Privacy Policy

1. Who we are

SecondWing is a product discovery website at secondwing.io, founded in 2026 in Bengaluru, India. For personal data collected through this website, SecondWing decides why and how it is used (under India's Digital Personal Data Protection Act 2023, the “Data Fiduciary”).

2. What we collect

You can browse, search and compare products without an account. We collect the following.

Account details

• If you sign up with email: your name, email address and a password. The password is stored only in hashed form; we cannot read it.
• If you sign in with Google: the name, email address and profile picture that Google shares with us. We never receive your Google password.
• Your role on the site (for example member, founder or moderator) and the date the account was created.

Things you give us

• Reviews: your rating, title, text, pros and cons, and the role label you choose. A published review is public and shows your name.
• Optional proof of use attached to a review (an image or PDF). Only moderators see it, and it is deleted after the moderation decision.
• Product submissions and edits: the product's website, description, pricing, logo, screenshots and video links.
• Ownership claims: your work email address, your role, and any evidence you add.
• Founder profile details, story submissions, and reports of incorrect information.
• Your email address, if you subscribe to the newsletter.

What you do on the site

• Votes (“wings”), saved products and reviews, linked to your account.
• Search queries. When you are signed in, a search is linked to your account; otherwise it is stored without your identity.
• Product page views and clicks through to a product's website, recorded as described under “Analytics” below.

Payments

Paid listing plans are paid through Stripe. Card details are entered on Stripe's pages and never reach our servers. We keep a record of the order: the plan, the amount, its status and Stripe's reference numbers.

3. Cookies and browser storage

We do not use advertising cookies. The site sets these:

• A sign-in session cookie, set when you log in. It keeps you signed in for up to 30 days and is renewed while you keep using the site. It is removed when you log out or delete your account.
• A browser identifier cookie named sw_device: a random value that lasts up to two years. It is set when you write a review or when a sponsored placement is shown to you. We store only a salted hash of it. It is used to stop one browser from reviewing the same product under several accounts, and to rotate sponsored placements fairly and count them once.
• If Google sign-in is offered to you, Google may set its own cookies to show the sign-in prompt. Those are governed by Google's privacy policy.

Your light or dark theme, your recent searches and your comparison list are kept in your browser's local storage. They stay on your device and are not sent to us.

4. Analytics without raw IP addresses

We measure how products are discovered, and we built that measurement so it does not identify you.

• We never store your raw IP address in our database.
• A visit is recorded against a salted hash made from your network address and browser type. The hash changes every day, so visits on different days cannot be linked to each other or traced back to you.
• A recorded event holds the product, the kind of event (view, click to website, search click), the page type it came from, the website that referred you (host name only) and, if you are signed in, your account.
• Rate limits and vote-abuse checks use the same daily hash.
• Review-abuse checks keep a salted hash of your network address and of the browser identifier cookie that does not change daily, so repeat abuse can be recognised. It is a hash, not the address itself.

The site is delivered through Cloudflare's network, which handles IP addresses in order to deliver pages and block attacks, and provides us with cookie-free, aggregate visit statistics.

5. AI crawler logging

Automated crawlers from AI companies (for example search and assistant crawlers) are recognised by the name they send and counted separately from human visits. For each day we keep how many times each named crawler read each product page or data endpoint, taken from our own counters and from Cloudflare's request logs (the address requested, the crawler's name and the response status). These counts describe crawlers, not people, and contain no personal data about visitors.

6. How we use personal data

• To run your account and keep it secure.
• To publish what you choose to publish: reviews, product listings, founder profiles and stories.
• To moderate reviews, submissions, claims and reports, and to detect fake votes and reviews.
• To rank and recommend products using aggregate activity such as views, votes and saves.
• To show founders how their product is discovered, as counts and trends, never as a list of named visitors.
• To take payment for paid plans and deliver what was bought.
• To send the newsletter, if you subscribed, and service messages about your account or submission.

We process personal data on the basis of your consent (for example when you create an account, post a review or subscribe) and for the legitimate uses the DPDP Act 2023 allows, such as providing the service you asked for and meeting legal obligations. We do not sell personal data, and the site carries no third-party advertising trackers.

7. Who we share it with

We share personal data only with the service providers that run the site for us, and only as far as each needs:

• Hostinger: hosts the website.
• Supabase: hosts the database.
• Cloudflare: delivers the site, stores uploaded files, and provides aggregate traffic statistics.
• Stripe: processes payments.
• Google: sign-in, if you choose it.
• OpenAI: its AI models help draft product profiles from a product's public website and help interpret search queries. The text of a search may be sent for this; your account details are not. Anthropic is retained as an optional provider only when explicitly configured.

[SERVICE PROVIDERS: confirm this list is complete and current]

Content you publish (reviews, listings, founder profile, stories) is public, appears in our public data endpoints, and can be read by search engines and AI systems. We may also disclose information when the law requires it.

Where your data is stored and processed: [DATA LOCATIONS: the countries where the database, file storage and hosting are located]

8. How long we keep it

• Account data is kept until you delete your account.
• Deleting your account removes your profile, saved products, votes, reviews and claims. Products you listed stay published but are no longer linked to you. Past searches and visit events are kept without your identity.
• Review proof files are deleted once a moderator has decided on the review.
• Daily analytics hashes cannot be linked to you after the day they were made.
• A sign-in session ends after 30 days without use.

Other periods: [RETENTION PERIODS: how long reviews, search history, order records, moderation and audit logs, and backups are kept]

9. Your choices and rights

You can do the following yourself, at any time:

• Export your data. In Account settings, download a file with your profile, saves, votes, reviews, submissions, searches and founder details.
• Delete your account. In Account settings, choose “Delete account”. This takes effect immediately and cannot be undone.
• Correct your details. Change your name in Account settings; founders can edit their listing in the dashboard.
• Unsubscribe from the newsletter with the link in any issue, or by writing to us.

Under the DPDP Act 2023 you also have the right to ask what personal data we hold and how it is used, to have it corrected, completed, updated or erased, to withdraw consent, to have a complaint dealt with, and to nominate someone to exercise your rights if you die or become unable to. To use any of these, write to [email protected].

10. Grievance Officer (India)

If you have a concern or complaint about how your personal data is handled, contact our Grievance Officer:

[GRIEVANCE OFFICER: full name and designation]

We will respond within [GRIEVANCE RESPONSE TIME: number of days within which a complaint is answered]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Children

SecondWing is not intended for anyone under [MINIMUM AGE: for example 18]. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.

12. Security

The site is served over HTTPS. Passwords are stored hashed. Staff areas are restricted by role and their actions are logged. Uploaded files are checked before they are stored, and sign-in, voting, reviewing and the public data endpoints are rate limited. No system is perfectly secure; if we learn of a breach affecting your personal data, we will tell you and the authorities as the law requires.

13. Changes to this policy

When we change this policy we will update the date at the top of this page. If a change materially affects how your personal data is used, we will also tell you on the site or by email before it takes effect.

14. Contact

Questions about this policy or your data: [email protected], or see the Contact page. Our Terms of Service cover the rules for using the site.