Privacy Policy — Knife Watcher

Effective date: August 4, 2026 · Last updated: August 4, 2026

1. Who we are

Knife Watcher (“Knife Watcher,” “we,” “us,” “our”) is a price-watching and product-discovery service that helps you find hard-to-find items and notifies you about price changes. We are operated by BoNimbus LLC, a Texas limited liability company. Our registered-agent and mailing address is in Austin, Texas, USA; any legal disputes are venued in Denton County, Texas (see our Terms of Use, available at launch).

Important — we are not the seller. Knife Watcher is not a store or a marketplace, and we do not host transactions. When you act on an alert, you click through to a third-party retailer to buy from them directly. Many of our outbound links are affiliate links, meaning we may earn a commission if you buy after clicking — at no extra cost to you. The retailer, not Knife Watcher, is responsible for the sale, the product, shipping, returns, and for complying with the laws (including knife and weapon laws) that apply where you live.

Service status: Knife Watcher is pre-launch. This policy is published ahead of public availability so that it governs the service from its first public day.

2. The short version (summary)

We collect only what we need to run the service: your account email, an optional phone number if you opt in to SMS alerts, strictly-necessary cookies for login and to remember your acceptance of our terms, and first-party usage analytics that stay with us.
We do not use third-party advertising or cross-site trackers or ad pixels.
We do not sell or “share” your personal information as those terms are defined under California and other US state privacy laws.
We honor the Global Privacy Control (GPC) browser signal.
You can access, correct, or delete your information and opt out of any marketing at any time.
The service is for adults — 18 and older. It is not directed to children.

3. What we collect, why, and our legal basis

We do not buy personal information from data brokers, and we do not collect more than we need.

3.1 Account information

Data	Why we collect it
Email address	To create and secure your account, log you in, send service/account messages, and — if you opt in — deliver the alerts you asked for.
Password (stored only as a salted hash; we never see or store the plaintext)	To authenticate you and protect your account.
Your watch list / saved searches / alert preferences	To run the price-watching service you signed up for and notify you of changes.

3.1a Pre-launch waitlist (if you join it)

Before launch, our landing page offers an optional waitlist. If you join, we collect your email address only — no name, no IP address — and use it solely to send one note when Knife Watcher opens. We do not use it for marketing, we do not sell or share it, and we delete the waitlist after that launch note is sent. You can have your address removed at any time by emailing us (§11).

3.2 Phone number (optional — SMS only)

We collect a mobile phone number only if you choose to opt in to SMS alerts. We use it solely to send the text alerts you requested and the program-required STOP/HELP responses.

SMS is delivered through Twilio (see §7, Sub-processors) in accordance with US telemarketing law (TCPA). We never sell or share your phone number or your SMS consent with anyone, and you can text STOP at any time to end messages. Standard message-and-data rates may apply. Our separate SMS Program Terms govern the details.

3.3 Cookies and login/session data

We set a small number of strictly-necessary first-party cookies:

Cookie	Purpose	Type / lifespan
`kw_session`	Authenticates your login and maintains your signed-in session	Strictly necessary (auth/session); `HttpOnly`.
`kw_csrf`	Anti-forgery (CSRF) security token	Strictly necessary (security); session.
`kw_legal`	Records your own acceptance of our legal terms	Strictly necessary; single-purpose; capped at ~6 months.
`kw_magic`	Binds a one-time magic sign-in link to your browser	Strictly necessary (auth); short-lived; `HttpOnly`.
`kw_auth`	Trusted-network perimeter access token	Strictly necessary (auth); ~1 year; `HttpOnly`.

These cookies are required for the site to function. Because they are strictly necessary, they are not subject to consent opt-in — but we still tell you about them here. We do not use these cookies for advertising, profiling, or cross-site tracking.

3.4 First-party usage analytics

To understand how the service is used and keep it reliable, we collect limited, first-party usage analytics — which pages or features are used and aggregate performance/error information — collected and stored by us, with our own tooling and server logs.

No advertising trackers. We do not use Google Analytics, Meta Pixel, or third-party advertising or cross-site trackers. Your data is not used to build advertising profiles.
We honor GPC. If your browser sends a Global Privacy Control signal, our server detects it and disables any analytics that could be treated as “selling” or “sharing” for that visit.
Outbound “Jump to Retailer” clicks — cookieless. When you click a Jump to Retailer link, we record that a click happened and which retailer it went to. To estimate distinct clickers without setting a cookie, we derive a short-lived token from your approximate network address and browser, keyed by a secret that rotates every day and is then discarded. The token is one-way, cannot be linked across days, is first-party only, and is never used for advertising or cross-site tracking. If your browser sends a GPC signal we do not create this token at all.

3.5 Information collected automatically

Our servers automatically receive basic technical information such as your IP address, browser/device type, and timestamps, in ordinary server logs, used to operate, secure, and troubleshoot the service. This stays first-party.

4. How we use your information

We use personal information to: create, secure, and operate your account; run the price-watching service and deliver the alerts you requested; send service and account communications; maintain a record of your acceptance of our legal terms; understand usage and improve, secure, and troubleshoot the service (first-party analytics only); comply with our legal obligations and enforce our Terms; and detect, prevent, and respond to fraud, abuse, and security incidents.

We do not use your information for third-party advertising or for building or selling advertising or marketing profiles.

5. How long we keep it (retention)

We keep personal information only as long as we need it for the purposes above, then delete or anonymize it.

Account data: kept while your account is active. When you delete your account, we delete or anonymize your account data within a reasonable period (target: 30 days), except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements.
Phone number / SMS consent records: kept while you are opted in. If you opt out (text STOP) or delete your account, we remove the number from active sending; we retain a minimal opt-out/consent record as required to honor your opt-out and evidence compliance.
Strictly-necessary cookies: session-length or as listed in §3.3.
Usage analytics and server logs: kept for a limited operational window and then deleted or aggregated/anonymized.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar US state laws. We have never done so.

Global Privacy Control (GPC): Our servers detect the GPC browser signal (the Sec-GPC header) and automatically treat it as a request to not sell/share and to disable any non-essential tracking for that visitor. You do not need an account for this to work.
“Your Privacy Choices”: If and when any law requires it, we will provide a “Your Privacy Choices” link. Given that we do not sell or share, this remains a stance rather than a transaction.

We share personal information only with service providers who help us run the service, under contract, and only for that purpose:

Sub-processor	Purpose	Data involved
Email provider / SMTP	Sending account and alert emails	Email address, message content
Twilio	Sending SMS alerts and STOP/HELP responses	Mobile phone number, message content
Hosting / infrastructure	Running and storing the service (self-hosted; encrypted off-site backups via Cloudflare R2)	Account data, logs

We do not include any third-party analytics or advertising company on this list, because the Knife Watcher service uses none. We may also disclose information if required by law, to protect the rights, safety, or security of our users or us, or in connection with a business transfer — in which case we will require the recipient to honor this policy or notify you of any material change.

8. Your rights and choices

Subject to verification and applicable law, you can: access the personal information we hold about you; correct inaccurate information; delete your account and personal information; opt out of marketing emails (every promotional email has an unsubscribe link) and of SMS (text STOP); and not be discriminated against for exercising these rights.

To make a request, contact us using §11. We will respond within the timeframes required by applicable law. You may use an authorized agent where the law allows.

9. Children’s privacy (18+)

Knife Watcher is intended for adults aged 18 and over. The service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us (§11) and we will delete it.

10. California (CalOPPA) and US state privacy notes

CalOPPA: the categories of information collected, the third parties they may be shared with, how to request changes, how we notify users of changes, and the effective date are all covered above, along with how we respond to GPC / Do-Not-Track-style signals (§6).
Other US state laws (CCPA/CPRA and similar): we are currently below the thresholds that make these laws apply to us, and we do not sell or share personal information. We have nonetheless built GPC honoring and first-party-only data handling in from the start. If our obligations change as we grow, we will update this policy and provide any additional rights or disclosures the law requires.

11. How to contact us

Email: hello@knifewatcher.com
Mailing address: 5900 Balcones Drive, STE 100, Austin, TX 78731, USA
Operator: BoNimbus LLC (operating Knife Watcher)

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the service after an update means you accept the revised policy.