Privacy Policy

1. Overview and Core Principles

Siftloom is a curated directory for software, AI tools, and workflows. We believe in minimal data collection: we collect only what is strictly necessary to provide authentication, maintain security, and deliver our directory service.

Browsing our directory does not require an account or the submission of personal data. When you do register, all data handling is derived directly from our system architecture and database design.

2. Personal Data We Collect and Store

We hold only the specific data fields required to operate user accounts, defined in our database schema:

• Name: Stored to identify your profile across account screens and communications.
• Email address: Stored as your unique account identifier, used for signing in, email verification, and critical security notices.
• Email verification status: A boolean flag recording whether your email address has been confirmed via verification link.
• Avatar image (optional): If you authenticate via Google OAuth, a URL to your public avatar image may be stored.
• Account passwords: For credential-based accounts, passwords are cryptographically hashed using standard one-way algorithms before storage. We never store or view plaintext passwords.

3. Sessions and Authentication Storage

When you sign in to Siftloom, a session row is created in our PostgreSQL database. Session records include:

• A cryptographically secure session token.
• Your internal user identifier.
• Creation timestamp and expiration date (expiresAt).
• Technical metadata including IP address and browser user-agent string, used exclusively to detect session hijacking and unauthorized logins.

Sessions automatically expire at their scheduled expiration date. Furthermore, all active sessions are immediately revoked when a user changes or resets their password, or clicks log out.

4. Transactional Email Usage

Email addresses collected during registration or authentication are used strictly for transactional security messages:

• Email verification: Sending a one-time verification link upon account registration or when requested via the verification resend form.
• Password reset: Sending a time-limited password reset link when requested by the account holder.

We do not sell, rent, trade, or share your email address with third-party advertisers. We do not send marketing newsletters unless you explicitly opt in.

5. Google OAuth Authentication

Users may optionally authenticate using Google OAuth. When you sign in with Google:

• Google provides your basic profile information (name, email address, and profile picture URL).
• Our system links the Google provider to your Siftloom account based on your verified email address.
• OAuth account identifiers and token expiration dates are stored in the account table in our PostgreSQL database. We request only the minimal permissions required for basic identity authentication.

6. Security and Abuse Prevention

To protect user accounts and service integrity, our application enforces rate limiting on sensitive authentication routes (such as login attempts, email verification, and password reset endpoints).

Rate-limiting counters are recorded in PostgreSQL to track request frequencies and timestamps. This data is used exclusively to prevent brute-force attacks, credential stuffing, and denial-of-service abuse.

7. Data Retention and Account Deletion Procedure

We retain personal data only as long as your account remains active or as required for platform security and abuse prevention.

You have the right to request the permanent deletion of your account and all associated data at any time.

8. Contact Information

For inquiries or requests regarding this Privacy Policy or your personal data, please contact our team at:

Email: privacy@siftloom.com