Privacy Policy

1. Who is responsible

talacha.dev (https://talacha.dev) operates nombra.la and is the controller of your personal data. Contact: https://talacha.dev.

2. What data we handle

Searches (no account needed): the text you type is used to generate candidate names and check their availability. We do not store your search text alongside your IP address or link it to your account. Availability results (domain names only) are kept in a temporary cache for up to 24 hours.

IP address: used transiently, as a keyed hash, to limit abuse (rate limits). Our hosting provider may record IP addresses in its infrastructure logs.

Account (optional): email, name, password (we store only a hash), sign-in provider (for example GitHub, if enabled), the date and version of your acceptance of the terms, and session records (dates, IP address, browser) for security. If you save domains or watch TLDs, we store those lists.

Analytics: we use Vercel Web Analytics, which is cookieless and measures aggregate visits (page, referrer, country, device and browser type) without building profiles or tracking you across sites.

Optional features: if the cloud AI tier (OpenRouter) is enabled, your search text is sent to that service to suggest names, and the suggestions are cached for up to 7 days against a hash of the text, not against you. On-device AI (Chrome) and semantic ranking run in your browser; for the latter your browser downloads a model from Hugging Face and components from jsDelivr, so those services see your IP address.

3. Purposes and legal bases

To provide the service and manage your account (performance of a contract, GDPR Art. 6(1)(b)); security, abuse prevention and improving the service through aggregate analytics (legitimate interests, Art. 6(1)(f)); to meet legal obligations (Art. 6(1)(c)); and, where applicable, your consent. We make no automated decisions with legal effects about you. AI-generated name ideas are only suggestions.

4. Who we share data with (processors and third parties)

Vercel (hosting, functions and analytics), Neon (database), Upstash (cache and rate limits), Cloudflare (DNS lookups from our server, domain names only), the Vercel Registrar API and registry RDAP services (candidate domain names only), OpenRouter (optional, search text), GitHub (only if you choose to sign in with GitHub), and Hugging Face and jsDelivr (downloads made by your browser).

We do not sell your personal data or share it for cross-context behavioural advertising. We use no advertising cookies.

5. International transfers

Our providers may process data in the United States and other countries. Where the law requires it, transfers rely on mechanisms such as the EU–US Data Privacy Framework or standard contractual clauses offered by those providers.

6. Retention

Account data is kept while you keep the account and is deleted immediately when you delete it (provider backups expire on their own schedule). Sessions expire after 7 days of inactivity. The availability cache lasts up to 24 hours and usage counters minutes to hours. We do not retain search text.

7. Your rights

Depending on your law (GDPR and UK GDPR, Brazil's LGPD, Canada's PIPEDA, Mexico's LFPDPPP —ARCO rights— and others) you can access, correct, erase or object to the processing of your data, restrict it, request portability and withdraw consent at any time.

Self-service: on the Account page you can download all your data (JSON) and delete your account instantly, with no request needed.

You can also contact us via https://talacha.dev. We reply within 30 days. If you believe your rights are not being respected you may complain to your data protection authority.

8. California residents (CCPA/CPRA)

In the past 12 months we may have collected: identifiers (email, name, IP address), internet activity (pages visited) and account information. We do not sell or share personal information (as those terms are defined), we do not collect sensitive personal information to infer characteristics, and we have no actual knowledge of selling data of people under 16.

You have the right to know, access, correct and delete your personal information, to limit use of sensitive information (not applicable) and not to be discriminated against for exercising your rights. We honour the Global Privacy Control signal; since we neither sell nor share data, nothing changes for you.

9. Cookies and similar technologies

We use only strictly necessary or functional storage: “lang” (language) and “theme” (light/dark, only if you choose one) cookies, each for 1 year, and, if you sign in, the authentication session cookies (httpOnly). Your browser also caches the downloaded AI model. We use no advertising or tracking cookies, so we show no cookie-consent banner.

10. Children

The service is not directed to people under 16 and we do not knowingly collect their data. If you believe a minor created an account, tell us and we will delete it.

11. Security

We use HTTPS, hashed passwords, httpOnly session cookies, rate limits and access controls. No system is 100% secure; if a breach affects you we will tell you and notify authorities where the law requires.

12. Changes

If we change this policy materially we will update the date and version and, where appropriate, notify you.

13. Contact

talacha.dev (https://talacha.dev)