Privacy
Last updated: October 24, 2026
Who is responsible
RivalFiled is published by CodeYaz, a company in the Netherlands. CodeYaz is the controller of the personal data described on this page, and the GDPR applies.
Address: Eemstraat 38, 5704 MR Helmond, the Netherlands
Privacy contact: hello@rivalfiled.com
What we store about you today
RivalFiled is in a private beta. Our operator creates each account by hand, at the request of the person it is for. For each account we store only:
- Your email address.
- The date and time your account was created.
- Your plan (free, premium or beta) and your account status (active or unsubscribed).
- The competitor names you ask us to watch, as you wrote them.
- The CPC subclasses you choose.
- Which published applications matched your list each week: the publication number, the week, the competitor name and CPC subclasses it matched on, and when the match was made.
- For each week, whether your list was matched against that week's USPTO file, was empty, or was over your plan's limits, and when.
- Which emails we sent you: the week, the kind of email (weekly summary or data delayed) and when it was sent. We do not keep the email's content.
- For each sign-in link we send you: a fingerprint (SHA-256 hash) of the link's code, never the code itself, when the link expires and when it was used.
- For each device you are signed in on: a fingerprint (SHA-256 hash) of your session cookie's value, never the value itself, when you signed in and when the session ends.
When we link two forms of a company name, for example a parent company and a subsidiary, that link is stored once for all accounts and is not tied to your account.
We send a weekly email to your account's address: the published applications that matched your list that week, a note that none matched, or a note that the week's USPTO data is delayed.
When you ask to sign in, we also email you a sign-in link.
Emails are sent through Resend, our email provider. Resend receives your email address and the email's content in order to deliver it.
Our emails contain no images, no tracking pixels and no tracked links.
Every weekly email has an unsubscribe link. Unsubscribing sets your account status to unsubscribed and stops the weekly emails; your account and your list are kept until you ask us to erase them.
Sign-in and cookies
There are no passwords. To sign in, you enter your account's email address and we email you a link. The link works once, within 15 minutes.
Signing in sets one cookie on that device. It holds a random code, not your email address, keeps you signed in for 30 days or until you sign out, and is used for nothing else. It is needed for signing in, so we do not ask for consent to it.
Expired sign-in links and sessions are deleted within a day. Signing out deletes the session at once.
To limit abuse, we count sign-in requests per email address and per IP address for 15 minutes. The count is kept only in our server's memory; the IP address is first turned into a fingerprint that cannot be reversed, and neither is written to disk or to logs.
Analytics
We count visits to this site with Umami, an open-source analytics tool that CodeYaz runs on its own server.
Umami sets no cookies and stores nothing in your browser.
For each page view it records the page's address, with account, list, competitor, publication and link identifiers removed, the site that sent you, your browser, operating system, device type, screen size and language.
Your approximate location is worked out from your IP address. The IP address itself is not stored.
Your browser sends these page views only to this site; our server passes them on to CodeYaz's analytics server. That server, rented from Hetzner, is in Germany, and the data is kept there for 24 months.
What we do not do yet
- There is no payment yet.
Patent data
The patent data in RivalFiled comes from the patent application publications the USPTO releases. We do not store inventor names. When an applicant or assignee is a person rather than a company, we do not store that person's name or location.
Where the service runs
The site and its database run on servers rented from Hetzner in Nuremberg, Germany, and the site is served through Cloudflare.
Legal basis
We process this data to provide the service you asked for: your account, your watchlist, the weekly matches and the emails. The legal basis is the performance of a contract (Article 6(1)(b) GDPR).
How long we keep it
We keep this data for as long as your account exists. When you ask us to erase your account, we delete it together with your watchlist, your matches, the record of the emails we sent you, and your sign-in links and sessions.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. To use any of these rights, write to the privacy contact above. You also have the right to complain to a data protection authority; in the Netherlands this is the Autoriteit Persoonsgegevens.