1. Introduction
Welcome to IconSearch ("we", "our", or "us"). IconSearch is an open-source icon discovery engine and developer productivity platform. This Privacy Policy explains how we collect, use, store, and protect information when you visit iconsearch.info or connect using any of our 18 developer extensions and plugins. By using the Platform, you agree to the practices described in this policy.
2. Information We Collect
We adhere to strict data minimization principles. The types of data we collect include:
• Account Data: When you sign up or log in via Supabase Authentication (Email/Password or Google OAuth), we store your email address, unique user ID, avatar URL, and authentication timestamps.
• Entitlement & Founder Access Claims: When you claim Founder access or product entitlements, we store your user ID, product key (e.g. vscode-extension, figma-plugin), claim status, and timestamp.
• Device Authorization Data (RFC 8628): When you approve an extension or plugin connection, we generate an 8-character user code and store ONLY a cryptographic SHA-256 hash of the session token combined with a server-side pepper (DEVICE_TOKEN_PEPPER). We never store raw session tokens on our servers.
• Cloud Sync Data: If you choose to save custom icon packs or style presets to your account, we store your custom pack names, icon lists, and styling parameters (size, stroke weight, color) in our Supabase database.
• Rate Limiting & Security Logs: To prevent abuse, API flooding, and automated scraping, we temporarily retain client IP addresses in sliding-window memory caches (120 requests/min rate limit).
• Usage Analytics: We use Google Analytics 4 to collect aggregated, anonymized metrics (pageviews, session durations, broad geographical country/city data) to optimize platform performance. All IP addresses are anonymized.
3. Authentication & Security Architecture
Authentication is managed securely through Supabase Auth. Device Authorization for IDE extensions, browser extensions, and design tools follows the RFC 8628 protocol. Session tokens issued to extensions can be individually revoked by users at any time via /api/device/revoke or by signing out. Database access is protected with strict Row Level Security (RLS) policies ensuring users can only access and modify their own packs, presets, and entitlements.
4. Cookies & Local Browser Storage
We use first-party HTTP cookies and LocalStorage to:
• Maintain your active Supabase user session. • Persist local UI settings (such as dark mode preferences, active customizer settings, and local cart items).
Third-party cookies may be set by Google Analytics for traffic analysis and Google AdSense for displaying contextual advertisements. You can disable third-party cookies in your browser settings or opt out of Google Analytics via tools.google.com/dlpage/gaoptout.
5. Google AdSense & Advertising
IconSearch partners with Google AdSense to display contextual advertisements across the platform to help fund server bandwidth and maintenance of our free open-source database. Google AdSense may use cookies, web beacons, and unique advertising identifiers to serve ads based on prior visits to our website or other sites on the internet. Users may opt out of personalized advertising by visiting Google Ad Settings (adssettings.google.com) or the Network Advertising Initiative (optout.networkadvertising.org).
6. How We Use Your Information
Collected data is used strictly for:
• Providing fast in-memory icon search and SVG customizer services. • Authenticating accounts and synchronizing icon packs and presets across devices. • Fulfilling Founder Access entitlements for official developer extensions. • Protecting the Platform from malicious DDoS traffic, automated scraping, and bot attacks. • Understanding aggregated site performance and popular icon search terms.
7. Data Sharing and Third Parties
We do not sell, rent, or trade your personal information. We share minimal necessary data only with trusted infrastructure providers:
• Supabase Inc.: Database storage and authentication. • Google Analytics & Google AdSense: Aggregated traffic measurement and contextual ad serving. • Cloudflare / Vercel: Edge routing, caching, and DDoS mitigation.
8. Data Retention and Deletion Rights
We retain account and sync data for as long as your account remains active. You have the full right to:
• Request a complete export of your account data. • Revoke authorized device sessions at any time via /api/device/revoke. • Request permanent account and data deletion by emailing iconsearchinfo@gmail.com. Account deletion will be processed within 14 business days.
9. GDPR & CCPA/CPRA Privacy Rights
If you reside in the European Economic Area (EEA), United Kingdom, or California, you have statutory rights under GDPR and CCPA, including rights to access, rectify, port, or erase your data, and to restrict or object to certain processing. To exercise these rights, contact us at iconsearchinfo@gmail.com.
10. Children's Privacy
IconSearch is a professional technical platform intended for developers and designers. We do not knowingly collect or solicit personal information from children under 13. If we discover personal data from a child under 13, we will delete it immediately.
11. Policy Updates
We may update this Privacy Policy periodically to reflect infrastructure or legal updates. Material updates will be indicated by revising the "Last updated" date at the top of this page.
12. Contact Us
For privacy inquiries, data deletion requests, or security reports:
📧 Email: iconsearchinfo@gmail.com 🌐 Contact Form: https://iconsearch.info/contact 📍 Operating from: India (Solo Founder / Independent Builder)