Privacy Policy

Effective date: June 30, 2026 Version: 1.0 Controller: CompatKit (operated by Randy Vera) Contact for privacy matters: privacy@compatkit.com

Plain English: We log compatibility searches to improve the database and understand what gear questions people actually have. We don't track who you are, don't sell your personal data, and delete anonymous logs after 90 days. If you make an account, you can delete it and everything linked to it at any time.

What We Collect

Anonymous visitors (no account required)

When you search for a compatibility pair, we log:

• The query type (e.g., "pair")
• The product slugs you searched (e.g., "sony-fx3" and "sony-tough-g-series")
• Whether we returned a result or a miss
• Your country (country-level only, derived from IP — not the IP address itself)
• The referring domain (e.g., "claude.ai") — not the full URL or path
• Response time in milliseconds
• That you consented, and when — not the query content itself, just the fact and timestamp of your consent decision

We do not store your IP address, device type, browser fingerprint, name, or email in our database. Your IP is used by our rate-limiting infrastructure (see "Third Parties" below) to enforce abuse limits — it is stored there, as a rate-limit counter key, for up to approximately 2 hours before automatically expiring, then is gone. It is never written to any database we control, and never linked to your searches.

We do not set tracking cookies. Session grouping is by time window only.

Legal basis (GDPR): Legitimate interest (Article 6(1)(f)). We have a genuine interest in understanding which compatibility questions are being asked so we can prioritize research and close data gaps. This interest is not outweighed by your rights: the data is country-level and product-level only, contains no identifying information, and expires automatically after 90 days.

Consent: On your first visit, we ask for your consent before logging begins. If you decline, we log nothing.

Registered users (not yet available)

User accounts are not built yet. When available, we plan to collect, in addition to the above:

• Email address (authentication only — never displayed publicly or shared)
• Saved gear setups (products you add to your setup)
• Query history linked to your account

Legal basis (GDPR), once live: Contract performance (Article 6(1)(b)) — we would need your email to provide the account service you requested. This policy will be updated with a new effective date before accounts go live.

API callers (not yet available)

A public API is not built yet. When available, we plan to collect:

• Hashed API key (not the raw key — the hash is a one-way identifier)
• Same query fields as anonymous visitors, plus query volume per key

How We Use It

To improve the database. Query patterns show us what combinations people research and where our database has gaps. A high volume of "no result" queries for a product pair tells us to research that pair next.

Aggregate signals sold to brands and retailers (future, not yet live). We may sell anonymized, aggregated signals to gear brands. Examples: "500 searches involved your microphone this month" or "60% of queries about your camera returned a compatible result." We will never sell individual user data, individual query histories, or any data that identifies a person.

Data Retention

| Data type | Retention | |---|---| | Anonymous query logs | 90 days, then automatically deleted | | User account data (once available) | Until you delete your account | | Saved gear setups (once available) | Deleted immediately when account is deleted | | API key hashes (once available) | Retained for security auditing (12 months after key is revoked) |

The 90-day expiry on anonymous query logs is enforced automatically. You do not need to request it.

Your Rights

Anonymous visitors (no account)

We do not assign a session ID or any other identifier that could link a query log row back to a specific visitor — this is by design, not an oversight. As a practical consequence, we have no way to find "your" rows among anonymous query logs to fulfill an individual erasure or access request; GDPR Article 11 addresses exactly this case (a controller that cannot identify the data subject is not required to maintain the ability to do so). What we can offer instead: erasure is already automatic (every anonymous row is deleted after 90 days regardless of any request — see "Data Retention"), and you can withdraw consent for future logging at any time via the cookie preferences control on the site (see "Cookies" below).

• Right to object: You can object to processing based on legitimate interest. Since we can't identify individual anonymous rows, the practical form this takes is withdrawing consent for future logging, as above.
• Right to withdraw consent: If you consented to query logging, you can withdraw that consent at any time, using the cookie preferences control. Withdrawal does not affect logs already written, and does not (and cannot) delete a specific past log row — see above.

Registered users, once available (GDPR, if you're in the EU/UK/EEA)

• Right to erasure: You will be able to request deletion of any data linked to your account. See "How to Exercise Your Rights" below.
• Right to access: You will be able to request a copy of the data linked to your account.
• Right to portability: You will be able to request your saved setup data in a machine-readable format (JSON).

California residents (CCPA)

• Right to know: You can request disclosure of the categories of personal information we collect and how we use it.
• Right to delete: You can request deletion of personal information we have collected about you. As with the GDPR erasure right above, this applies to account-linked data (once accounts are available) — anonymous query logs have no identifier we could use to locate a specific visitor's rows, and already expire automatically after 90 days.
• Right to opt out of sale: We do not sell personal information. Aggregate, anonymized signals are not personal information.

How to Exercise Your Rights

Email privacy@compatkit.com with the subject line "Privacy Request" and describe what you want (deletion, access, export). We will respond within 30 days. Once accounts are available, you will also be able to delete your account directly from your account settings page — all linked data removed immediately via cascading delete.

We do not charge a fee for privacy requests. We may ask you to verify your identity before acting on a request.

Third Parties

We do not share personal data with any third party for their own use.

Infrastructure vendors (data processors, not controllers):

• Supabase (database hosting) — processes data on our behalf under a data processing agreement
• Vercel (website hosting) — processes web requests on our behalf
• Upstash (rate-limiting infrastructure) — receives your IP address to enforce request limits and prevent abuse of our search and reporting features. Stored there as a rate-limit counter key for up to approximately 2 hours, then automatically expires. Not stored in our own database, not linked to your searches.

Product links on this site are plain, unaffiliated retailer links. No affiliate tracking cookies are set by this site.

Cookies

We do not use tracking or advertising cookies. We set one cookie today:

• ck-consent — records whether you accepted or declined query logging, so we don't ask again on every visit. Expires after 30 days, or immediately if you use the cookie preferences control (bottom-right of any page) to change your choice. This cookie is strictly necessary to remember your consent decision and does not require its own separate consent under ePrivacy rules.

Once accounts are available, we will also set a session cookie for logged-in users, strictly necessary for the account service, and will update this section before that ships.

Changes to This Policy

If we make material changes, we will update the effective date and version number at the top of this page and (for registered users) send a notification email at least 30 days before the change takes effect.

Contact

For questions about this policy or to exercise your rights:

Email: privacy@compatkit.com Response time: Within 30 days