Privacy Notice

1. Who we are

Knoim is a trading name of Rocket Domains Ltd, a company incorporated in England and Wales.

Rocket Domains Ltd is the data controller for personal data processed in connection with the Knoim service.

When this Notice says "we", "us", or "our", it means the company named above.

2. Scope of this notice

This Privacy Notice describes how we process personal data when you visit and use knoim.com, including the search service and any companion features such as saved searches and the quiet-word reporting form.

It does not cover third-party websites you reach by clicking on a search result. Those sites have their own privacy notices, which apply once you leave our service.

3. Personal data we process

3.1 When you search

• Your search terms — the words you type into the search box. These are sent to our search results provider to fetch results. We may also log them locally for service operation (see §6).
• Your IP address — used for: (a) regional results bias — your country is detected client-side in your browser by a third-party IP-to-country API (ipapi.co, or a fallback such as ipwho.is or ifconfig.co), which briefly sees your IP and returns only a country code to your browser; (b) rate-limit enforcement and abuse prevention in hashed form on our server; (c) optional query logging in hashed form (unless Do Not Track or Global Privacy Control is signalled by your browser, in which case no IP is logged at all). Your IP is never forwarded to our search results provider in raw or hashed form.
• Your User-Agent and basic request metadata — browser name and version, sent by your browser as part of every web request. Used for rate-limit enforcement, abuse prevention, and (when DNT and GPC are both off) anonymised analytics.

3.2 When you save a search

• Your email address — you give us this voluntarily so we can email you when new results match a saved query. We hash a copy for deduplication.
• Your saved queries and email frequency — used to run the saved search on schedule and compose the email.

3.3 When you send us a quiet word (content report)

• Report contents and category — the URL you are concerned about, the reason, and any details you provide.
• Your email (optional) — used to acknowledge receipt and explain our decision under EU Digital Services Act Article 17 ("statement of reasons") and equivalent UK provisions.
• Your IP (hashed) — kept to detect abusive or duplicate reporting patterns.

3.4 Locally on your device

The following are stored only in your browser's local storage and only when you take an action that requires them. They are never sent to us:

• Theme preference (light or dark mode)
• Chimes preference (sound on/off)
• Auroras preference (animated background on/off)
• Locally bookmarked Knoims (your "Bookmark in this browser" list)

Clearing your browser data removes all of the above. No third party can read them.

4. Why we process this data (legal bases)

Under the UK General Data Protection Regulation, the EU General Data Protection Regulation (Regulation (EU) 2016/679), and equivalent laws, we rely on the following legal bases:

For California, Virginia, Colorado, Connecticut, Utah, Texas, and other US state privacy laws, the corresponding bases are "providing a service requested by the consumer" and the operator's "legitimate business purpose" (or equivalent terminology under each state's statute).

5. Who else processes your data

We use the following sub-processors. Each is bound by a written data processing agreement.

5.1 Search results provider

Knoim uses Brave Search's API to return search results. Brave Software, Inc. operates an independent privacy-respecting search index from the United States.

• What we send: your search terms only.
• What we do not send: your IP address, User-Agent, email, or any identifier we have about you. The API call is made server-to-server from our infrastructure, not from your browser.
• Retention by provider: Brave retains a record of the search terms submitted via our API account for a maximum of 90 days for billing and troubleshooting. These records are associated with our account and not with any individual visitor.
• Brave's own privacy notice: api-dashboard.search.brave.com/privacy-policy
• Brave's data processing addendum: available on request.

5.2 Hosting provider

Our site is hosted on a commercial UK / EU-based managed hosting service. The hosting provider processes server logs (including IP addresses) for security, abuse prevention, and DDoS mitigation under their own privacy policy. Server logs typically retain IPs for a short period (usually 14 days) and are not used to build profiles of visitors.

5.3 Email delivery

Saved-search emails, quiet-word acknowledgements, and statement-of-reasons emails are sent via our hosting provider's outgoing mail service. We do not use a third-party marketing platform.

We do not:

• sell your personal data;
• share your personal data with advertisers or ad networks;
• use your data to train artificial intelligence models, nor permit our search results provider to do so;
• profile you across other websites or apps.

6. How long we keep your data

7. International transfers

Our search results provider is established in the United States. When your search terms are sent to it, that constitutes a transfer of data outside the United Kingdom and the European Economic Area.

We rely on the following safeguards for such transfers:

• Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as supplemented by the UK International Data Transfer Addendum, where the recipient is not separately certified;
• EU-US Data Privacy Framework certification, where the recipient is certified;
• Our own technical safeguards (notably: not transmitting your IP address, User-Agent, or other identifiers when calling the search API).

You may request a copy of the relevant safeguards by contacting us using the details in §13.

8. Cookies and similar technologies

Knoim sets no first-party tracking cookies and no third-party cookies. We use the following browser storage only when you take an action that requires it (a "strictly necessary / user-requested" category exempt from consent under PECR regulation 6(4) and Article 5(3) of the ePrivacy Directive):

You can clear these at any time via your browser's privacy settings.

9. Your rights

9.1 UK and EU (UK GDPR and EU GDPR)

Subject to the conditions set out in the regulations, you have the right to:

• be informed about how we process your personal data (this Notice);
• access the personal data we hold about you (Article 15);
• have inaccurate personal data corrected (Article 16);
• have your personal data erased — the "right to be forgotten" (Article 17);
• restrict the processing of your personal data (Article 18);
• receive a portable copy of your personal data (Article 20);
• object to processing based on legitimate interests (Article 21);
• not be subject to a solely automated decision producing legal effects on you (Article 22) — we do not make any such decisions.

To exercise any of these rights, email us using the contact details in §13. We will respond within one month, which may be extended by two further months for complex requests, in line with Article 12(3).

You also have the right to lodge a complaint with a supervisory authority. In the UK, that is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may complain to your local data protection authority — a list is available at edpb.europa.eu.

9.2 California (CCPA / CPRA)

If you are a California resident, you have the right to know what categories of personal information we collect, to access it, to correct it, to request deletion, to limit the use of sensitive personal information, and to opt out of "sale" or "sharing". We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act. We do not knowingly collect personal information from California residents under the age of 16. You will not be discriminated against for exercising your rights.

9.3 Other US states

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (DPDPA), Oregon (OCPA), Montana, or any other US state with a comprehensive consumer privacy law, you have rights substantively similar to those listed in §9.1 and §9.2 above. We will honour valid verifiable requests under the relevant statute.

9.4 Other jurisdictions

If your local law gives you rights beyond those described above, we will honour those rights to the extent we are required to do so.

9.5 How we verify a request

Because we hold so little identifying information about visitors, the easiest way to identify yourself is to send your request from the email address on file (for saved searches) or to include enough detail for us to recognise your data unambiguously. We may ask follow-up questions to verify your identity before fulfilling any request. We do this to protect your data from misappropriation.

10. Do Not Track and Global Privacy Control

Knoim honours two browser-level privacy opt-out signals: the original Do Not Track header ("DNT") and the modern Global Privacy Control header ("Sec-GPC"). If your browser sends either signal — Brave sends both by default, Firefox sends DNT when its privacy settings are enabled, and DuckDuckGo and Tor Browser send these signals — we do not record your IP address or User-Agent against your search-log entry. The search term itself is still logged for service operation and to power the optional "wonder log".

11. Security

We use industry-standard technical and organisational measures:

• TLS encryption (HTTPS) for all traffic between you, our servers, and our search results provider;
• IP addresses are hashed with a per-installation secret salt before any local storage;
• access to our systems is restricted to authorised personnel of our company and our hosting provider;
• periodic deletion of search-log entries and email-sending records on automatic schedules.

No system is perfectly secure. In the unlikely event of a personal data breach affecting your rights and freedoms, we will notify the UK Information Commissioner's Office (and, where applicable, EU supervisory authorities) within 72 hours of becoming aware of it, and notify affected individuals where the law requires.

12. Children

Knoim is a general-audience service and is not directed at children. We do not knowingly collect personal data from children under the age of 13 (or 16 in some jurisdictions). If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Contact us

For any privacy enquiry, data-subject request, or to lodge an internal complaint, please contact:

• General contact: hello@knoim.com

14. Reporting unlawful content

To report unlawful content, copyright infringement, defamation, or a right-to-be-forgotten request concerning a search result, please use our <a href="https://knoim.com/a-quiet-word/">quiet word</a> form. This is also our notice-and-action mechanism under EU Digital Services Act Article 16 and our content-reporting route under the UK Online Safety Act.

15. Changes to this Notice

We may update this Notice from time to time. Material changes will be reflected by updating the "last updated" date at the top of this page. We recommend you re-read it occasionally. Continued use of Knoim after a change constitutes acceptance of the updated Notice to the extent permitted by applicable law.