Privacy
Federal Funding Finder has no accounts, does not store your queries and collects no personal information. This page matches PRIVACY.md in the repository.
What the server keeps
| Data | Kept | How long |
|---|---|---|
| Accounts, names, emails | None collected. | None |
| Your queries | Not stored and not logged. Search terms are sent to the upstream API for that request only. | None |
| Response cache | A trimmed copy of each upstream response, stored in Netlify Blobs: only the result fields the tools return (IDs, titles, organizations, amounts, dates, abstracts). Fields that echo the request, such as Grants.gov searchParams and NIH saved-search links, are removed before caching, as are investigator and program officer names, emails and phone numbers. The cache key is an HMAC-SHA256 of the request made with a secret server-side key, so it contains no query text. | 30 minutes (Grants.gov) or 60 minutes (NIH, NSF). Expired entries are never served. They are deleted when read and by an hourly cleanup job. |
| IP address | Counted by Netlify's edge rate limiter (per IP, 60 requests per minute) and, as a salted hash, in function memory. This server does not store or log the raw IP. | Counters reset every 60 seconds |
| Logs | One line per tool call: tool name, success or failure, duration. No query text, no IPs. | Netlify function log retention |
Upstream services
Each tool forwards your search terms to a public federal API. Those services have their own terms and privacy policies:
- Grants.gov terms of use, privacy policy, search2 API
- NIH RePORTER API notes and usage limits, FAQs
- NSF Award Search API documentation, NSF privacy policy
Use of the service is covered by the terms of use.