Privacy Policy

1. Personal data we collect and how

Signed-in users: you can sign in only with a GitHub or Google account; we never receive a password. When you sign in, the authentication service (Supabase Auth) stores:

• Account data: email address, internal user ID, the sign-in provider and its user identifier, profile data supplied by the provider (name or username, profile image URL and similar), sign-up and last sign-in times
• Public profile: display name and profile image URL. The display name is set at first sign-in from the provider's name, otherwise the username, otherwise "user" (your email address is never used as a display name); it is shown publicly next to your comments.

Data you provide:

• Comments: text (up to 2,000 characters), the item commented on, time, author ID and whether it is hidden
• Reactions: like or dislike, the target, time and user ID
• Reports: the reported comment, reporter ID, an optional reason (up to 500 characters) and time

Data generated automatically when you use the Service:

• Usage events: when an item page is viewed or code is copied or shared, we record the item, the kind (view/copy/share), the time and the date. If you are signed in we record your user ID; if not, we record only a SHA-256 hash of your IP address and browser identification (User-Agent) combined with a secret salt and the date. The raw IP address and User-Agent are not stored with events, and the hash changes every day. Its purpose is to count the same visitor only once per day.
• Search queries: used only to answer the search and not stored. When semantic (embedding) search is enabled, the query text is sent to the embedding API provider (see section 5).
• Connection data: Vercel, which hosts the Service, and Supabase, which provides authentication and the database, process technical data such as IP address, requested URL, time and User-Agent while handling requests and may keep it in their own logs for security and operations. For visit statistics the Service uses Vercel Web Analytics and Speed Insights, which store no cookies or visitor identifiers and aggregate page URLs, referrers, country, browser and device type and page performance metrics into statistics that do not identify individuals. No advertising trackers are used.
• Rate limiting: the MCP endpoint counts requests per IP address or API key ID in server memory over one-minute windows to prevent abuse. These counters are not stored in the database.

MCP API keys: for API keys issued by the operator, only a SHA-256 hash is kept in the server configuration, never the key itself. When code is copied through an API key, events record only the key ID.

Visitors who send a quote inquiry (no sign-in needed): the name, contact (email or phone number), project type, budget range, optional preferred schedule and message you type into the inquiry form, and the time you agreed to the collection of personal data. On submission we also store a SHA-256 hash of your IP address with a secret salt (the raw IP is not stored) and the start of your browser identification (User-Agent); the operator may add a processing status and a note. The form has a consent checkbox for collecting and using personal data, and an inquiry cannot be sent without it.

2. Why we use personal data

• Signing you in, identifying you and keeping you signed in
• Providing comments and reactions: showing comments with your display name and profile image, and showing like/dislike counts
• Preventing abuse and running the Service: comment rate limits (5 per minute), handling reports, hiding or deleting inappropriate comments, responding to security incidents
• Handling quote inquiries: contacting you to answer and give a quote or consultation, and spam prevention that limits excessive submissions from the same IP hash (more than 3 per hour or 10 per day)
• Statistics: ranking popular items and aggregate metrics for administrators (views, copies, shares and reactions per item). The admin screens show only aggregates, not individual records.

Legal bases: processing accounts, comments and reactions is necessary to provide the service you request (performance of a contract); security, abuse prevention and anonymous event counting rely on our legitimate interests to the extent necessary. We will ask for your consent before using personal data for any other purpose.

3. How long we keep personal data

• Account data and public profile: until the account is deleted. Deleting an account also deletes its profile, comments, reactions, reports and the usage events recorded with its user ID.
• Comments: until deleted by the author or an administrator. Comments hidden by an administrator are visible only to the author and administrators and are kept until deleted.
• Reactions: until you remove the reaction or delete your account
• Usage events (views, copies, shares): statistics records holding a daily hash or a user ID, deleted automatically every day once they are older than 13 months.
• Quote inquiries: deleted automatically every day once they are older than 12 months from receipt, and sooner without delay if you ask. If the inquiry leads to a contract, records about the contract, payment and tax are kept for the period the law requires.
• Sign-in session cookies: until you sign out or the session expires

Where a law requires us to keep data for longer, we keep it for the period that law sets.

4. Disclosure to third parties

We do not sell or disclose your personal data to third parties, except where a law specifically requires it or authorities request it through legally prescribed procedures. Comments, display names and profile images are published by design and can be seen by anyone.

5. Processors and international transfers

We use the providers below to run the Service, which involves transferring personal data outside Korea. Transfers happen over the network whenever the Service is used, and the retention periods are those in section 3.

• Supabase, Inc. (United States): authentication, database and file storage. Data is stored in the Tokyo, Japan region (ap-northeast-1). Data transferred: the account data, public profile, comments, reactions, reports and usage events listed in section 1
• Vercel Inc. (United States): website hosting, server functions and content delivery (CDN). Connection data, session cookies and the contents of requests are processed on the Vercel infrastructure that serves the request (including the United States).
• Sign-in providers GitHub, Inc. and Google LLC (United States): you sign in with the provider you choose; the provider processes data under its own policy and gives the Service the account data in section 1.

External services that receive no personal data: when semantic search is enabled, item description text and the search queries you type are sent to an OpenAI-compatible embedding API provider. When generating social preview images, the server fetches the font glyphs for the image title from Google Fonts without any visitor data. The site's web fonts are served from the Service's own servers.

If you do not want your data transferred abroad, you can use the Service without signing in; comments and reactions are then unavailable. Each provider's own privacy policy describes how it handles data.

Supabase privacy policy

Vercel privacy policy

6. Your rights and how to exercise them

You can at any time ask to access, rectify or erase your personal data, restrict or object to its processing, receive it in a portable format, and withdraw consent. What you can do yourself in the Service:

• Delete your own comments: the "삭제" (Delete) button next to each comment
• Remove a reaction: press the same reaction button again
• Delete your account: the "계정 삭제" (Delete account) button on the account page, opened by clicking your display name in the header (administrator accounts excluded)
• Sign out: the sign-out button in the header. You can also revoke the Service's access in your GitHub or Google account settings.

Correcting your display name or profile image and requests to access or receive a copy of stored data cannot currently be done in the Service itself; please send them to the contact in section 9, as should requests to delete an administrator account. We will verify your identity, act without undue delay and tell you the outcome. Deleting an account also deletes the related records described in section 3. You may also exercise your rights through a legal representative or an authorised agent.

If you are in the EU/EEA, the UK or another jurisdiction with similar laws, you also have the right to lodge a complaint with your local data protection authority. In Korea you can contact the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), the Supreme Prosecutors' Office (1301) or the Korean National Police Agency (182).

7. Cookies and similar technologies

• Sign-in session cookies: when you sign in, first-party cookies holding the Supabase authentication session are stored, and a temporary security cookie is used during the sign-in flow. They are strictly necessary to keep you signed in and are removed when you sign out or the session expires.
• Session storage (sessionStorage): to avoid counting a view twice when an item page is reopened in the same tab, the browser keeps only a "viewed this item" flag. It is never sent to the server and disappears when the tab is closed.

The Service uses no cookies for advertising or cross-site tracking, and its visit statistics (Vercel Web Analytics) are collected without cookies. You can block cookies in your browser settings, but you will then be unable to sign in. The sign-in provider's own cookie policy applies on its pages.

8. How we protect personal data

• Encryption in transit: the site and its APIs are served over HTTPS.
• Access control: row-level security (RLS) is enabled on every database table, so users cannot read other people's individual reactions or hidden comments and can delete only their own comments. Usage events can be written only by the server, and admin features are open only to user IDs registered as administrators.
• No passwords: sign-in happens only through the providers' OAuth, so the Service stores no passwords.
• Pseudonymisation and hashing: for visitors who are not signed in, only a salted hash of IP address and User-Agent is stored; MCP API keys are kept only as hashes, and logs contain only the key ID.
• Abuse prevention: blocking state-changing requests sent from other sites, comment rate limits and MCP request rate limits
• Secret management: database service keys and API keys live only in server environment variables and are never sent to browsers.

9. Data protection contact

Questions about personal data, requests to access, rectify, erase or restrict processing, account deletion requests and complaints are handled by the operator of the Service.

Operator: 데브스튜디오(devs7udio), representative 김용만, business registration number 226-14-93132, phone 010-8300-8210

10. Children under 14

Children under 14 may not sign in (create an account). We do not knowingly collect children's personal data, and if we learn that an account belongs to a child under 14 we delete the account and related data. Viewing public pages without signing in is not restricted.

Accounts section of the Terms of Service

11. Changes to this policy

If we change this policy, we announce the changes and their effective date on this page at least 7 days in advance, or at least 30 days in advance for changes that matter to your rights, such as collecting new data or using it for new purposes. The "Last updated" date at the top of this page shows when it last changed.

12. Effective date

This Privacy Policy applies from the effective date shown at the top of this page.