فهرست

Privacy Policy

Last updated: July 30, 2026

Fihrist ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (the "Service") available at https://fihrist.ai.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

1. Information We Collect

1.1 Information You Provide

  • Account information: Your name and email address, provided by Google when you sign in with Google, or the email address you use for one-time sign-in links. Sign-in is passwordless — we never collect or store a password.
  • Creator catalog sources: The channels or feeds you connect for indexing, and the content published at them (video/audio, captions, titles, descriptions, artwork). This is content you have already published; we fetch it to build your searchable index.
  • Onboarding consent record: When you connect a source, we record the authorization statement you accepted (its exact text and version), the source URL, and technical metadata (IP address, browser user-agent) as the rights trail for your catalog.
  • Payment information: When you subscribe to a paid plan, payment is processed by our Merchant of Record, Paddle. We do not store your full credit card or payment details; these are handled directly by Paddle. We receive limited transaction data such as your name, billing country, and subscription status.
  • Communications: Information you provide when you contact us for support or other inquiries.

1.2 Information Collected Automatically

  • Usage data: How you interact with the Service, such as features used, pages visited, and actions taken.
  • Search and click data on creator pages: When any visitor searches a creator's public page or widget, we log the search query, result counts, and clicks on outbound links (including affiliate links, via our redirect). We use this for abuse and rate-limit protection and to show creators aggregated analytics about their own catalog. Visitors are not required to have an account, and these logs are keyed to the creator's catalog, not to a visitor profile.
  • Device and log data: IP address, browser type, operating system, device identifiers, and access times.
  • Cookies and similar technologies: As described in the "Cookies" section below.

2. How We Use Your Information

We use your information to:

  • Provide, operate, and maintain the Service.
  • Process transactions and manage your subscription (via Paddle).
  • Authenticate users and secure accounts.
  • Respond to your requests, questions, and support inquiries.
  • Send you service-related communications, including account notices and updates.
  • Send marketing communications where you have consented (you may opt out at any time).
  • Analyze usage to improve and develop the Service.
  • Detect, prevent, and address fraud, security issues, and technical problems.
  • Comply with legal obligations.

3. Legal Bases for Processing (for EEA/UK users)

Where the GDPR (or UK GDPR) applies, we process your personal data under the following legal bases:

  • Contract: To provide the Service you have requested.
  • Legitimate interests: To improve and secure the Service, provided these do not override your rights.
  • Consent: For marketing communications and certain cookies.
  • Legal obligation: To comply with applicable laws.

4. How We Share Your Information

We do not sell your personal information. We may share it with:

  • Payment processor: Paddle, our Merchant of Record, processes payments and related transaction data. See Paddle's Privacy Policy.
  • Service providers (subprocessors): The specific third parties below help us operate the Service, each bound by its own terms and confidentiality obligations. Creator catalog content (audio and transcript text) is processed by the AI providers listed, whose service terms state that data submitted via their APIs is not used to train their models:
    • Fly.io — application hosting and databases (primary region: Frankfurt, EU).
    • Groq — speech-to-text transcription of connected audio/video that has no usable captions.
    • Voyage AI — converts transcript text into search embeddings (the vectors that power moment search).
    • Anthropic — analyzes transcript text to extract the books, tools, people, and products mentioned.
    • Google — sign-in with Google (OAuth) and the YouTube Data API used to read connected channels' public metadata and captions.
    • Resend — delivers one-time sign-in link emails.
  • Legal and safety: When required by law, regulation, legal process, or to protect the rights, property, or safety of Fihrist, our users, or others.
  • Business transfers: In connection with a merger, acquisition, or sale of assets, subject to this Policy.

We will update this list when a subprocessor is added or replaced (see "Changes to This Policy").

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. When no longer needed, we will delete or anonymize your information.

Catalog deletion is complete deletion. When a creator removes a channel or requests deletion (see the Terms of Service, "Content Removal and Takedown"), the content comes off our live systems immediately. It stays recoverable for 7 days so an accidental removal can be undone, and is then permanently deleted together with everything derived from it — transcripts, search embeddings, extracted mentions, and caches. Copies inside encrypted backups are deleted as those backups expire on rotation.

Two small records outlive a deletion, and nothing else does. We retain the onboarding consent record (Section 1.1), as evidence of the authorization under which indexing took place. We also retain a removal record containing only an identifier for the source (for example a YouTube channel ID or a podcast feed address), the date of removal, and how much indexing time had been used — which we use solely to apply the re-indexing waiting period described in the Terms, and to answer you if you ask us why a source cannot be re-added. Neither record contains your content: no transcripts, no excerpts, no search queries.

6. Cookies and Tracking Technologies

We use cookies to operate the Service. Today that means essential cookies only — the session cookie that keeps you signed in and short-lived cookies used during sign-in. We do not use third-party advertising or analytics cookies. You can control cookies through your browser settings, though disabling essential cookies will prevent signing in.

If we ever introduce additional cookie categories (for example, analytics), we will update this section first.

7. Data Security

We implement reasonable technical and organizational measures to protect your information against unauthorized access, loss, or misuse. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Request deletion of your information.
  • Object to or restrict certain processing.
  • Request portability of your information.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with a supervisory authority.

Two of these you can exercise yourself, immediately, without asking us:

  • Access and portability. Your dashboard has an Export my data link for each channel. It downloads a single JSON file containing your account details, the channel's settings, your consent records, your subscription record, and everything indexed from your content — the content items, full transcripts, timestamped moments, extracted mentions, and the searches visitors ran on your page. Search embeddings are the one thing omitted: they are mathematical representations derived from the transcript text already in the file, and are meaningless outside our search index. Export is available on every plan, including Free.
  • Deletion. Your dashboard has a Remove this channel control. See "Data Retention and Deletion" above for exactly what happens and when.

For the remaining rights, or if you cannot access your account, contact us at hello@fihrist.ai. We will respond in accordance with applicable law.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own, where data protection laws may differ. Where required, we take appropriate safeguards to protect your information in accordance with this Policy and applicable law.

10. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will take steps to delete it.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on this page and updating the "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Fihrist Email: hello@fihrist.ai Website: https://fihrist.ai