max / makenotwork

5.1 KB · 139 lines History Blame Raw

1	# Privacy Policy
2
3	Last updated: June 8, 2026
4
5	Makenot.work is operated by Make Creative, LLC. This policy explains what data we collect and how we use it.
6
7	## The Short Version
8
9	- We collect the minimum data needed to operate
10	- We don't track you across the web
11	- We don't sell your data
12	- We don't show ads
13	- You can export or delete your data anytime
14
15	## What We Collect
16
17	### Account Information
18	- Email address
19	- Username
20	- Password (hashed, we can't read it)
21	- Payment information (handled by our payment processor, we don't store card numbers)
22
23	### Content
24	- Files you upload
25	- Metadata you provide (titles, descriptions, tags)
26	- Projects and organization
27
28	### Transactions
29	- Purchases and memberships
30	- Payment amounts and dates
31	- Payout records
32
33	### Technical Data
34	- IP address (for security, rate limiting)
35	- Browser type (for compatibility)
36	- Error logs (for debugging)
37
38	IP addresses are retained for 30 days, then deleted.
39
40	### Login and Session Data
41	- IP address and browser type per session (for security alerts and session management)
42	- Failed login attempt counts and timestamps (for account lockout protection)
43
44	Session records are retained for 90 days after the session ends. Failed login data is reset after a successful login.
45
46	## What We Don't Collect
47
48	- Browsing behavior or history
49	- Location data (beyond IP-derived country for tax purposes)
50	- Cross-site tracking or device fingerprinting for identification
51	- Third-party tracking data
52	- Social media profiles
53	- Analytics of any kind. We run no analytics product, first-party or third-party, and no page-view or visitor measurement.
54
55	The one thing your browser reports back to us is a Content Security Policy violation: if a page tries to load a script or style the policy forbids, the browser posts the blocked address and the page it happened on. That report carries no cookie, no identifier, and nothing about you, and it is sent only when a violation occurs. It exists so an injected script shows up in our logs instead of going unnoticed.
56
57	## How We Use Data
58
59	- Operating the service: Hosting content, processing payments
60	- Communication: Account notifications, support responses
61	- Security: Detecting abuse, preventing fraud
62	- Legal compliance: Tax reporting, responding to valid legal requests
63
64	## Data Sharing
65
66	We share data only with:
67
68	- Payment processor: Payment processing (see [Infrastructure & Vendors](../tech/infrastructure.md) for current provider)
69	- Infrastructure providers: Hosting, CDN (they process but don't access your data)
70	- Legal authorities: Only when legally required, and we'll notify you unless prohibited
71
72	We don't sell or share data for advertising.
73
74	## Your Rights
75
76	### Access
77	Download all your data anytime from Settings > Export.
78
79	### Correction
80	Edit your account information directly.
81
82	### Deletion
83	Delete your account from Settings > Account > Delete. We remove your personal data within 30 days, except:
84	- Transaction records (legal requirement)
85	- If you have completed sales, purchased content remains accessible to buyers for 90 days after deletion, then is removed
86
87	### Portability
88	Export includes all content, metadata, and transaction history in standard formats.
89
90	## Cookies
91
92	We use cookies for:
93	- Session management: Keeping you logged in
94	- Security: Preventing unauthorized actions on your account
95
96	We don't use tracking cookies or third-party cookies.
97
98	## Children
99
100	We don't knowingly collect data from children under 13.
101
102	## International Transfers
103
104	Your data is processed in the United States (application server and database) and the European Union (file storage in Germany and Finland). For the specific providers and regions that host it, see our [Infrastructure](../tech/infrastructure.md) page and the service list in [Credits](../about/credits.md), which links to each vendor (including Hetzner).
105
106	For transfers of personal data from the EU/EEA to the United States, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. Copies of our SCCs are available upon request at privacy@makenot.work.
107
108	We also maintain data processing agreements with our infrastructure providers that include SCC commitments for any EU personal data they process on our behalf.
109
110	## GDPR (EU Users)
111
112	You have rights under GDPR including access, rectification, erasure, and portability. Contact privacy@makenot.work to exercise these rights.
113
114	Legal basis for processing: contract performance (operating your account), legitimate interest (security), legal obligation (tax records).
115
116	We respond to data subject requests within 30 days.
117
118	## CCPA (California Users)
119
120	You have the right to know what data we collect, request deletion, and opt out of data sales (we don't sell data, so there's nothing to opt out of).
121
122	## Changes
123
124	We'll notify you of material changes via email.
125
126	## Contact
127
128	Privacy questions: privacy@makenot.work
129
130	Data protection inquiries: dpo@makenot.work
131
132	---
133
134	## See Also
135
136	- [Terms of Service](./terms-of-service.md): Full legal terms
137	- [Acceptable Use Policy](./acceptable-use.md): Content rules
138	- [What We Guarantee](../about/guarantees.md): Data export and portability commitments
139