How ChronoCode (the “Operator”) handles personal data in Madefolio.
This policy applies from 23 August 2026.
① Account and auth: email and auth identifiers from Google or GitHub OAuth, session cookies. ② Profile: username, display name, bio, website, avatar URL. ③ User content (UGC): projects (title, description, links, cover, tags, category), comments and replies, maker notes, likes, follows, stacks, reports. ④ GitHub import: public metadata from repos you choose (name, description, URLs, etc.). ⑤ Billing: Maker Pro subscription status (e.g. plan tier). Card and tax data are handled directly by Lemon Squeezy (MoR). ⑥ Service operation: access and usage logs, security logs, locale and theme cookies. ⑦ Optional: recipient email when an email provider (SMTP) is configured for notification emails.
We use it for sign-up and sign-in, profiles, public projects and feeds, comments, maker notes, notifications, follows, stacks, Maker Pro billing, URL autofill (public OG metadata), reports and abuse prevention, and support. We do not sell personal data for marketing.
We keep data until you delete your account or the purpose is met, or longer if the law requires. Uploaded images stay in file storage; projects, comments, and related data stay in the database. When retention ends, we delete data so it cannot reasonably be recovered. Requesting "Delete account" in Settings immediately deletes/anonymizes your profile (name, bio, avatar, website) and deletes your makes, projects, and related data. Sign-in is permanently blocked. You can sign up again with the same email as a new profile. This is difficult to undo.
We do not share personal data with third parties by default. Exceptions apply with your consent or when required by law. We do not sell personal data.
We may use: · Supabase - auth, database, file storage · Vercel - web hosting and deployment · Google and GitHub - social sign-in (OAuth) · Lemon Squeezy - Maker Pro payments and subscriptions (Merchant of Record) · Email provider (SMTP) - notification and inquiry email (only when configured) Material changes to providers are reflected in this policy.
Personal data may be transferred to and processed by the following providers outside your country: · Supabase (servers abroad) - authentication, database, file storage · Vercel (servers/CDN abroad) - web hosting and deployment · Google and GitHub (servers abroad) - identity verification for OAuth sign-in · Lemon Squeezy (servers abroad, Merchant of Record) - Maker Pro billing, subscriptions, refunds · Email provider (SMTP, may be abroad, only when configured) - notification and inquiry email The purposes and categories transferred match sections 1 (What we collect) and 5 (Processors) above, and are limited to what's needed to run the service. Exact countries and retention periods may change as each provider's policy changes. This section is general information, not legal advice.
You may request access, correction, deletion, or restriction of processing. Update your profile in Settings or contact us below. Access to another user’s public content follows that user and service policies.
We apply reasonable measures such as access control, authentication, row-level isolation, and common transport/storage protections. No internet service can eliminate all risk.
We use cookies needed for sign-in, locale, and theme. We do not use ad-tracking cookies by default (ads remain off until separately announced). Blocking cookies may limit sign-in and related features.
The service is not directed at children under 14. If we learn we collected a child’s personal data, we will delete it promptly.
We may update this policy for law or product changes. Material updates are posted on this page with an effective date.
Operator (display name): ChronoCode Email: zmimi40@gmail.com
This document is general information only and is not legal advice.