Privacy Policy

Accounts are handled by Clerk. When you sign up, Clerk stores your login details — your email address, and whatever a social login (for example Google or GitHub) hands over, such as your name and profile picture. We read your identity from Clerk; we do not store your password, and we never see it.

Clerk sets cookies in your browser to keep you signed in. Clearing them signs you out.

Your profile, posts, projects, spaces, comments, likes, and challenge completions are stored in a Supabase Postgres database. Anything you post inside the community is visible to other signed-in members. Some things are public to the whole internet only if you opt in — public project pages and public builder profiles are off by default.

Files you upload — avatars, project images, attachments — go to Cloudflare R2. Your browser uploads them straight to R2 using a short-lived signed URL, so the file itself does not pass through our servers. The bucket is served publicly, which means anyone with the file’s URL can open it.

The optional paid membership runs through Gumroad. Gumroad takes the payment and holds the card details — we never see them. We receive enough from Gumroad to know that your membership is active, and you manage or cancel the subscription on Gumroad’s own site.

We use PostHog to see which pages and features get used. It records page views and a small number of product events. This only runs when the site is configured with a PostHog key; where it is not configured, no analytics are sent at all.

If you use the avatar generator, the prompt is sent from our server to fal.ai, which generates the image and returns it. The resulting picture is stored with your profile like any other upload. This feature is off entirely unless the site is configured with a fal.ai key.

The live visitor counter on the home page is built to count people without identifying them. Concretely, for each visit we store:

• a random session id, generated in your browser and kept in sessionStorage — it is thrown away when you close the tab;
• a two-letter country code, which our hosting platform derives from your connection (the x-vercel-ip-country header). Country is the finest location detail that exists anywhere in this system;
• the page path you are on, checked against a strict allowlist pattern before it is saved — no query strings.

We do not store your IP address, your user agent, or your referrer. There is no link between a presence row and any user account, and no way to follow one person across separate visits.

Retention: the live table keeps a row for at most 90 secondsafter your last heartbeat, and a scheduled job deletes anything older every minute. A second, permanent table keeps one row per session — session id, country, timestamp — purely as the running total behind “N visits since <date>”.

One extra detail, for completeness: to stop one person inflating the live count, a temporary throttling fingerprint is attached to the live row. It is never copied into the permanent ledger, never logged, and disappears with the row inside 90 seconds.

Only the services named above: Clerk, Supabase, Cloudflare R2, Gumroad, PostHog, fal.ai, and our hosting platform. We do not sell your data and we do not share it with advertisers.

You can edit or clear your profile at any time from your settings. To delete your account and the content attached to it, contact us via the about page. Payment records held by Gumroad are Gumroad’s to keep or remove under their own policy.

When these practices change, this page changes with them and the date at the top moves. There is no separate notification.