Privacy policy

Last updated August 31, 2026.

This notice explains how KeebFinder (keeb-finder.com) processes personal data. The controller is Patrick Hallek, Falkenberger Chaussee 4C, 13053 Berlin, Germany ([email protected]). See also the Imprint.

1. What this site does

KeebFinder is a comparison site for mechanical keyboards and related products. You can browse without an account. Some features are optional: email alerts, a local wishlist, a compare list, AI-assisted search, and extra analytics if you allow it.

2. What we collect

Depending on how you use the site, we process:

• Server logs from hosting: IP address, user agent, requested URL, and approximate time. We do not use these logs to build profiles.
• Optional email alerts: email address, product type, the filters you picked, a frequency or wish price, the time you confirmed the subscription, and the IP address of that confirmation click.
• Feedback you send through the contact form, including your email if you include one.
• Aggregated counts when someone opens a product or clicks a vendor link. Those counts are not tied to your identity.
• Search queries you type, stored with the filters we resolved from them so we can improve search. If you use AI-assisted search, the query text is also sent to Google to be turned into filters. Do not put personal data in the search box.
• Your IP address for short-term abuse protection, so a single client cannot flood the AI search endpoint. It is held in server memory for up to one hour and written to our log service only when a limit is exceeded.
• Cookieless Umami pageviews (self-hosted): pages viewed, referrer, browser, device, your approximate country derived from your IP, and a hash of IP address and user agent used to recognise a visit. We do not resolve anything narrower than country, and the IP address itself is not kept in the analytics tables. Custom click events are sent only if you allow optional analytics.

We do not collect special-category data, and we do not run advertising pixels or sell personal data.

3. Email alerts

New-product and price alerts are sent only if you subscribe, tick the consent box, and then click the confirmation link we email you. Until you confirm, we store the pending subscription and send no alerts. Extra alerts you add later for an email that is already confirmed reuse that opt-in; we do not send another confirmation link. The legal basis is Art. 6(1)(a) GDPR and, for promotional mail, § 7 UWG. You can unsubscribe from every email or by writing to [email protected]. Withdrawal does not undo mail we already sent.

Subscription records live in our database (Supabase). The confirmation click is stored with its time and IP address so we can show that you opted in. Confirmation links expire after 48 hours. Transactional confirmation and alert mail goes through Twilio SendGrid. Feedback mail goes through Amazon SES. We keep a subscription until you unsubscribe or ask us to delete it, then delete or anonymize it unless we need a short record to show that we honored the request.

4. Cookies and similar storage

German and EU rules (TDDDG § 25 and GDPR) require consent before we store or read information on your device, unless it is strictly necessary for a service you asked for. Necessary storage does not need a banner. Optional analytics (click events, A/B cookie) do. You can change this later via Cookie settings in the footer.

Necessary (no consent). These stay on your device and are not used for advertising:

• kf_consent cookie, 180 days: stores whether you allowed analytics.
• tailwind-theme in localStorage: light or dark mode after you toggle it.
• currency in localStorage: the currency you picked.
• wish-list-storage in localStorage: products you saved to the wishlist.
• Compare lists in sessionStorage, cleared when the tab closes.
• Builder layout and share-dialog flags in localStorage, only on those pages.
• hasClosedPopup in localStorage: a timestamp set when you dismiss the email-alert dialog, so it does not open itself again for 14 days.
• hasSubscribedNotifications in localStorage: set when you subscribe to email alerts, so the dialog does not open itself again. Stays on your device.
• Gallery scroll position in sessionStorage, so back-navigation lands where you were.

Cookieless pageviews (no consent). We self-host Umami at umami.keebfinder.com. The tracker does not set a cookie and does not write to your device. It counts pageviews, referrer, basic device data, and your approximate country from your IP. A visit is recognised by a hash of IP address and user agent; the IP address itself is not kept in the analytics tables. We respect Do Not Track, and search strings are stripped before sending. Legal basis is Art. 6(1)(f) GDPR (reach measurement on our own infrastructure, no cross-site tracking, no profiles, no ad use). Because nothing is stored on or read from your device for this, TDDDG § 25 does not require consent. To stop it, enable Do Not Track in your browser or email us to object.

Server and diagnostic logs (no consent). We send server-side logs to Axiom so we can keep the site working. These are not stored on your device and are not turned off by Reject. They contain:

• Error reports: the requested path, HTTP method, error message, and stack trace.
• Operational events: when a product link or a vendor link is opened we record the product handle, product type, vendor name, and the target domain. When a wishlist entry is added we record the product handle. These lines are counters for us, not a profile of you.
• Abuse protection: if the AI search rate limit is exceeded, the log line includes the IP address.

Optional analytics (consent). Active only after you choose Accept in the cookie banner, or tick Optional analytics under Customize and save:

• Umami custom events (filter clicks, outbound links, and similar).
• kf_ab cookie, 30 days, only if an A/B test is actually running. It stores which variant you saw so the page stays consistent. It is not used for ads. Rejecting optional analytics prevents this cookie from being set and deletes it if it was already there.

Affiliate links may include a referral parameter. After you click through, the vendor's site may set its own cookies. That processing is theirs. Details: Affiliate disclosure.

5. AI-assisted search

Some galleries let you search in your own words instead of clicking filters. When you use that, the text you typed is sent to Google's Gemini API, which turns it into catalog filters and sends them back. We send only the query text and the list of available filters for that category. We do not send your IP address, cookies, or any account data to Google, and the request is not tied to your identity.

We also store the query and the filters we resolved from it in our own database so we can see which searches fail and improve them. Please do not type personal data into the search box. To protect the endpoint from abuse we count requests per IP address in server memory for up to one hour.

6. Legal bases

• Art. 6(1)(a) consent: email alerts, Umami click events, and the A/B cookie.
• Art. 6(1)(b) contract / requested service: delivering the pages you open, running an AI search you asked for, wishlist and compare storage you use, currency and theme after you set them.
• Art. 6(1)(f) legitimate interests: securing the site and limiting abuse, diagnosing errors, counting product and vendor clicks in aggregate, storing search queries to improve search, and cookieless Umami pageviews. Server and diagnostic logs are not gated by Cookie settings. You can object by emailing us or enabling Do Not Track. We do not send optional events or set the A/B cookie after you reject them.
• Art. 6(1)(c) legal obligation: tax, bookkeeping, and responding to lawful requests.

7. Who receives data

We use processors. They may only use the data on our instructions:

• Vercel Inc., USA: website hosting.
• Supabase Inc., USA: database for alerts, click counts, search queries, and similar operational data.
• Twilio SendGrid, USA: alert emails.
• Amazon Web Services, USA (SES in us-east-1): feedback mail.
• Axiom, USA: server-side error reports, operational event logs, and rate-limit records, as described in section 4. They are not used for advertising.
• Google Ireland Limited and Google LLC, USA: the Gemini API turns an AI search query into catalog filters, as described in section 5. Only used when you run an AI search.

Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses. Umami runs on our own host at umami.keebfinder.com.

The About page can load a Reddit embed after you choose to. That sends a request to Reddit, which has its own privacy policy. You can open the thread on Reddit instead.

8. How long we keep data

• Hosting logs: typically a few days to a few weeks, according to the host.
• Email subscriptions: until you unsubscribe or we delete on request. Confirmation tokens expire after 48 hours. Unconfirmed pending subscriptions are deleted after they expire.
• Feedback mail: as long as needed to reply, then ordinary email retention.
• Umami: up to 24 months.
• Server and diagnostic logs at Axiom: only as long as they are useful for debugging and abuse protection, then removed by the retention window we set on that service.
• Search queries and the filters resolved from them: kept while we use them to improve search. They are not linked to your identity, your IP address, or a session.
• AI search rate-limit counters: at most one hour, in server memory only.
• Consent cookie: 180 days, then we ask again.
• Device storage for theme, wishlist, and similar: until you clear it.

9. Your rights

You can ask for access, correction, deletion, restriction, and data portability, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it the same way you gave it: unsubscribe links, Cookie settings, or email. Withdrawal does not affect processing that already happened.

To use these rights, email [email protected]. We answer within one month. You can also lodge a complaint with a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, datenschutz-berlin.de. If you live elsewhere in the EU or EEA, you can complain to the authority in your own country instead.

We do not use automated decision-making that produces legal or similarly significant effects.

10. Children

The site is not aimed at children under 16. We do not knowingly collect data from them. If you think we have, email us and we will delete it.

11. Changes

If this notice changes in a way that matters, we will update the date above. For material changes we will also post a short note on the site.