Privacy
Privacy policy
What Figure Finder collects, why, who else handles it, and what you can do about it. You can browse every figure and price without an account and without giving us anything.
Last updated 28 October 2026
Who we are
Figure Finder ("we") runs this website. You can reach us through the contact page.
What we collect
When you create an account
- Email address, to sign you in, reset your password and send account messages. It is never shown on your profile.
- Username, which is public: it appears on your profile and on any collections you make public. You can also sign in with it.
- Password, stored only as a secure hash by our sign-in provider, Supabase. We can't see it.
- Confirmation that you're 16 or older, recorded when you sign up.
Google sign-in
If you choose "Continue with Google", Google tells us your email address and basic profile details (such as your name and profile picture) so we can create or find your account. We don't receive your Google password, and we don't get access to your Gmail, contacts or files. Google's own handling of your data is covered by the Google Privacy Policy.
Things you choose to add
- Profile details: a profile photo, bio, country and social links.
- Favourites, collections, the figures in them, and your notes and condition labels.
- Likes on other people's collections, and any reports you make.
- Privacy settings, which decide whether your profile, favourites and collections are public.
Profile photos are automatically checked for inappropriate content before they're published, using OpenAI's moderation service. The photo is sent to OpenAI for that check only.
Collected automatically
- Figure page views. To work out which figures are popular, your browser keeps a random ID and we count at most one view per figure per day from it. It isn't linked to your account, your name or your IP address.
- Your country, for the default currency. On your first visit, the site asks our host, Cloudflare, which country you're visiting from, to pick a default currency. Only the currency it picks is kept, in your browser; the country isn't stored.
- Settings in your browser. Your chosen currency, cached exchange rates, the random ID above and your sign-in session are kept in your browser's local storage. They stay on your device.
- Problem reports. When you use "Report a problem" on a figure page, we keep the reason and any note you write. If you're signed in, the report is linked to your account. If you're not, we keep a scrambled (hashed) form of your IP address instead, only so we can stop the same person flooding us with reports. It isn't used for anything else, and it's deleted after 30 days.
- Server logs. Like any website, our hosting providers process your IP address and browser details to deliver pages and stop abuse.
Cloudflare Turnstile and Web Analytics
Turnstile
The sign-in, sign-up and password reset forms use Cloudflare Turnstile to check that you're a person and not a bot. Turnstile looks at signals from your browser and device to make that check, and Cloudflare processes them under its own Turnstile privacy addendum. We only receive a pass or fail result.
Web Analytics
We use Cloudflare Web Analytics to count visits and see which pages are used. It doesn't use cookies, doesn't track you across sites and doesn't build a profile of you; we see totals such as page views, referring sites, countries and page load times. See Cloudflare's privacy policy.
Why we use it
- To run your account and the features you use: favourites, collections, your public profile.
- To keep the site safe: stopping bots, spam and abuse, and enforcing the terms.
- To understand which pages and figures are used, so we can improve the site.
We don't sell your personal information, and we don't use it for advertising.
Who else handles it
We use these providers to run the site. They process data on our behalf:
- Supabase: database, sign-in and file storage for your account and profile photo.
- Cloudflare: hosting, Turnstile, Web Analytics and figure photo storage.
- Google: Google sign-in if you use it, and the Inter web font (your browser requests it from Google Fonts).
- OpenAI: moderation of uploaded profile photos.
- jsDelivr and Frankfurter: your browser loads a code library from jsDelivr and daily exchange rates from api.frankfurter.dev. Neither receives your account details.
Links to eBay and shops take you to their sites, where their own privacy policies apply.
How long we keep it
We keep your account information until you delete your account. When you do, your profile, photo, favourites, collections and sign-in are deleted. Anonymous page view counts are kept to calculate popularity and contain nothing that identifies you. Problem reports are kept until we've dealt with them, but the hashed IP address on a signed-out report is deleted after 30 days, and a deleted account's reports are no longer linked to it.
Your choices and rights
- Download your data from Settings at any time.
- Change or remove your profile details, photo and links in Settings.
- Make things private: your profile, favourites and collections each have a privacy setting.
- Delete your account in Settings. This is permanent.
Depending on where you live, you may also have the right to ask what we hold about you, to correct it, to object to some uses, or to complain to your local data protection authority. Email us through the contact page and we'll respond.
Children
Accounts are for people aged 16 and over. If you believe someone younger has made an account, contact us and we'll remove it.
Changes to this policy
If we change how we handle your information, we'll update this page and the date at the top. For significant changes we'll let account holders know.