This notice covers the TrueFetch website, account workspace and Job Search API. Task inputs, source selections and account identifiers are processed to run requests and maintain billing and recovery records. Collected results are stored privately in Cloudflare R2 and are available through authorized access until the task’s resultExpiresAt, normally seven days after completion. Downloads use short-lived signed links. Billing and recovery records, including private task metadata, can remain after result expiry; result expiry is not deletion of all account or backup records.
Who operates TrueFetch
TrueFetch is currently operated by an individual under the TrueFetch brand. The operator is responsible for the account and website data described in this notice. Contact [email protected] for privacy inquiries.
Account and API data
When you sign in, we store your email, name, provider account identifier and session information. We also store the profile, saved requests, notification preferences and credential metadata you choose to create in the workspace. Google, GitHub and Microsoft provide identity information when you choose their sign-in options. Resend delivers email sign-in links. Account records are stored in a dedicated PostgreSQL database hosted on Amazon Web Services. Do not save sensitive personal data in request drafts. Job Search API executes collection jobs submitted through the workspace or REST API. Public interactive examples use sample data and do not start collection jobs. Catalog search terms are reflected in the page URL; do not enter sensitive information.
Request diagnostics
For authenticated collection API calls, we retain account-linked request IDs, task IDs when known, fixed operation names, HTTP status, duration and error codes for seven days in the live request-history store. This diagnostic record does not include request bodies, complete URLs, API keys, cookies or IP addresses. Recording is best effort and is separate from billing, authentication records and infrastructure security logs. Older diagnostic rows are removed by scheduled cleanup; database backups follow their separate retention schedule.
Welcome credit eligibility
When welcome credits are enabled, we check your verified account email and set an essential, signed browser cookie to help prevent repeat claims. The cookie lasts up to 400 days and is separate from website analytics. We store hashed email and browser identifiers with the grant record, including after account deletion, to enforce one-time eligibility. These hashes are pseudonymous, not anonymous. The browser identifier is not a hardware fingerprint; clearing cookies or using another browser can reset it. Known temporary email domains are not eligible. Contact us if you believe an eligibility check is incorrect.
Website delivery
The site is hosted through Cloudflare. Serving and protecting web traffic involves technical data such as IP addresses, requested URLs, browser information and timestamps. Cloudflare processes this information under its own applicable policies. Cloudflare also provides aggregate Web Analytics on pages where its measurement script is enabled. Service delivery and security logs are separate from the public-page analytics described below. See Cloudflare’s privacy policy.
Account sessions and retention
Essential secure session cookies keep you signed in and protect account actions. Account records are retained while your account is active; you can export your account information or request deletion in Settings. A deletion request disables account access pending review. Records needed for security, accounting or legal obligations may be retained; contact us for a retention or deletion inquiry. Our Google Analytics and Microsoft Clarity integrations are excluded from the workspace, administrator, sign-in and sign-up pages.
Cookies and website analytics
Public website and documentation pages automatically load Google Analytics 4 and Microsoft Clarity to measure visits and understand how people use the site. These services can use cookies or similar browser identifiers. They receive technical connection, device and browser information under their own policies.
Our initial Google Analytics page measurement uses the built page address without its query string or fragment and the referring website's origin without its path or query. The integration disables Google signals and advertising personalization options. These settings apply to our Google Analytics configuration; other providers process information under their own policies. See Google's privacy policy.
Our Google Analytics property currently retains event data for 2 months and user data for 14 months. User retention resets when there is new activity. These settings do not set the retention period for standard aggregated reports. See Google's data retention guidance.
Microsoft Clarity supports heatmaps and session analysis. It can collect visited URLs, clicks, scrolling, page rendering and page content, subject to its masking settings. The Google Analytics address settings do not redact Clarity's URLs. Clarity's cookie use and session features depend on its project settings and regional rules. Avoid putting personal, confidential or credential information into public-page fields or URLs. See Clarity's data collection description and Microsoft's privacy statement.
You can limit these tools through browser controls that block their scripts or cookies. Google provides an Analytics opt-out browser add-on. Microsoft describes its Clarity opt-out options. Blocking or deleting cookies alone does not guarantee that all measurement stops. For questions about analytics records, retention or deletion, contact [email protected].
Payment integration
When you use Stripe-hosted checkout, Stripe collects payment details on its hosted page and processes transaction and fraud-prevention information under its privacy policy. TrueFetch sends an account identifier and order details to Stripe and uses payment identifiers, amounts, currency, status, refunds and dispute information to maintain your credit balance and handle billing support. Our application does not collect full card numbers or card security codes. Payment processing is separate from public website analytics.
To limit abusive checkout requests, we count requests per account and per client network using pseudonymous keyed identifiers. Network identifiers are derived from the client IP address or IPv6 network prefix; the rate-limit records do not store the raw address. Expired rate-limit records are removed by scheduled maintenance. These essential security controls are separate from public website analytics.
External links
External sites have their own privacy practices. Copying an example to your clipboard occurs only when you choose the copy action.
Questions
Email [email protected] for privacy questions. Messages sent to this address are routed by Cloudflare to our Google-hosted mailbox; we receive your sender address and message contents to respond to your inquiry. For account data, use Settings in the workspace to export your information or request deletion.