max / makenotwork

7.4 KB · 162 lines History Blame Raw

1	# Privacy Policy
2
3	Last updated: June 8, 2026
4
5	Makenotwork is operated by Make Creative, LLC. This policy explains what data we collect and how we use it.
6
7	## The Short Version
8
9	- We collect the minimum data needed to operate
10	- We don't track you across the web
11	- We don't sell your data
12	- We don't show ads
13	- You can export or delete your data anytime
14
15	## What We Collect
16
17	### Account Information
18	- Email address
19	- Username
20	- Password (hashed, we can't read it)
21	- Payment information (handled by our payment processor, we don't store card numbers)
22
23	### Content
24	- Files you upload
25	- Metadata you provide (titles, descriptions, tags)
26	- Projects and organization
27
28	### Personal Annotations
29	Notes you attach to commits are private to you. No other user sees them, and neither does the creator whose repository you annotated. Our server reads them in order to render them back to you on the commit view, the same way it reads any private repository it holds. That means anyone with administrative access to our database could read them as well. We do not, outside of what running the service requires, and you should know the capability exists before writing something there you would not want held on our hardware.
30
31	### Transactions
32	- Purchases and memberships
33	- Payment amounts and dates
34	- Payout records
35
36	### Technical Data
37	- IP address (for security, rate limiting)
38	- Browser type (for compatibility)
39	- Error logs (for debugging)
40
41	IP addresses are retained for 30 days, then deleted.
42
43	### Login and Session Data
44	- IP address and browser type per session (for security alerts and session management)
45	- Failed login attempt counts and timestamps (for account lockout protection)
46
47	Session records are retained for 90 days after the session ends. Failed login data is reset after a successful login.
48
49	## What We Don't Collect
50
51	- Browsing behavior or history
52	- Location data (beyond IP-derived country for tax purposes)
53	- Cross-site tracking or device fingerprinting for identification
54	- Third-party tracking data
55	- Social media profiles
56	- Analytics of any kind. We run no analytics product, first-party or third-party, and no page-view or visitor measurement.
57
58	The one thing your browser reports back to us is a Content Security Policy violation: if a page tries to load a script or style the policy forbids, the browser posts the blocked address and the page it happened on. That report carries no cookie, no identifier, and nothing about you, and it is sent only when a violation occurs. It exists so an injected script shows up in our logs instead of going unnoticed.
59
60	## How We Use Data
61
62	- Operating the service: Hosting content, processing payments
63	- Communication: Account notifications, support responses
64	- Security: Detecting abuse, preventing fraud
65	- Legal compliance: Tax reporting, responding to valid legal requests
66
67	## Data Sharing
68
69	We share data only with:
70
71	- Payment processor: Payment processing (see [Infrastructure & Vendors](../tech/infrastructure.md) for current provider)
72	- Email provider: Sending the mail you receive, which means your address and the message itself (see [Infrastructure & Vendors](../tech/infrastructure.md) for current provider)
73	- Infrastructure providers: Hosting, CDN (they process but don't access your data)
74	- Legal authorities: Only when legally required, and we'll notify you unless prohibited
75
76	We don't sell or share data for advertising.
77
78	Everyone in that list is a processor: they act on our instructions and decide nothing about why your data is held. Project mailing lists are the one place where a second party decides something, and that is a different role. See below.
79
80	## Project Mailing Lists
81
82	When you subscribe to a project's mailing list, Makenotwork and the creator of that project are joint controllers of your address.
83
84	We hold the address, run the send, and hold the contract with the email provider. The creator decides who is on the list and what the mail says. Neither of us decides both, which is what joint controllership means.
85
86	This does not give you two places to write to. One contact answers everything: privacy@makenot.work. Access, correction and erasure requests about a mailing list are fulfilled by us and take effect on the creator's list at the same time.
87
88	The email provider is still a processor here, listed above. Sub-processor and joint controller are separate roles, and the provider holds neither of the decisions that make a controller.
89
90	The full arrangement, including what happens when a creator closes their account with a list still on it, is on the [Mailing List Data Processing](./mailing-list-data-processing.md) page.
91
92	Account mail is not covered by any of this. Receipts, security notices and password resets are ours alone, and no creator is involved in them.
93
94	## Your Rights
95
96	### Access
97	Download all your data anytime from Settings > Export.
98
99	### Correction
100	Edit your account information directly.
101
102	### Deletion
103	Delete your account from Settings > Account > Delete. We remove your personal data within 30 days, except:
104	- Transaction records (legal requirement)
105	- If you have completed sales, purchased content remains accessible to buyers for 90 days after deletion, then is removed
106
107	Subscribed to a mailing list without an account? Write to privacy@makenot.work. You do not need an account to have your address erased.
108
109	### Portability
110	Export includes all content, metadata, and transaction history in standard formats.
111
112	## Cookies
113
114	We use cookies for:
115	- Session management: Keeping you logged in
116	- Security: Preventing unauthorized actions on your account
117
118	We don't use tracking cookies or third-party cookies.
119
120	## Children
121
122	We don't knowingly collect data from children under 13.
123
124	## International Transfers
125
126	Your data is processed in the United States (application server and database) and the European Union (file storage in Germany and Finland). For the specific providers and regions that host it, see our [Infrastructure](../tech/infrastructure.md) page and the service list in [Credits](../about/credits.md), which links to each vendor (including Hetzner).
127
128	For transfers of personal data from the EU/EEA to the United States, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Copies of our SCCs are available upon request at privacy@makenot.work.
129
130	We also maintain data processing agreements with our infrastructure providers that include SCC commitments for any EU personal data they process on our behalf.
131
132	## GDPR (EU Users)
133
134	You have rights under GDPR including access, rectification, erasure, and portability. Contact privacy@makenot.work to exercise these rights.
135
136	Legal basis for processing: contract performance (operating your account), legitimate interest (security), legal obligation (tax records).
137
138	We respond to data subject requests within 30 days.
139
140	## CCPA (California Users)
141
142	You have the right to know what data we collect, request deletion, and opt out of data sales (we don't sell data, so there's nothing to opt out of).
143
144	## Changes
145
146	We'll notify you of material changes via email.
147
148	## Contact
149
150	Privacy questions: privacy@makenot.work
151
152	Data protection inquiries: dpo@makenot.work
153
154	---
155
156	## See Also
157
158	- [Mailing List Data Processing](./mailing-list-data-processing.md): Joint controllership for project mailing lists
159	- [Terms of Service](./terms-of-service.md): Full legal terms
160	- [Acceptable Use Policy](./acceptable-use.md): Content rules
161	- [What We Guarantee](../about/guarantees.md): Data export and portability commitments
162