue slot, replying about sponsorship). Legitimate interest, for abuse prevention, for keeping the index accurate, and for first-touch attribution (knowing which channels bring submissions). Consent, for the newsletter, which is double opt-in, and for optional listing, Plus, promotion and relaunch follow-ups you enable.

How votes are counted

A vote is stored as a listing identifier plus the hashed signature described above. There is no account behind it, so we cannot tell you what you voted for and neither can anyone else.

Email

Transactional email (verification links, queue confirmations, launch-day notices) goes to the address you gave for that purpose. Non-essential email includes the weekly newsletter and any optional listing, Plus, promotion or relaunch follow-ups you enable. Newsletter and maker follow-up preferences are separate. Every message we send carries a one-click unsubscribe header as well as a link, and unsubscribing is immediate.

If we contact the owner of an unclaimed listing, it is a single message about that listing with at most one follow-up, and it always includes a removal link.

Who else sees it

Our hosting provider, our database provider, our email provider and our error-monitoring provider process data on our behalf under contract. We do not sell data, we do not share contact details with investors or sponsors, and we do not run advertising networks on the site.

Your rights

Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it: email hello@toolfound.com and we will act within 30 days, and usually within two working days. Deleting your email address also removes you from the newsletter and from any pending submissions.

Unverified submissions are deleted automatically after 14 days. Newsletter addresses are kept until you unsubscribe. Audit records and first-touch attribution (referrer hostname and utm tags) are kept for twelve months. Email delivery, link-request, suppression, attribution and support-review records currently have no fixed automatic deletion period; you can ask us to delete records linked to your address using the contact above.