Legal

Privacy policy

Last updated October 24, 2026

reachpony ("we", "us") runs the reachpony.com website, the JSON API at /v1/ and the MCP server at /mcp (together, the "service"). This policy explains what we collect when you or an AI agent acting for you use the service, why, and what you can ask us to do about it. The short version: there are no accounts, no cookies and no tracking; we log searches without saying who made them, and we delete those logs after 90 days.

What we collect

Searches and profile views

When you search, open a business profile or an agent calls a tool, we record:

• the search text and location you entered, the filters (trade, service, requirement codes) and the page number;
• how we interpreted the search (the resolved city or metro and codes), the number of results and how long the search took;
• the id of a business you opened, and the search it was opened from;
• whether it came from the website, the JSON API or the MCP server, which tool was used, and a timestamp.

We do not store your IP address, device identifiers, user agent, name, email address or account with these records. Please don't type personal details (such as your own street address or phone number) into the search box or an agent's query: the text is logged as entered.

Technical data that is not stored

• IP address: used in memory to apply rate limits and to merge search-as-you-type keystrokes into one logged search. It is combined with a one-way hash of your browser's user agent for that purpose, never written to our logs, and dropped from memory within minutes of your last request.
• Hosting and network providers (listed below) process IP addresses and request metadata to deliver and protect traffic, under their own policies.

What we don't collect

No accounts, passwords, payment details or precise location. No cookies, no local storage, no analytics or advertising scripts, no tracking pixels. The website loads nothing from third-party servers: fonts, styles and scripts are served from reachpony.com.

Why we use it

We use the data above only to:

• return search results and profiles;
• keep the service secure and reliable, including rate limiting and investigating abuse or errors;
• improve the service: find searches that return nothing, and decide which cities, trades and services to add;
• report aggregate counts (for example, how often a business appeared in results) that contain no search text.

We do not sell or rent data, use it for advertising or for profiling individuals, try to infer sensitive characteristics, or use it to train AI models. Sponsored placements are chosen by location and trade only, never from who you are or what you searched before, and are always labeled as sponsored.

Who we share it with

We share data only with service providers that run the service for us, and only what they need:

• Railway (hosting): runs our servers and search index.
• Cloudflare (network): serves and protects traffic to reachpony.com.
• Tinybird (analytics database): stores the search records described above.

They may not use it for their own purposes beyond providing their service. We may also disclose data if the law requires it, or to protect the service and its users from fraud or abuse. If reachpony is sold or merged, this policy continues to apply to data collected under it.

When you contact a business through details shown on reachpony (phone, email, website, booking link), you deal with that business directly; we don't see or receive what you send them.

How long we keep it

• Search and profile-view records: deleted after 90 days.
• Aggregate counts with no search text and no identifiers: may be kept longer.
• Rate-limit state: in memory only, minutes.
• Emails you send us: as long as needed to handle your request, then deleted.

Business information

Business profiles are built from information businesses publish about themselves: their own website, plus public place data and their Google rating. A profile can include a business's name, contact details, address, services and prices as the business published them. If you represent a business and want a profile corrected or removed, email [email protected] from an address at the business's domain, and we'll act on it within 7 days.

Security

• All traffic is encrypted in transit (HTTPS). We hold no sensitive personal data; search records are stored with Tinybird, which encrypts data at rest.
• The search index sits on a private network and is read through a key that can only search.
• Access to production systems and logs is limited to the people who run the service.
• Credentials are kept in our host's secret store, never in code, URLs, responses or logs.

If a security incident affects data covered by this policy, we will investigate, notify affected partners and platforms within 48 hours of discovering it, and notify anyone else as the law requires. Report a vulnerability to [email protected].

Your choices and rights

Because we don't store identifiers with search records, we usually can't tell which records are yours. You can still ask us to access or delete them: tell us the search text and roughly when you searched, and we'll find and delete matching records. Depending on where you live (for example, the EU, UK or California), you may have rights to access, correct, delete or object to processing of your personal data, and to complain to a data protection authority. We don't sell or share personal information for cross-context behavioral advertising. Email [email protected]; we reply within 30 days.

If you use reachpony through an AI assistant or agent, that assistant's provider handles your conversation under its own privacy policy. We receive only the tool arguments the agent sends.

Children

The service is not directed at children under 13, and we don't knowingly collect their personal information.

International users

Our servers are in the European Union. Our providers may process data in other countries, including the United States, with the safeguards required by applicable law.

Changes

We'll post changes here and update the date at the top. If a change materially expands what we collect or how we use it, we'll say so on the site before it takes effect.

Contact

Privacy questions and requests: [email protected]. Security: [email protected]. See also the Terms.