Privacy

1. Scope and Data Controller

Vaneform (vaneform.com) provides website traffic estimates, search visibility research, domain lookups, watchlists, and REST / MCP APIs. This Privacy Policy explains how we collect, use, and protect personal data when you browse the site, sign in, manage API keys, or purchase a paid plan. Privacy requests may be sent to hello@vaneform.com.

2. Account and Sign-In Data

Vaneform supports passwordless sign-in via Google OAuth 2.0 and 6-digit email verification codes. We collect only the information needed to authenticate and maintain your account:

• Google OAuth: we request standard openid, email, and profile scopes to receive your verified email address, display name, profile avatar URL, and Google account identifier.
• Email OTP: 6-digit login codes expire after 10 minutes and are stored on the server using HMAC-SHA256 hashes alongside attempt counters and a keyed hash of the request IP for abuse prevention.
• Bot protection: sign-in code requests use Cloudflare Turnstile or a same-origin fallback verification challenge to block automated abuse.

3. Cookies and Local Storage

We use strictly necessary first-party cookies and browser storage to operate authentication and preserve interface preferences:

• Session cookie (__Host-vaneform_session / vaneform_session): an HttpOnly, SameSite=Lax signed session token valid for 30 days.
• OAuth state cookie (__Host-vaneform_oauth / vaneform_oauth): a short-lived HttpOnly nonce stored solely during the Google OAuth redirect handshake (maximum 10 minutes).
• Local preferences: theme selection, UI language, and recent local lookup history stored in your browser.

4. Billing, Credits, and API Keys

When you subscribe to Pro, purchase credit packs, save domains to a watchlist, or create API keys, Vaneform stores your entitlement state, order summary, credit ledger entries, saved domains, and cryptographic hashes of vf_live_ API keys.

Payment card numbers and sensitive payment credentials are collected and processed directly by our payment processor; Vaneform stores only billing references, plan status, and invoice summaries.

5. Analytics and Public Website Reports

Vaneform collects first-party operational metrics and privacy-focused product usage events to keep lookups reliable. We do not run third-party advertising trackers or sell personal information.

Domain owners can submit verified first-party updates or report-exclusion requests through the site claim workflow.

6. Retention and Your Rights

Account records remain active while your account is open, and billing records are retained as required for accounting, fraud prevention, and legal compliance. You can revoke API keys at any time or contact hello@vaneform.com to request access, correction, or deletion of your account data.