Skip to main content

max / docengine

5.2 KB · 140 lines History Blame Raw
1 # Privacy Policy
2
3 *Last updated: June 8, 2026*
4
5 Makenotwork is operated by Make Creative, LLC. This policy explains what data we collect and how we use it.
6
7 ## The Short Version
8
9 - We collect the minimum data needed to operate
10 - We don't track you across the web
11 - We don't sell your data
12 - We don't show ads
13 - You can export or delete your data anytime
14
15 ## What We Collect
16
17 ### Account Information
18 - Email address
19 - Username
20 - Password (hashed, we can't read it)
21 - Payment information (handled by our payment processor, we don't store card numbers)
22
23 ### Content
24 - Files you upload
25 - Metadata you provide (titles, descriptions, tags)
26 - Projects and organization
27
28 ### Transactions
29 - Purchases and memberships
30 - Payment amounts and dates
31 - Payout records
32
33 ### Technical Data
34 - IP address (for security, rate limiting)
35 - Browser type (for compatibility)
36 - Error logs (for debugging)
37
38 IP addresses are retained for 30 days, then deleted.
39
40 ### Login and Session Data
41 - IP address and browser type per session (for security alerts and session management)
42 - Failed login attempt counts and timestamps (for account lockout protection)
43
44 Session records are retained for 90 days after the session ends. Failed login data is reset after a successful login.
45
46 ## What We Don't Collect
47
48 - Browsing behavior or history
49 - Location data (beyond IP-derived country for tax purposes)
50 - Cross-site tracking or device fingerprinting for identification
51 - Third-party tracking data
52 - Social media profiles
53 - Analytics of any kind. We run no analytics product, first-party or third-party, and no page-view or visitor measurement.
54
55 The one thing your browser reports back to us is a Content Security Policy violation: if a page tries to load a script or style the policy forbids, the browser posts the blocked address and the page it happened on. That report carries no cookie, no identifier, and nothing about you, and it is sent only when a violation occurs. It exists so an injected script shows up in our logs instead of going unnoticed.
56
57 ## How We Use Data
58
59 - **Operating the service**: Hosting content, processing payments
60 - **Communication**: Account notifications, support responses
61 - **Security**: Detecting abuse, preventing fraud
62 - **Legal compliance**: Tax reporting, responding to valid legal requests
63
64 ## Data Sharing
65
66 We share data only with:
67
68 - **Payment processor**: Payment processing (see [Infrastructure & Vendors](../tech/infrastructure.md) for current provider)
69 - **Email provider**: Sending the mail you receive, which means your address and the message itself (see [Infrastructure & Vendors](../tech/infrastructure.md) for current provider)
70 - **Infrastructure providers**: Hosting, CDN (they process but don't access your data)
71 - **Legal authorities**: Only when legally required, and we'll notify you unless prohibited
72
73 We don't sell or share data for advertising.
74
75 ## Your Rights
76
77 ### Access
78 Download all your data anytime from Settings > Export.
79
80 ### Correction
81 Edit your account information directly.
82
83 ### Deletion
84 Delete your account from Settings > Account > Delete. We remove your personal data within 30 days, except:
85 - Transaction records (legal requirement)
86 - If you have completed sales, purchased content remains accessible to buyers for 90 days after deletion, then is removed
87
88 ### Portability
89 Export includes all content, metadata, and transaction history in standard formats.
90
91 ## Cookies
92
93 We use cookies for:
94 - **Session management**: Keeping you logged in
95 - **Security**: Preventing unauthorized actions on your account
96
97 We don't use tracking cookies or third-party cookies.
98
99 ## Children
100
101 We don't knowingly collect data from children under 13.
102
103 ## International Transfers
104
105 Your data is processed in the United States (application server and database) and the European Union (file storage in Germany and Finland). For the specific providers and regions that host it, see our [Infrastructure](../tech/infrastructure.md) page and the service list in [Credits](../about/credits.md), which links to each vendor (including Hetzner).
106
107 For transfers of personal data from the EU/EEA to the United States, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Copies of our SCCs are available upon request at privacy@makenot.work.
108
109 We also maintain data processing agreements with our infrastructure providers that include SCC commitments for any EU personal data they process on our behalf.
110
111 ## GDPR (EU Users)
112
113 You have rights under GDPR including access, rectification, erasure, and portability. Contact privacy@makenot.work to exercise these rights.
114
115 Legal basis for processing: contract performance (operating your account), legitimate interest (security), legal obligation (tax records).
116
117 We respond to data subject requests within 30 days.
118
119 ## CCPA (California Users)
120
121 You have the right to know what data we collect, request deletion, and opt out of data sales (we don't sell data, so there's nothing to opt out of).
122
123 ## Changes
124
125 We'll notify you of material changes via email.
126
127 ## Contact
128
129 Privacy questions: privacy@makenot.work
130
131 Data protection inquiries: dpo@makenot.work
132
133 ---
134
135 ## See Also
136
137 - [Terms of Service](./terms-of-service.md): Full legal terms
138 - [Acceptable Use Policy](./acceptable-use.md): Content rules
139 - [What We Guarantee](../about/guarantees.md): Data export and portability commitments
140