heyImade Privacy Policy
Last updated: 7 October 2026. Version 1.0.
In short
- You can browse heyImade without an account and without any tracking cookies.
- To create an account we use Google sign-in and receive only: your email, name, avatar and Google account ID.
- Your profile, your projects, your comments and your votes are public ("Voted by" shows your handle). Your email is never public.
- We do not sell data. There are no ads and no analytics cookies.
- Visitor counters work without cookies and without storing IP addresses (details in section 6).
- You can delete your account and everything in it with one button in Settings.
1. Who is responsible for your data (controller)
Łukasz Król, sole trader in Poland, running heyImade. Company details: https://kroltech.eu/kontakt/#dane-firmy. Contact for all privacy matters: kontakt@heyimade.com. We have not appointed a data protection officer (we are not required to).
2. What data we use, why, on what legal basis and for how long
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| From Google sign-in: email, name, avatar, Google account ID | Create and run your account, sign you in, send the emails listed in section 8 | Contract — art. 6(1)(b) | Until you delete your account |
| Profile you fill in: handle, name, avatar, country, bio, links, tools, "looking for / offering" | Show your public maker profile | Contract — art. 6(1)(b) | Until you change it or delete your account |
| Projects, screenshots, logos, descriptions, Build Receipt | Show your projects and rank them | Contract — art. 6(1)(b) | Until you delete them or your account |
| Votes (who voted for what, when) | Count votes, show "Voted by", stop cheating | Contract — art. 6(1)(b); fraud prevention — legitimate interest, art. 6(1)(f) | Until you remove the vote or delete your account |
| Comments, questions, answers, follows | Run the community features | Contract — art. 6(1)(b) | Until you delete them or your account |
| Daily-salted hash of the IP address (not the IP itself) | Count unique visitors for the badge and counters, rate limits, spotting vote farms | Legitimate interest — art. 6(1)(f): honest numbers and security | Deleted after 2 days |
| Server and error logs (may include IP address, time, address requested, browser) | Keep the site working and secure, fix errors | Legitimate interest — art. 6(1)(f) | 14 days |
| Reports (DSA), decisions, appeals, and your email if you give it | Handle reports and appeals, meet our legal duties | Legal obligation — art. 6(1)(c) (Digital Services Act); legitimate interest — art. 6(1)(f) | 12 months after the final decision |
| Emails you send us | Answer you | Legitimate interest — art. 6(1)(f) | 12 months after the matter is closed |
| "I am 18+" answer (cookie) | Remember that you entered the adults-only section | Necessary for the service you asked for — art. 6(1)(b) | 30 days, stored only in your browser |
When we need data to defend or pursue legal claims, we may keep the relevant part longer, only for that purpose (art. 6(1)(f)).
Statistics in the maker dashboard (views, clicks, countries, referring websites) are aggregated: they show numbers, not people.
3. What is public
Public to everyone, also search engines and AI tools that read the web:
- your profile: handle, name, avatar, country, bio, links and anything else you add;
- your projects and their pages;
- your comments, questions and answers;
- your votes: the list "Voted by" on each project shows the handles of people who voted;
- how many people follow you (we do not show publicly whom you follow).
Your email address, Google account ID and IP hashes are never public.
4. Who receives data
We use only a few providers, each only for what is needed:
- SeoHost (Poland) — hosting of the website, database, files and our email server. Data stays in Poland. SeoHost processes data on our behalf (data processing agreement).
- Google — sign-in. When you sign in, Google tells us who you are (email, name, avatar, ID). Google acts as a separate controller for your Google account; see Google's privacy policy.
- Groq (AI provider, USA) — receives only the public text of the project website you submitted, to suggest a short description or summary. We never send account data, emails or other personal data. If a public website itself contains a name, that name is part of the public text.
- Our own computer — screenshots of project websites and some background jobs run on the operator's own computer in the EU, not at an external company.
- Authorities — only when the law requires it (for example a court order, or reporting a threat to someone's life or child sexual abuse material).
We do not sell or rent data and do not share it for advertising.
5. Transfers outside the European Economic Area
Google may process sign-in data in the USA. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing adequate protection. Groq does not receive personal data from us (see above).
6. Counters and badges without cookies
The visitor counter on project pages and the badge makers place on their own websites do not use cookies and do not store IP addresses. To count each visitor once per day, we compute a one-way hash of the IP address combined with a secret value (salt) that changes every day. The hash is used only to spot duplicates and abuse, and is deleted after 2 days. After that nobody, including us, can connect a number with a person. The country may be read from the IP address at the moment of the visit; we store only the country, not the address.
Page-view counting does not include people who block JavaScript, known bots, or the maker's own visits.
7. Automated decisions
We do not make decisions with legal or similarly significant effects about you based only on automated processing. Automatic tools help us against spam (rate limits, holding suspicious votes for review, blocking links in comments from new accounts). A person checks held votes and makes all moderation decisions.
8. Emails
We email you only about: a new question on your project, an answer to your question, your website not responding for 24 hours, and moderation decisions about your content or account. Every email has a one-click unsubscribe. No marketing without your separate consent.
9. Your rights
You have the right to:
- access your data and get a copy;
- correct your data (most of it you can edit yourself in Settings);
- delete your data — the "Delete account" button removes your account, projects, comments, questions, votes and images;
- restrict processing;
- data portability (we will send your data in a common format on request);
- object to processing based on legitimate interest (art. 21 GDPR);
- withdraw consent at any time, where we rely on consent (currently we do not, except for future optional features);
- lodge a complaint with a supervisory authority. In Poland: the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl). You may also contact the authority in your own country.
Write to kontakt@heyimade.com. We answer within one month. We may ask you to confirm the request from the email linked to your account.
10. Deleting your account
Settings, then "Delete account". We delete immediately: your account, profile, projects, comments, questions, votes, follows and images. Image files and leftovers are cleaned up overnight. Database backups exist for the current and previous day only, so deleted data disappears from them within about 2 days database backups on the server: the current one and one previous (up to 2 days). Pages may stay in search engine caches for some time; this is outside our control.
11. Security
HTTPS everywhere, no passwords stored by us, secure session cookies, uploaded images re-encoded (which removes EXIF data such as GPS location), access to admin functions only through signed requests, secrets never sent to AI tools.
12. Age
Accounts are for people aged 16 and older. If we learn that an account belongs to someone younger, we delete it. If you are a parent and think your child under 16 has an account, write to us.
13. Changes
If we change this policy in an important way, we will tell signed-in users on the site and by email before the change takes effect. The date at the top shows the current version.