Privacy Policy

1. Data controller

The data controller is Nicola Fadelli, creator and manager of the independent Findami project.

For questions, reports or requests concerning personal data, you can contact findami.it@gmail.com.

2. What Findami is

Findami is an independent online social experiment that is currently offered without charge.

It allows a person to write a wish, choose whether to share it publicly or keep it private, and receive a public wish written by another person.

Users are not required to create an account or provide their name, email address or social media profile.

3. Data processed

Public wishes

When you choose to share a wish publicly, the following information is stored:

• the text of the wish;
• the date and time of submission;
• the moderation status;
• the number of times the wish has been displayed;
• the hash of the secret token used to delete the wish;
• technical database information needed to manage the record.

Public wishes are initially stored with a pending status. They may be read manually by the project manager for moderation purposes.

Only approved wishes may be displayed randomly to other users. Rejected or pending wishes are not publicly displayed.

Wishes are shown in the language in which they were submitted and are not automatically translated by Findami.

Private wishes

When you choose to keep a wish private, the text remains temporarily in your browser and is not sent to or stored in the Findami database.

The private text disappears when the page is closed, reloaded or reset, subject to the normal behaviour of your browser and device.

Language preference

The selected interface language is stored in your browser's local storage under the key findami_language.

This preference is used only to remember the interface language and remains on your device until it is changed or deleted through your browser settings.

Technical data

When Findami is used, technical providers may process information necessary to deliver, protect and maintain the service.

This information may include the IP address, browser type, operating system, user agent, request date and time, requested resource, security events and information relating to the anti-bot verification.

To prevent spam and abuse, Findami also applies rate limiting to certain requests. For this purpose, the connection IP address is used to generate a pseudonymous identifier through a keyed cryptographic hash (HMAC).

Findami does not store the raw IP address in its rate-limiting database. Only the resulting pseudonymous identifier, the type of request, the relevant time window and a request count are stored. This information is used only for security and abuse prevention and is not used for advertising or profiling.

Reports

When you report a public wish, Findami stores information necessary to review and manage the report.

This may include the identifier of the reported wish, the selected reason, any optional details provided by you, the status of the report, and the date and time of submission.

Reports are used only for moderation, safety, prevention of abuse and management of potentially unlawful or inappropriate content.

Email communications

If you contact Findami by email, the sender address, message contents, attachments and any other information you choose to provide will be processed.

4. Do not include personal or sensitive data

Findami is designed for short anonymous wishes. You must not include information that identifies you or another person.

In particular, do not include:

• full names or identifying details;
• postal or home addresses;
• email addresses or phone numbers;
• social media usernames or profile links;
• identity documents, financial information or account credentials;
• information concerning another person without their permission;
• information about health, medical conditions, disability or treatment;
• racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
• genetic or biometric data used for identification;
• information about sex life or sexual orientation.

Basic automatic controls attempt to identify email addresses, possible phone numbers, links, social media usernames and excessive repeated characters. These controls cannot identify every type of personal, sensitive or inappropriate information.

Findami may reject or delete content containing personal data, sensitive information or information that may harm another person.

5. Purposes and legal bases

• Storing, moderating and displaying a public wish: your consent, expressed by selecting the public option and submitting the wish. You may withdraw consent by using the secret deletion link or contacting Findami.
• Providing the Findami experience: the legitimate interest in operating the service requested by the user and providing a random approved wish.
• Moderation, security and prevention of spam, abuse and unlawful use: the legitimate interest of the controller in protecting Findami, its users and its infrastructure.
• Responding to emails, privacy requests and reports: taking steps at the user's request, complying with legal obligations and the legitimate interest in managing communications.
• Establishing, exercising or defending legal claims: compliance with legal obligations and the legitimate interest in protecting the controller's rights.

6. Is providing data mandatory?

Providing a wish is voluntary and is not a statutory requirement.

Without entering a wish and selecting a public or private option, it is not possible to complete the Findami experience.

Providing personal or sensitive information is neither required nor permitted.

7. Public nature of approved wishes

An approved public wish may be shown to an unspecified number of Findami users.

Other users may copy, photograph, share or otherwise reproduce content displayed to them. Findami cannot control copies independently made by third parties.

Deleting a wish from Findami removes it from the active database and prevents future display by the service, but it cannot delete copies already made by other people.

8. Automatic controls and manual moderation

Public wishes are subject to basic automatic checks intended to detect email addresses, possible phone numbers, links, social media usernames and excessive repeated characters.

These checks may prevent submission and ask the user to edit the text. They may produce false positives or fail to identify some personal, sensitive or inappropriate information.

Submitted public wishes are also subject to manual moderation before they may be displayed.

Findami does not use automated decision-making that produces legal or similarly significant effects on users.

9. Technical providers and recipients

Findami uses the following technical providers:

• Vercel, for website hosting, content delivery and server-side functions;
• Supabase, for database hosting and storage of public wishes and related records;
• Cloudflare Turnstile, for anti-bot verification and protection against spam and abuse;
• Google Gmail, for receiving and managing messages sent to the contact address.

These providers may receive technical data and, where necessary for the service supplied, the content stored or transmitted through their systems.

Personal data is not sold to advertisers.

10. International data transfers

Some providers or their subprocessors may process data in countries outside the European Economic Area.

Where an international transfer takes place, Findami relies, as applicable, on an adequacy decision, appropriate contractual safeguards or another transfer mechanism permitted by applicable data protection law.

Further information may be requested by contacting findami.it@gmail.com.

11. Cloudflare Turnstile

Public wish submissions and reports are protected by Cloudflare Turnstile.

Turnstile analyses technical signals from the browser and connection to help distinguish legitimate users from automated systems and to prevent spam and abuse.

Findami does not use Turnstile information for advertising, retargeting or commercial profiling.

12. Retention periods

• private wishes are not stored in the Findami database;
• pending public wishes are automatically scheduled for deletion once they are older than 30 days from submission; because cleanup runs daily, deletion may occur within the following 24 hours;
• rejected public wishes are automatically scheduled for deletion once they are older than 30 days from rejection; because cleanup runs daily, deletion may occur within the following 24 hours;
• approved public wishes are automatically scheduled for deletion once they are older than 24 months from approval, unless they are deleted earlier; because cleanup runs daily, deletion may occur within the following 24 hours;
• deletion-token hashes, display counts and related database information are deleted together with the relevant wish;
• pseudonymous rate-limiting identifiers and their associated request counters are retained for no more than 24 hours and are then automatically deleted;
• reports concerning public wishes, including any optional details submitted with them, are automatically scheduled for deletion once they are older than 90 days from submission, unless they are deleted earlier together with the associated wish; because cleanup runs daily, deletion may occur within the following 24 hours;
• email communications are retained for a maximum of 12 months after the request has been resolved, unless longer retention is necessary to comply with a legal obligation or protect legal rights;
• the language preference remains in the browser until it is changed or removed by the user;
• technical logs and anti-bot information are retained according to the periods applied by the relevant providers, subject to applicable law.

When data is deleted from the active database, residual copies may remain temporarily in provider backups or security logs until their ordinary rotation or deletion.

13. Deleting a public wish

After submitting a public wish, the user receives a secret deletion link.

Anyone who possesses this link can permanently delete the wish without creating an account. The link must therefore be kept private.

Findami stores only the cryptographic hash of the deletion token. The original token is shown to the user after submission and cannot be recovered from the database.

If the link is lost, you may contact findami.it@gmail.com. You may be asked to provide the exact text or other information necessary to locate the relevant wish.

Findami may be unable to act on a request if the relevant wish cannot be identified with reasonable certainty.

14. User rights

Subject to the conditions established by applicable law, you may request:

• access to your personal data;
• rectification of inaccurate data;
• deletion of personal data;
• restriction of processing;
• data portability, where applicable;
• objection to processing, where applicable;
• withdrawal of consent at any time, without affecting processing carried out before withdrawal.

Because Findami does not require accounts or verify user identities, you may need to provide the secret deletion link, the exact text of the wish or other information needed to locate the relevant content.

Requests may be sent to findami.it@gmail.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali.

15. Users under 16

Findami is intended only for people aged 16 or over and is not designed for children.

People under the age of 16 must not submit public wishes.

If Findami becomes aware that information has been submitted by a user under 16, the relevant content may be removed.

16. Security

Findami applies technical and organisational measures intended to reduce unauthorised access, alteration, disclosure or loss of information.

However, no online service can guarantee absolute security. Users should therefore avoid submitting any information that is private, confidential or capable of identifying a person.

17. Changes to this policy

This Privacy Policy may be updated when the project's features, providers, security measures or processing activities change.

The date of the latest update will be displayed at the beginning of this page.