Privacy Notice

Signing in uses Google. We receive and store, in a Cloudflare D1 database:

• your Google account identifier, email address, display name and profile picture address;
• a sign-in session: a one-way hash of your session token and when it expires (30 days);
• the websites you save: domain, address, title and when you saved it.

We use this only to show your account and your saved list. We never see your Google password.

• Your search words go to our server. Our own logs and metrics record counts and error codes, never the words themselves. Cloudflare, which hosts and protects the site, sees every request address and may keep it in its own security logs under its own policies; the search words are part of that address.
• When our own collection of websites cannot answer well, the words are also sent to our search provider (Tavily) to find sites.
• To limit how many searches one person can run, we use your IP address. We keep it only as a salted one-way hash in usage counters, not in readable form.

No advertising, tracking or analytics cookies.

• common_session — keeps you signed in, 30 days, not readable by page scripts.
• common_oauth_state — protects the sign-in handshake, 10 minutes.
• common_human — set after an automatic bot check so you can search, 30 minutes. Cloudflare’s check may use its own cookies or storage.
• common:auth-hint in your browser’s local storage — your name and picture address, so the header does not flash “Sign in” on reload. Removed when you sign out.

• Google — sign-in.
• Cloudflare — hosting, the database, the bot check and request logs.
• Tavily — web search, only for searches our own collection cannot answer.
• Preview images — result cards load a picture of each website. Your browser fetches it from that website or from a screenshot service (WordPress.com mShots, Thum.io), which can see your IP address and the address being previewed.

We do not sell personal data and we do not use your data to train models.

You can remove saved websites one by one or all at once from the Saved page. You can delete your whole account — profile, sessions and saved websites — from your account page. Deletion removes it from our database straight away. Cloudflare may keep logs and database backups for a limited time under its own policies.

Questions about your data: hello@common.to.