Last updated 2026-08-15
This policy explains what personal data pmcosta.dev collects when you use this wiki, why it is collected, and what you can do about it. It describes the site as it works today, not as a general template.
Who is responsible
The data controller is TODO: legal name — e.g. Pedro Costa, sole trader, trading as pmcosta.dev, based in Portugal. Registered address: TODO: registered address, or omit if not required.
For anything in this policy, write to TODO: contact email.
Browsing without an account
Every lesson, guide, template and tool comparison is readable without signing in. When you browse anonymously the site does not know who you are: no name, no email, no account. It does measure how the site is used — which pages are opened, which searches are run, which prompts are copied — through Mixpanel and Google Analytics, described below. The hosting platform processes your IP address and browser details for the short time it takes to serve a page and to keep the service secure — that is ordinary server operation, and those logs are not linked to a member account.
What is collected when you have an account
- Email address and sign-in identifiers. You can sign in with a one-time link sent to your email, or with Google or X OAuth. The authentication system stores your email, an internal user ID, the provider you used, and timestamps for account creation and last sign-in. There is no password to store. If you use Google or X, the provider may share your name, email address and profile picture with the site during the sign-in handshake.
- Profile. Display name, optional handle, optional profile photo, and your self-declared experience level.
- Learning progress. Which lessons you have marked complete, and the days you were active — used for streaks and badges.
- Workshops. Session bookings and waitlist position, attendance, questions and answers you post in a session, and your progress through session milestones.
- Builds and submissions. Projects you submit — title, description, tools used, links, an optional screenshot — plus votes you cast on other members' builds.
- Notifications. In-app notifications addressed to you and your notification preferences.
- Usage measurement. Pages opened, searches run, prompts copied, outbound links clicked, how far you read a guide, and the account actions listed above. When you are signed in, these are linked to your internal user ID so member journeys can be understood. Your email address and display name are never sent to the analytics provider.
Some of this is deliberately visible to others: your display name, handle, photo and any build you mark public appear on the build wall and in workshop cohort views. Builds kept private stay visible only to you.
Why, and on what lawful basis
- Contract — running your account: signing you in, storing your profile, tracking lesson completions, handling workshop bookings and attendance, and showing your builds. Without this data the account features cannot work.
- Legitimate interest — keeping the site running, secure and free of abuse, and displaying public builds and cohort activity as the community part of the site people join for.
- Consent — optional extras you switch on yourself, such as email notifications and uploading a profile photo. You can withdraw either at any time in your profile.
- Legitimate interest — measuring how the site is used so lessons and guides can be improved. This is limited, aggregate product measurement: no advertising, no selling of data and no cross-site profiling. You can object at any time using the contact address above, and browsers sending a "Do Not Track" signal are excluded automatically.
Who processes the data
Only the providers this site actually depends on:
- Supabase — the database, authentication and file storage behind the site. It holds everything listed above, including profile photos, and it creates the sign-in links sent to your email address.
- Resend — email delivery and the member mailing list. It receives your email address and name so account emails reach your inbox from our own domain, and so we can send occasional updates about new lessons, workshops and giveaways. Alongside that, it receives a small set of activity facts used only to decide who gets which update: when you joined, your stated experience level, whether you are an administrator, how many workshops you attended, builds you shipped and lessons you completed, when you were last active, and which email topics you chose on your profile. Every update email carries a one-click unsubscribe link; unsubscribing stops the updates and does not affect account emails such as sign-in links.
- Cloudflare — Turnstile, the anti-abuse check shown on the sign-in form. It receives your IP address and basic browser signals to confirm you are not an automated script. It does not track you across sites and is not used for advertising.
- Lovable — the platform that builds and hosts the site and serves it over a global content delivery network.
- Google — OAuth sign-in and Google Analytics 4. For sign-in, Google receives the request and may share your name, email and profile picture with the site. For analytics, it receives the usage events described above, plus your approximate location derived from a truncated IP address and basic device and browser details. Signed-in analytics activity is keyed to your internal user ID only; your email address and display name are never sent. Advertising features, Google Signals and ad personalisation are switched off.
- X — OAuth sign-in only. X receives the sign-in request and may share your username, name, email address and profile picture with the site. X is not used for analytics or marketing.
- Mixpanel — product analytics. It receives the usage events described above, processed on its EU servers. Signed-in activity is keyed to your internal user ID only; your email address and display name are never sent. There is no session recording and no automatic capture of what you type.
There is no advertising network, no customer-messaging tool and no separate email marketing service in use. If that changes, this page changes first.
Transfers outside the EU
These providers are US-headquartered and may process data outside the European Economic Area, including for support and for edge delivery of pages. Those transfers rely on the European Commission's Standard Contractual Clauses in each provider's data processing agreement, and, where applicable, on their certification under the EU–US Data Privacy Framework.
How long it is kept
- Account, profile, progress and workshop records: for as long as your account exists.
- Builds and workshop questions: until you delete them, or until the account is deleted.
- After account deletion: your personal records are removed. Anonymous aggregate counts, such as how many people attended a session, may remain because they no longer identify you.
- Server and security logs: kept short-term by the providers as part of operating them.
Your rights
Under the GDPR you have the following rights. To use any of them, email TODO: contact email from the address on your account.
- Access — ask for a copy of the data held about you.
- Rectification — correct anything wrong. Most of it you can edit yourself in your profile.
- Erasure — ask for your account and its data to be deleted.
- Restriction — ask that data be kept but not used while a dispute or correction is being sorted out.
- Portability — receive the data you provided in a machine-readable file, or have it sent to another service.
- Objection — object to processing based on legitimate interest, for example asking that your builds no longer appear publicly.
- Withdraw consent — turn off email notifications or remove your profile photo whenever you like; withdrawing does not affect what was already sent.
Requests are answered within one month. If you are not satisfied, you can complain to the Comissão Nacional de Proteção de Dados (CNPD), the supervisory authority in Portugal.
No automated decision-making
The site does not profile you and makes no automated decisions with legal or similarly significant effects. Streaks and badges are simple counts of your own activity, not assessments of you.
Children
Accounts are intended for people aged 16 or over. If you believe a younger person has created one, write to the contact address and it will be removed.
Changes
When this policy changes, the date at the top of the page changes with it. Material changes will be announced on the site.