What DexFinds stores
and why.

Always on — needed for the site to work

• Sign-in session. If you sign in with Discord, a secure cookie keeps you signed in. We store your Discord ID, display name and avatar.
• Your choices in this browser. Size tool drafts, outfit plans and your personalization choice are kept in your browser’s local storage.
• Your account data. Saved finds, link alerts, your public profile and reviews are stored with your account. Signed-in size tool workspaces also synchronize to our database. Reviews you submit may appear publicly with your public name and avatar.
• Security events. To detect misuse we record sampled API events: time, endpoint template, response status and the network observed by our trusted proxy (IPv4 address or IPv6 /64 network). When that request has a verified Discord session, it is linked to your account. Active event records are kept for up to 30 days and are visible only in private administration; backup copies follow their separate rotation. Shared networks do not prove identity. We do not put request bodies, query strings, passwords or session cookies in these event records.
• Tools and images. A tracking number is sent to the carriers and trackers that may hold it (KakoBuy's tracker, Cainiao, 4PX, Česká pošta and GLS); parcels you save stay in your browser, or on your account once you sign in, where the Discord bot reads them to send you updates. A search image is sent to the relevant provider when you use that tool. Explicit AI listing analysis sends the seller’s listing text and selected listing images to Anthropic. Product images load from their image hosts, which receive your browser’s network request.

Visit statistics — our own, on our server

To see how DexFinds is used we count visits ourselves, on our own server. No analytics company is involved. When you open a page, search, follow a KakoBuy link or enter the monthly drop, and when you leave a page, your browser tells our server, and we record:

• what happened (a page view, a search with its text, a KakoBuy click with the link’s address without its query, a click on Join KakoBuy with the place on the site it was clicked from, such as the navigation bar or the drop page, or that a drop entry was made, without your KakoBuy ID), the page’s path, the time, how long the page was open and in use, and the site or app you came from (its domain only, or the campaign name in the link you followed);
• your IP address, the approximate location our proxy (Cloudflare) derives from it (country, city and a rough position), and whether you use a phone, tablet or computer;
• the currency and the language the site is shown to you in (for example CZK and Čeština), as picked in its menus or, until you pick one, as guessed from your browser’s language;
• a code computed from the random number in the dx_vid cookie (see below) so the same browser is counted once; if your browser keeps no cookies, a code computed from that day, your network and your browser instead. Neither can be turned back into what it was computed from;
• if you are signed in, which account made the visit.

While the monthly drop is open and you are signed in, the number of different finds you have opened this month, counted from these records, decides whether the drop card can appear for you on Finds, until you enter that month’s drop; nothing new is stored in your browser for it.

We do this on the basis of our legitimate interest in understanding and improving the site (GDPR Art. 6(1)(f)); you can object at any time via the contact above. Only our administration can see these records. IP addresses are deleted after 30 days, the rest of the records after 90 days. Our administration area is never counted, and neither are the visits of our own team.

Cookies — what each one is for

These are the cookies DexFinds sets itself. Your browser sends them only to DexFinds, and none of them holds an advertising ID.

• dexfinds_session keeps you signed in after you sign in with Discord. It lasts 30 days from sign-in and is removed when you sign out.
• dexfinds_oauth_state and dexfinds_oauth_next exist only while you sign in with Discord: they check that the answer really comes from Discord and bring you back to the page you came from. They last 10 minutes and are removed when sign-in finishes.
• dexfinds_lang remembers the language you picked, for 1 year.
• dx_vid holds a random number and nothing else, so the visit statistics above count your browser once, not once per page or per network. It is not shared with anyone and is renewed when you visit, for about 13 months.
• dexfinds-appearance remembers the light, dark or system appearance and the accent colour you picked, for 1 year.

On the live site the sign-in cookies carry the __Host- prefix, so no other site can set them. Besides dx_vid, the visit statistics read only the sign-in session, to note which account made a visit. Browsers of our own team also get dx_team, which keeps their visits out of the statistics. Our private administration, used only by our staff, sets its own security cookies there.

Monthly drop — only if you enter

When you enter the monthly drop we store your KakoBuy ID with your account, the month and when you accepted the drop rules; for winners also the prize and whether it was verified and paid. Only winners’ KakoBuy IDs are checked, in KakoBuy’s affiliate overview. Each entry is kept until 12 months after its month has ended, then deleted. Winners’ shortened Discord names (such as dex***) are shown with their prize on the drop page.

Photo search — nothing kept

A photo you search with is processed to find similar pieces and is not stored.

To show marketplace results, the part of the photo you picked is sent to KakoBuy.

To name the piece you tap, only that part of the photo is sent to Anthropic and is not stored.

Personalized finds — a separate choice

Personalization is off until you enable it in “Personalize your finds”. We then use catalogue product identifiers and interaction types: opening a product, arriving from search (not the search text), active viewing time thresholds, scroll depth thresholds, photo and QC interactions, option selection (not your size), saving or removing a save, opening the seller’s link, and hiding or seeing a suggestion.

As a guest, this interest profile stays in this browser. When signed in, a separate profile is stored with your account so recommendations can follow you between devices. Guest history is not automatically uploaded when you sign in. The recommender does not use the visit statistics above, typed text, private size measurements or your old browsing history.

At most 300 recent signals are used. Signals older than 90 days no longer influence recommendations and are pruned as the profile is updated; inactive server profiles require the scheduled retention cleanup. Personalization consent expires after 12 months. You can reset the interest profile, or turn personalization off and clear it, without deleting your saved collection.

Your rights

Under the GDPR you can ask for access to, correction or deletion of your data, object to its processing, or file a complaint with the Czech data protection authority (ÚOOÚ, uoou.gov.cz).