Privacy policy

Who is responsible

The controller of your data is [OPERATOR NAME], [ADDRESS]. Contact for anything about your data: the email at the bottom of this page.

What we collect

• Account: email, username, a hash of your password (never the password itself), or your Google / Apple account id if you sign in with them.
• Profile: display name, bio, roles, languages, directions you'd like to work in, country, time zone, city if you give one, and the contacts you add (for example Telegram, WhatsApp, LinkedIn, Discord).
• Crew activity: crews you join or leave, check-ins, links your crew adds, project pages, upvotes, comments and reports.
• Where you came from: the ?ref= tag of the link you first arrived with, if there was one.
• Security: for each signed-in session, the browser's user agent and IP address; for rate limits, your IP address for a short time.

Why, and on what basis

• To run the service you signed up for — matching you into crews, emails about your crew, the showcase (GDPR Art. 6(1)(b), contract).
• To keep accounts safe and stop abuse — sessions, rate limits, moderation (Art. 6(1)(f), legitimate interests).
• To understand whether Tolokit works — counts such as how many crews ship, built from our own database, never from third-party analytics (Art. 6(1)(f)).
• Public contacts and a public profile are shown only because you choose to show them; you can turn them off at any time (Art. 6(1)(a), consent).

Who sees what

• Everyone: your public profile — name, username, roles, shipped projects and the contacts you marked public.
• Your crew: also the contacts you added, your city and time zone, so you can work together.
• Nobody else: your email, password hash, sessions and private contacts. Admins of Tolokit can see account data to run and moderate the service.

Services we use

These companies process data on our behalf, only for the purpose listed:

• Cloudflare — hosting of the site and the API.
• Neon — the database.
• Resend — sending emails.
• Discord — the crew chat, only if you link your Discord account.
• Google and Apple — sign-in, only if you choose them.

Transfers outside the EU

Some of these providers are based in, or may process data in, the United States. Where they do, transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

• Your account and profile: until you delete your account.
• Sign-in codes: until used or expired. Sessions: until you sign out or they expire.
• After you delete your account: your email, name, bio, contacts and sign-in methods are erased at once and your comments are removed. Crews you were in and their published projects stay, with you shown as a deleted member, because they are also your crew mates' work.
• Server logs kept by our hosting provider: a short period set by that provider.

Your rights

You can see, correct, download and delete your data yourself: Settings → "Download my data" gives you everything we hold about you as a file, and Settings → "Delete account" deletes it. You may also object to processing based on legitimate interests, restrict it, or withdraw consent at any time. Write to us for anything the settings don't cover; we answer within one month.

You can complain to your data protection authority. [OPERATOR'S LEAD SUPERVISORY AUTHORITY]

Cookies

We use only the cookies needed to keep you signed in, and browser storage to remember small things such as the ?ref= tag until you sign up. No advertising or tracking cookies, so there is no cookie banner.

Children

Tolokit is not for anyone under 16. If we learn that an account belongs to someone younger, we delete it.