Frequently Asked Questions

Everything you need to know about keeping your account safe and how PrefNest works online.

Logging In

What is two-factor authentication (2FA) and does PrefNest use it? Active

Two-factor authentication (2FA) adds a second step to your login. Even if someone discovers your password, they still cannot access your account without also having the one-time code sent to your email.

PrefNest automatically sends a 6-digit code to your registered email address every time you log in. The code expires in 10 minutes and can only be used once.

What happens if I enter the wrong OTP code too many times?

After 3 incorrect attempts your pending login session is cleared and you are returned to the login screen. This prevents automated bots from guessing the 6-digit code.

Simply log in again — a fresh code will be sent to your email.

I didn't receive my OTP email. What should I do?
  • Check your Spam / Junk folder.
  • Make sure the email address on your account is correct.
  • OTP emails are sent within seconds — if nothing arrives in 2 minutes, go back to the login page and try again (a new code is issued each attempt).
  • If the issue persists, contact support@ganootech.com.
Can I sign in with Google, Facebook, Apple, or GitHub?

Yes. When you use a social login, the third-party provider handles password verification and we receive only a verified email address and basic profile information. You do not need to set a separate GT password for social accounts.

Social logins still go through our session security checks (HttpOnly cookies, SameSite protection, CSRF tokens).

Passwords

How is my password stored?

Your password is never stored in plain text. It is hashed using bcrypt (with a cost factor of 12) or Argon2id before being saved to the database. Even if the database were ever exposed, the raw password cannot be recovered from the hash.

What is the password reset process?

Click Forgot Password on the login page. We send a secure, single-use reset link (64 random hex characters) to your email. The link expires after 60 minutes and is invalidated the moment it is used.

If you did not request a reset, you can safely ignore the email — your password remains unchanged.

How do I create a strong password?
  • Use at least 12 characters.
  • Mix uppercase, lowercase, numbers, and symbols.
  • Avoid real words, names, or dates.
  • Use a unique password for every service — a password manager makes this easy.
  • Enable 2FA wherever possible (including here).

Session & Cookies

How does PrefNest protect my session?

Sessions are protected with several layers:

  • HttpOnly cookies — JavaScript cannot read the session cookie, blocking cross-site scripting (XSS) theft.
  • SameSite=Strict cookies — the cookie is not sent on cross-site requests, blocking CSRF attacks.
  • Secure flag — the cookie is only transmitted over HTTPS.
  • CSRF tokens — every form includes a one-time token that must match your session.
  • Session ID regeneration — the session ID changes on login to prevent session fixation.
Does the site use tracking cookies or advertising cookies?

No. PrefNest only uses a single first-party session cookie required to keep you logged in. We do not use advertising networks, tracking pixels, or third-party analytics cookies. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't collect personal data.

What happens when I log out?

Clicking Logout immediately destroys your server-side session and clears the session cookie from your browser. Any subsequent request will be treated as unauthenticated.

Brute-Force & Rate Limiting

Is there protection against brute-force login attacks? Active

Yes. Failed login attempts are tracked by both email address and IP address. After a threshold of failures within a short window, further attempts from that IP or for that account are temporarily blocked.

This is separate from the OTP attempt limit and covers the initial password check.

My account seems locked after failed attempts. How long before I can try again?

Lockouts are time-based and lift automatically. Wait a few minutes, then try again. If you believe your account has been targeted, reset your password immediately via the Forgot Password link and contact support.

How Search Engines See This Site

Is PrefNest indexed by Google?

Only public-facing pages — such as this FAQ, the Privacy Policy, Terms of Service, and the login/register pages — are intended to be indexed. Authenticated pages (dashboard, personas, search results) require a login and are not accessible to search engine crawlers.

What SEO best practices does the site follow?
  • Unique <title> tags on every page describing the page content.
  • Meta description tags on public pages.
  • Canonical URLs (<link rel="canonical">) to avoid duplicate-content penalties.
  • Semantic HTML — correct use of h1/h2/h3 heading hierarchy, <main>, <nav>, <footer>.
  • HTTPS — a confirmed ranking signal for Google.
  • Mobile-responsive design (viewport meta tag, responsive CSS).
  • Descriptive alt text on images.
Does having a favicon affect SEO?

Not directly — favicons are not a ranking factor. However, a recognisable favicon improves click-through rate from browser bookmarks and search results (Google shows them in mobile SERPs), which indirectly benefits SEO over time.

PrefNest provides favicons at multiple sizes (16×16, 32×32, 180×180 Apple touch icon, and Android Chrome icons).

Is there a sitemap?

A sitemap.xml listing all public pages is planned. Submitting it to Google Search Console helps the crawler discover pages faster and understand the site structure.

In the meantime, all public pages are interlinked through the footer navigation, which Google's crawler will follow.

How does page speed affect my ranking?

Google uses Core Web Vitals (Largest Contentful Paint, Cumulative Layout Shift, Interaction to Next Paint) as ranking signals. Key things PrefNest does to stay fast:

  • CSS is served from a single stylesheet (fewer HTTP requests).
  • Images should be served in modern formats (WebP/AVIF) and correctly sized — upload optimised images to persona profiles.
  • Server-side rendering (PHP) means there is no client-side JavaScript framework adding parse time.
  • Retailer API calls (UCP) run in parallel so search results pages load faster.
Does the app use structured data / schema.org markup?

Not yet. Adding JSON-LD structured data (e.g. FAQPage schema on this page) would allow Google to display rich results — expandable Q&A directly in search results — improving click-through rate significantly. This is on the roadmap.

Social Sharing

How does the site look when shared on WhatsApp, Twitter, or LinkedIn?

Social platforms use Open Graph (og:) and Twitter Card meta tags to generate link previews. PrefNest public pages include:

  • og:title and og:description — the headline and summary shown in the preview.
  • og:image — a preview image (the app logo).
  • og:url — the canonical URL.

Persona and search pages are private and do not generate public previews.

Why, what and how

Why does PrefNest want my family's details, what does it keep, and how is it used?

Why we ask for your details. Shopping for the people you love means remembering everyone's sizes, colors and tastes. PrefNest keeps them in one place, so you get the right size and the right gift without guessing and without asking again.

What we keep, and what we never do. We keep what you add: names, sizes, colors, style, loves, birthdays, trips, and photos only if you upload them. We never sell your data, show ads or use tracking cookies. Color and style analysis from a photo is opt-in, for adults only, and we keep just the written results.

How it is used, and who sees it. Only you see your profiles. Someone else sees one only if you invite them and tick what to share. AI assistants and stores you connect see only what you approve, and can't change anything; stores get a size suggestion, not your profile. To suggest sizes and gifts, what you search for and the sizes and colors of the person you're shopping for go to Anthropic's Claude AI. Sensitive details are encrypted, and you can delete a person or your whole account at any time.

See the full Privacy Policy for details.

What We Store

What personal data does PrefNest store?
  • Account: username, email address, hashed password.
  • Personas: name, birthday, gender, clothing/shoe sizes, colour preferences, brand preferences, and any photos you upload.
  • Security logs: failed login attempts (IP address + timestamp) — automatically pruned after the lockout window.
  • OTP codes: hashed, single-use, expire in 10 minutes.

See the full Privacy Policy for details.

Are my persona images stored securely?

Images are stored on the server in a directory that is not publicly browsable. They are served only to your authenticated session. Uploaded filenames are randomised (UUIDs) to prevent guessing.

Deleting a persona image removes both the database record and the file from the server immediately.

Is my shopping search data saved?

Search queries typed into the search bar are used in real-time to call retailer APIs and are not stored in the database. The AI intent classification (powered by Claude) processes your query but does not log it.

Sharing Profiles

How do I share my sizes and likes with family?

Open the persona, go to Sharing and choose Share with someone. Pick what they can see (Family, Friends or Gift exchange, or tick your own), then send the invite link by text or WhatsApp. It works once and expires after 7 days. When they accept, the profile appears on their dashboard, and they always see your latest version, so a gift they choose fits what you like now.

What can they see, and what stays private?

Only what you ticked. Photos, birth year, height, weight and your notes are never shared, and they can't change anything. They can keep their own private notes, like "loved the scarf last year".

Can I stop sharing with one person?

Yes. On the persona's Sharing section, choose Stop sharing next to their name. It takes effect immediately and they aren't notified. You can also change what each person sees at any time.

What is "Who's it for?"

Found something in a shop that isn't for you, but might be perfect for someone? Open Who's it for?, snap the item (and its size tag, for size advice) or paste a product link. We show which of your people it suits, why, in which size, and whose birthday is coming up. Photos are checked once and never saved.

Can I ask someone to fill in their own sizes?

Yes. Open the persona you keep for them and choose Ask them to fill it in, then send the link to them, or to their parent for a child. They sign in (or join free), check the details, and share them back. Their profile then replaces yours, so when they update it ("no more Lego"), you see it.

I already made a persona for someone who shared their profile with me. What happens?

When you accept, we ask whether to use their shared profile instead of yours (we pick it for you when the names match). If you say yes, your copy is hidden, your trips and important dates for them move to the shared profile, and your "Tell me about" note goes into your private notes. If they ever stop sharing, your copy comes back. You can also keep both and replace yours later from the shared profile's page.

Can I get someone's size at a store when buying them a gift?

Yes, if they shared their sizes with you. At stores with the Fit me with PrefNest button, pick them under "Who are you shopping for?". The store only gets the suggested size, never their profile or name. It stops working if they stop sharing their sizes with you.

What are "Loves" and "No thanks"?

Short lists on every persona, like "Loves: soccer, sketching" and "No thanks: Lego". Gift searches lean toward what they love and skip what they don't want, so a 12-year-old who has outgrown Lego isn't sent Lego.

Your Rights

How do I delete my account and all my data?

Visit the Data Deletion Instructions page. You can request full deletion of your account and all associated personas, images, and logs. Deletion is processed within 30 days.

Can I export my persona data?

Data export is on the roadmap. In the meantime, contact privacy@ganootech.com to request a copy of your data.