Privacy Policy

We collect very little about you directly. The things we do collect fall into two buckets:

• Reactions you leave on a product (a heart tap). This is stored as a one-way hashed identifier tied to a cookie (see §3). We never see your name, email, or IP address.
• Basic, anonymous usage data provided by our hosting provider — such as country, browser type, and pages visited. This data is aggregated and cannot be used to identify you personally.

We do not require you to create an account. We do not ask for your name or email. We do not collect your home address, phone number, or any payment information — purchases happen on third-party sites (AliExpress and similar) that we link out to.

• No personal identifiers (name, email, phone, address).
• No payment or financial information.
• No precise location data.
• No advertising IDs or cross-site tracking.
• No special-category data (race, religion, health, etc.).

A cookie is a small text file stored in your browser. We use two:

• lili_vid — a randomly generated visitor identifier, used only so the heart-reaction button works (so the same person doesn't accidentally react twice). It expires after 365 days. It is hashed before being stored in our database, so the raw value is never saved server-side.
• lili_admin — set only when you sign in to the admin area at /admin. It is strictly required for the admin interface and is removed when you sign out. It is not used for any other purpose.

Both cookies are HttpOnly (not readable by JavaScript), use the SameSite=Lax attribute, and are marked Secure on the live site (HTTPS only).

You can clear cookies at any time in your browser settings. Clearing lili_vid simply resets your reaction history — it does not delete anything else.

To run the Site we rely on a small set of trusted providers. Each one processes only the data necessary to deliver its service:

• Vercel — hosts the website and serves pages. Vercel may log standard request data (IP, user agent, requested URL) for security and performance. See vercel.com/legal/privacy-policy.
• Cloudflare — provides DNS for the domain. Cloudflare does not proxy traffic on this site (DNS-only mode) and therefore does not see page requests.
• Supabase — used as the optional database for products and reactions. On this site Supabase is currently configured in mock-data mode and is not used at runtime. If it is enabled in the future, this policy will be updated.
• Pinterest — when you click the Pinterest icon, you leave the Site and Pinterest's own privacy policy applies.
• Affiliate networks (rzekl.com, AliExpress) — when you click an affiliate link, you leave the Site. Those networks may set their own cookies or read your IP for the purpose of attributing a commission. We do not control those cookies; their policies apply.

Some links on the Site are affiliate links. If you click one and make a purchase, we may receive a small commission at no extra cost to you. Affiliate status never affects which items we curate or how we describe them. For the full disclosure, please see our Terms of Service.

The Site is intended for a general adult audience and is not directed at children under 13 (or under the relevant age in your country). We do not knowingly collect data from children. If you believe a child has interacted with the Site, please contact us and we will address it promptly.

Depending on where you live, you may have some or all of the following rights:

• Access — request a copy of any personal data we hold about you.
• Deletion — ask us to delete any personal data we hold about you.
• Correction — ask us to fix anything that's wrong.
• Objection / restriction — ask us to stop certain processing.
• Portability — receive your data in a machine-readable format.

Because we store only a hashed visitor ID (not your name, email, or IP), the easiest way to “be forgotten” is to clear your cookies. If you'd like to exercise any of these rights formally, email us at hello@homefindslily.com.

The Site is operated from outside the European Union, but we honor GDPR and similar frameworks as a matter of principle. We do not transfer personal data to third countries for processing; the limited hashed data we hold is stored with our hosting provider (Vercel) under their standard data- processing terms.

We use industry-standard practices: HTTPS-only traffic, HttpOnly cookies, server-side hashing, and access controls on the admin area. No system is perfectly secure, but we continuously work to keep your data safe.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top. Material changes will be noted with a banner on the Site for at least 30 days before they take effect.

Questions, concerns, or formal requests? Email us at hello@homefindslily.com. We aim to reply within 7 business days.