Privacy Policy
This policy explains what information whichproduct.app ("we", "us") collects when you use the site, why, on what legal basis, and what rights you have. It is written to meet the transparency requirements of Article 13 of the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven).
Who is responsible
The controller for the personal data described here is:
Cloud Ninja Consulting ApSApeldoorn Alle 20, 2791 Dragør, DenmarkCVR no. 46044118Email: mniel04@gmail.com Send emailWe have not appointed a data protection officer, because the law doesn't require one for processing of this kind and scale. Send any privacy question or request to the email address above.
The short version
- You don't need an account, and we don't ask for your name, email or any other personal details.
- We count a few anonymous events (page visits, finder starts and completions, clicks to Amazon, "Were these results useful?" answers, and the words of site searches that found nothing) to learn which pages help people. These records contain no identifier and don't identify you.
- We don't store your IP address. Our own counting sets no cookies and stores nothing in your browser.
- Your IP address is processed briefly to protect the site from abuse, and by our host in its request logs.
- When you click through to Amazon, Amazon's own privacy notice and cookies apply.
- We keep the anonymous event records for 24 months, then delete them and keep only daily totals.
What we collect
Anonymous events
We record six kinds of events in our own database. Each record also gets the time it was saved (for searches with no result, only the day). None of them contains an IP address, browser details, a cookie, a device identifier or any other identifier.
| Event | What we record | What we don't record |
|---|---|---|
| Page visit | The page you viewed, as its address without anything after a "?" (e.g. /tvs/buying-guide), and its product category if it has one. The website that sent you, as a domain name only (e.g. google.com), when you arrive from another site. Any campaign tags in the link you arrived on (e.g. utm_source=youtube). | Your IP address, browser details, name, email, device ID or location |
| Finder start | That you answered the first finder question in a category, the page on our site you opened the finder from (its address only, as above), plus the same referring domain and campaign tags | Your answers |
| Finder completion | That the finder was completed in a category, the results page's address without your answers (e.g. /tvs/results), plus the same referring domain and campaign tags | Your answers |
| Click to Amazon | The product, the page the button was on (its address only, as above), where on the page the button was (for example results or a top-picks list), the answer-combination code when you clicked from results, and the same referring domain and campaign tags | Who you are, or what you buy on Amazon |
| Result feedback | Whether you answered 👍 or 👎, the category, and the answer-combination code | Any comment or personal detail |
| Search with no result | When a site search finds nothing, the words you searched for, but only if they are 1 to 3 plain words of letters (no digits, "@" or web addresses), kept as a count per day and deleted after 24 months | Anything with a number in it, the page, the time beyond the day, or anything that links the words to you |
The "answer-combination code" is a fixed code calculated from a set of answers (for example "55-inch, under $500, gaming"). Everyone who picks the same answers gets the same code. It describes the answers, not the person.
We believe these records are not personal data, because neither we nor anyone else can link them to a person. We still describe them here, and treat them with the same care, so you can see exactly what we keep.
Your answers also appear in the address of the results page (for example /tvs/results?size=55&budget=under-500) so you can bookmark or share them. That address stays in your browser history and goes wherever you share it.
Your IP address
Every website receives your IP address when your browser asks for a page. We use it in two ways only:
- Abuse protection. When your browser sends one of the events above, our server turns the IP address into a scrambled code (a one-way hash with a random value that changes whenever the server restarts) and keeps it in memory to count how many events arrive per minute. The code is never written to our database or logs. It is kept only in server memory, normally for about a minute, and is discarded at the latest when that server instance shuts down.
- Hosting logs. Our host, Vercel, processes your IP address and browser details to deliver pages, and keeps technical request logs for security and troubleshooting. If you submit a search, the words you typed are part of the page address (
/search?q=…), so they also appear in Vercel's short-lived request logs and in your browser history.
Emails you send us
If you email us, we receive your email address, your name if you include it, and your message.
Cookies and browser storage
- Our own event counting uses no cookies and stores nothing on your device (no local storage or session storage). Campaign tags are read from the address of the page you're on each time, not saved.
- The only cookies whichproduct.app sets are for the site administrator: sign-in cookies for the private admin area, and a marker that keeps the administrator's own visits out of the counts. Ordinary visitors never receive them.
- Amazon sets its own cookies once you're on Amazon. See "Amazon and other third parties".
Why we use it, and our legal basis
| What | Why | Legal basis | How long |
|---|---|---|---|
| Anonymous events | To see which pages, guides, lists and campaigns are useful and which need work; to read 👍 / 👎 feedback and improve questions and matches | To the extent any of it is personal data: our legitimate interest in understanding and improving the site with minimal, non-identifying statistics (GDPR Art. 6(1)(f)) | 24 months, then deleted; daily totals kept without limit |
| IP address, abuse protection | To stop automated traffic from flooding our statistics and database | Our legitimate interest in keeping the site and its statistics secure and reliable (Art. 6(1)(f)) | In server memory only, normally about a minute; never written to storage |
IP address and browser details in Vercel's request logs. If you submit a search, the words you typed are part of the page address (/search?q=…), so they also appear in Vercel's short-lived request logs and in your browser history. | To deliver pages, keep the site secure and find faults | Our legitimate interest in running a secure, working website (Art. 6(1)(f)) | Available to us for 1 day (Vercel's documentation for our plan). Vercel's own retention: as set out in Vercel's privacy notice (https://vercel.com/legal/privacy-policy) |
| Emails you send us | To answer you, and to fix errors you report | Our legitimate interest in answering messages and keeping the site accurate (Art. 6(1)(f)) | As long as needed to deal with the matter, and no longer than 12 months after it is closed |
Where we rely on legitimate interests, we have weighed them against your interests:
- we collect very little;
- the event records contain no identifier;
- we never store the IP address;
- you can object at any time (see "Your rights").
You don't have to give us any personal data to use the site. We don't make decisions about you based solely on automated processing, and we don't profile you. The finder's results depend only on the answers you give and aren't saved against you.
Who receives it
We don't sell your personal data or share it with anyone for their own purposes. These providers process it on our behalf:
- Vercel Inc., USA: website hosting. Processes IP addresses and browser details to deliver pages, and keeps request logs. We don't use Vercel Web Analytics or Speed Insights. Data processing agreement: https://vercel.com/legal/dpa.
- Supabase Inc., USA: database hosting. Stores the anonymous event records. Your browser doesn't send events to Supabase directly; our server does, so Supabase doesn't receive your IP address from them. Data processing agreement: https://supabase.com/legal/dpa.
- Google (Gmail): hosts our mailbox, so it receives the emails you send us.
We also use AI tools (Anthropic's Claude) to help research and draft product content. Those tools work with product information from manufacturers. They never receive information about visitors.
We may disclose information if the law requires it.
International transfers
Vercel and Supabase are based in the United States, and Vercel delivers pages from servers in many countries. Personal data may therefore be processed outside the European Economic Area. These transfers are covered by the European Commission's Standard Contractual Clauses (2021), which are part of each provider's data processing agreement (links above). You can ask us for a copy of the relevant clauses at mniel04@gmail.com.
Amazon and other third parties
As an Amazon Associate I earn from qualifying purchases.
When you click a "See more" button, you leave our site and go to Amazon.com. With the default settings of current browsers, Amazon learns that you came from whichproduct.app, but not which page you were on or which answers you gave. From that point:
- Amazon and other third parties may serve content, collect information about you, and place or read cookies in your browser. Amazon uses cookies to know that our site referred you, so it can pay us a commission on qualifying purchases. It may also use cookies and similar technologies for its own purposes, including advertising.
- Amazon is responsible for what it collects on its own site, under Amazon's Privacy Notice and Amazon's Cookies Notice on Amazon.com, not this policy. We don't receive your name, contact details or the details of what you buy. Amazon's reports to us show only totals, such as the number of clicks and items ordered.
Your choices about third-party cookies:
- You can block or delete cookies, including third-party cookies, in your browser settings. Blocking Amazon's cookies may mean we don't receive credit for a referral. It doesn't change the price you pay.
- You can manage Amazon's interest-based ads on Amazon.com.
- For industry opt-out tools, see:
Other sites we link to, such as manufacturer pages we cite as sources, have their own privacy policies.
Do Not Track and Global Privacy Control
- Global Privacy Control (GPC): we honor it. whichproduct.app itself runs no third-party analytics or advertising scripts and sets no tracking cookies, so today there is nothing for it to switch off. Once you click through to Amazon, Amazon's own cookies and its handling of GPC apply (see "Amazon and other third parties").
- Do Not Track: browsers have largely dropped this setting and there is no agreed standard for it, so we don't treat it as a signal. Our own anonymous counts don't track you across sites either way.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- restrict how we use it (Art. 18);
- object at any time to processing based on our legitimate interests (Art. 21). We will then stop unless we have compelling legitimate grounds, or need the data for legal claims;
- receive data you gave us in a portable format, where the processing is based on consent or a contract (portability, Art. 20);
- withdraw consent at any time, where we rely on it, without affecting earlier processing (Art. 7(3)).
To use any of these rights, email mniel04@gmail.com. We'll reply within one month. In practice, the anonymous event records and Vercel's short-lived logs can't be linked to you, so we usually can't find any data about you in them (Art. 11). Anything you've emailed us, we can find, copy or delete on request.
Complaints. You have the right to complain to a data protection supervisory authority. Ours is the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
dt@datatilsynet.dk
https://www.datatilsynet.dk
You can also complain to the authority in the EU/EEA country where you live or work. We'd appreciate the chance to sort out any concern first, so please contact us.
Visitors in the United States
- Residents of some US states, including California, have rights under state privacy laws. We don't sell or share personal information, and we don't use it for targeted advertising or profiling.
- The site is not directed at children under 13, and we don't knowingly collect personal information from children under 13.
Children
whichproduct.app is a general shopping-help site and is not directed at children. We don't knowingly collect personal data from children.
Security
Our database is accessible only to the site administrator, and public pages can only add new anonymous events, not read them. Connections to the site are encrypted (HTTPS). No system is perfectly secure, but we keep what we collect to a minimum, which limits what could ever be exposed.
Changes to this policy
If we change how we handle information, we'll update this page and the effective date at the top. If we ever start collecting personal data that identifies you, we'll say so here before we start.
Contact
Questions or requests about this policy: mniel04@gmail.com Send email
Cloud Ninja Consulting ApS, Apeldoorn Alle 20, 2791 Dragør, Denmark. CVR no. 46044118.