Privacy Policy

Who is responsible

OFinder is operated by Mahmoud (“we”). We decide how the personal data described here is used.

For any question or request about your personal data, write to [email protected].

What we collect and why

• Account: your email address, display name, password (stored only as a salted scrypt hash; nobody, including us, can read it), preferred language, account status, the time of your last sign-in and when your email address was verified. We use it to create and protect your account, sign you in and send you verification codes.
• Profile, which you fill in yourself: name, date of birth, nationalities, country of residence, phone number, time zone, education level, field of study, experience, languages (and whether you hold a language certificate), interests, sports and your preferences (countries, categories, attendance, funding, fees and visas). We use it to check your eligibility and to match opportunities to you; your age is calculated from your date of birth.
• Achievements and files: titles, dates and descriptions of achievements, optional evidence files (for example a language certificate or an award, up to 5 MB each) and your profile picture.
• What you do in OFinder: saved opportunities, application tracking (status, personal deadlines, private notes and tasks), comments and likes, reports you send and their evidence, answers to announcement forms, and which version of the terms you accepted.
• Applications sent through an OFinder form: the answers and files you submit to an organization, and the time you agreed to send them.
• Notifications: your notification settings, the notifications we create for you and, for push notifications, the device token, platform, device name and language of each device you register.
• Sign-in and security: active sessions (the name of the device you signed in from, when the session started and when it expires), one-time codes and reset links (stored only as hashes), the second sign-in step of staff accounts (a hashed PIN) and a security log of sensitive actions.
• Contact Us messages: your full name, email address, phone number, message and language, the time you agreed to this policy and, if you were signed in, a link to your account.
• Organization accounts: the organization's name and website, its contact person's name, email and phone number, and the members of its team.
• iOS waiting list: your email address and language, if you ask to be told when the iOS app is available.
• Abuse protection and technical logs: your IP address is held in short-lived counters (24 hours at most) that stop automated abuse such as password guessing; it is not stored with your account. The servers that run OFinder also keep technical logs, which can include IP addresses, to keep the service working and secure.

We do not use your data for advertising, we do not sell it, and OFinder contains no analytics, tracking pixels or third-party scripts.

Opportunity listings from public sources

Listings are added by organizations, by our staff, and from public sources: official websites, public Telegram channels whose administrators gave OFinder's bot access, and web searches. A listing can include names or contact details that the organization itself published. Every imported listing is reviewed by the Founder before it is published, and keeps a record of where it came from. If a listing contains your personal data and you want it corrected or removed, contact us.

Who can see your data

• Your profile details are used for matching and are not shown to other users.
• Your profile picture is visible according to your setting: everyone, signed-in members, or only you.
• Comments show your display name, your picture (according to your setting) and your verification badge.
• When you apply through an OFinder form, the organization receives only the answers and files you submit in that form, and uses them to consider your application.
• OFinder staff see account data only through the permissions they were given; your date of birth and phone number are visible only to the Founder. Staff actions on accounts are recorded in the security log. Nobody can see your password.

Service providers

• Hosting: Amazon Web Services (Stockholm, Sweden) runs the servers that store OFinder's data.
• Email: Mektup (usemektup.com) delivers OFinder's emails (verification codes, password-reset links, notices about changes to your account and, if you enable them, email notifications), so it processes your email address and the content of those emails.
• Push notifications: Google Firebase Cloud Messaging delivers notifications to the Android app, so it processes your device token and the title and text of each notification.

These providers process the data only to provide their service to us. We disclose personal data to others only when the law requires it.

Where your data is processed

Your data is stored on the servers described above. Email and push-notification providers can process data in other countries, including countries outside your own, which may have different data-protection rules.

Cookies and storage on your device

• One cookie, ofinder_session, keeps you signed in on the website. It cannot be read by scripts and expires when you sign out or after 12 hours.
• The website stores your language and theme choices in your browser (ofinder.language and ofinder.theme).
• The Android app stores your sign-in token encrypted with the Android Keystore, and your theme, language and notification-prompt settings. It is excluded from device backups.

OFinder uses no advertising or analytics cookies.

How long we keep data

• Your account, profile, files and activity: until you delete your account.
• Sessions: until you sign out, or 12 hours on the website and 30 days in the Android app.
• One-time codes and password-reset links: deleted after they expire or are used.
• Notification delivery records: 30 days. Read in-app activity notifications: 180 days. Opportunity match results: 90 days.
• Contact Us messages: 365 days after they are received.
• Technical logs: 14 days.
• Abuse-protection counters: 24 hours at most.
• Backups of the database and files: 35 days. Data you delete disappears from backups when they expire.
• Security log: kept without a fixed end date, because it cannot be changed or deleted; after your account is deleted its entries are no longer linked to your account details.
• Reports you sent and their evidence: kept after your account is deleted, as part of our safety records, without a link to your account.
• iOS waiting list: until you ask us to remove your address.

Your choices and rights

• See and download your data: use “Download my data” on your profile page on the website.
• Correct your data: edit your profile at any time.
• Delete your account: use “Delete account” on your profile page on the website or in the Android app's Settings. Your profile, files, saved items, applications (including answers sent to organizations) and notifications are deleted; your comments are blanked.
• Control notifications and who sees your profile picture in Settings.
• Anything else, such as removing a Contact Us message or a listing that mentions you, or a copy of your files: write to [email protected]. We may ask you to confirm that the request comes from you.

Depending on the law that applies to you, you may have further rights, such as to object to or restrict certain processing, or to complain to a data-protection authority.

Children and young people

OFinder does not verify ages. If you are younger than the age at which the law of your country lets you agree to this use of your data yourself, use OFinder only with the permission of a parent or guardian. A parent or guardian can ask us to delete a child's account.

Security

Connections use HTTPS, passwords are stored only as salted hashes, the sign-in cookie cannot be read by scripts, staff accounts need a second sign-in step, uploads are checked for type and size, and sensitive actions are recorded in a log that cannot be changed. No online service can guarantee complete security.

To report a security vulnerability, contact [email protected].

Changes to this policy

The date at the top shows when this policy last changed. We announce significant changes in OFinder.

Contact

• Mahmoud
• Privacy: [email protected]
• Security: [email protected]