Privacy policy
Last updated:
This policy explains what personal data MakerLabs SARL collects through makerlabs.dev and the emails it sends, why, how long it is kept, who helps us process it, and how to exercise your rights. We collect only what the site needs: no advertising, no tracking cookies, and we never sell your data.
Who is responsible
The data controller is MakerLabs SARL, 10 rue de la Paix, 75002 Paris, France. Full company details are in the legal notice.
For any question about your data, or to exercise your rights, write to contact@makerlabs.dev.
What we collect, why, and for how long
When you visit the site
- Technical data of each request — IP address, browser, page requested, time. Cloudflare, our host, needs it to deliver the pages and protect the site from attacks.
- Audience statistics from Cloudflare Web Analytics: pages viewed, referring site, country, type of device. It uses no cookies and does not follow you from site to site.
- Anonymous search counts: when you search the site, we record the filter you used and the number of results — never what you typed, and never who you are.
Legal basis: our legitimate interest in running a secure site and knowing which content is useful (GDPR art. 6(1)(f)).
Kept: search events for 90 days, then only daily totals that identify no one. Request logs are kept by Cloudflare under its own privacy policy.
Your member account
- Your email address and, if you sign in with GitHub or Google, the name and profile picture they share. With GitHub, your username is only used to suggest your handle.
- Your handle, and the display name and bio you choose to add.
- Your settings: email language and reply notifications.
- The link to your GitHub or Google account: its identifier and the access tokens the provider returns when you sign in.
- Your sessions: the browser and IP address each sign-in came from, and when it expires.
- Your passkeys, if you add any: their public key and technical details of the device. Your fingerprint or face never leaves your device.
Your handle, display name, bio and picture are public: they appear on your profile page and next to your comments. Your email address never is.
You can change your display name, bio and settings at any time on your account page. If your account is deleted, your comments stay online but are shown as written by a “deleted member”; everything else linked to the account is deleted. A newsletter subscription is a separate consent: it stays until you unsubscribe with the link in any newsletter.
You must be at least 15 to create an account (the age of digital consent in France).
Legal basis: providing the service you signed up for (GDPR art. 6(1)(b)); for session and sign-in security data, our legitimate interest in protecting accounts (art. 6(1)(f)).
Kept: as long as your account exists. A session ends after 7 days without activity; an email sign-in link expires after 10 minutes.
Comments
- Your comment, when you wrote or edited it, and how it was moderated.
- When someone replies to your comment, we email you. You can turn this off on your account page.
Before a comment is published, its text — and the comment it answers — is checked by an automated classifier (Workers AI, run by Cloudflare) that labels it safe, spam, toxic or off-topic. The classifier can only publish a comment or hold it for review; it never rejects anything. A person reviews every held comment, your first 3 comments and any comment with a link. We record the result, its confidence and the model version.
Legal basis: publishing what you post (GDPR art. 6(1)(b)); for moderation, our legitimate interest in keeping discussions free of spam and abuse (art. 6(1)(f)).
Kept: until you delete the comment. Deleting erases its text; if it has replies, an empty placeholder stays so the conversation still reads.
Favourites and progress
- The articles, tutorials and series you save, and the lessons you mark as done, with their dates. Only you can see them.
Legal basis: providing the service you signed up for (GDPR art. 6(1)(b)).
Kept: until you remove them or your account is deleted.
Newsletter
- Your email address, the language you chose, and the dates you subscribed, confirmed and unsubscribed. If you were signed in, the subscription is linked to your account.
- Double opt-in: we send one confirmation email, and nothing else until you click its link (valid 24 hours).
- Every newsletter has a one-click unsubscribe link, which works for 90 days after the email. The codes in our links are stored only in hashed form.
- For each newsletter sent, whether it reached you.
Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time with the unsubscribe link.
Kept: until you unsubscribe. An unconfirmed sign-up is deleted after 30 days. When you unsubscribe, we delete your record and keep only a one-way fingerprint (hash) of your address, so we never add it back by mistake. Delivery records are kept 180 days.
Contact form
- Your name, email address, subject, message and page language; if you are signed in, a link to your account.
- The message is emailed to us with your address as reply-to, and you receive an acknowledgement.
Legal basis: our legitimate interest in answering you (GDPR art. 6(1)(f)).
Kept: 2 years, then deleted.
Emails you send us
- Mail sent to hello@makerlabs.dev is forwarded to our mailbox, and a copy of the original is archived in private storage (Cloudflare R2, Western Europe).
- We also record its sender, recipient, subject, size and the first 4 KB of its text, to find it again.
Legal basis: our legitimate interest in answering you and keeping a record of our correspondence (GDPR art. 6(1)(f)).
Kept: the archive and the record, 2 years, then deleted.
Emails we send
- Each email we send is logged with a fingerprint (hash) of the recipient's address — never the address itself — its delivery status and the email provider's reference.
Legal basis: our legitimate interest in checking that our emails are delivered (GDPR art. 6(1)(f)).
Kept: 30 days.
Protection against bots
- The sign-in, newsletter and contact forms use Cloudflare Turnstile to check that you are not a bot. It runs in a frame served by Cloudflare.
- To limit abuse, we count requests per email address using a fingerprint (hash) of the address.
Legal basis: our legitimate interest in protecting the site and its members (GDPR art. 6(1)(f)).
Kept: only the fingerprint, with a count that resets within a day.
Videos
Tutorial videos are hosted on YouTube. The player loads only when you press play, from youtube-nocookie.com; from then on, Google's privacy policy applies to what the player collects.
Who processes your data
These providers process data on our behalf, only for the purposes above:
- Cloudflare, Inc. (United States) — hosting and delivery of the site, file storage (R2), sending and receiving email, bot protection (Turnstile), audience statistics (Web Analytics) and comment classification (Workers AI).
- Convex, Inc. (United States) — our database and server functions: accounts, comments, favourites, newsletter and messages are stored there, in the European Union (Ireland).
- Google (Gemini API) — writes and translates our own articles and tutorials from our videos, through Cloudflare AI Gateway. No visitor or member data is sent to it.
- GitHub (Microsoft) and Google — only if you sign in with them; they learn that you use MakerLabs, under their own privacy policies.
- YouTube (Google) — the video player, once you press play.
- Google (Gmail) — the mailbox that receives our forwarded mail and contact-form messages.
- Anthropic (Claude) — Claude, used in the operator's own moderation and support tooling, which displays comments, contact messages and inbound mail. The site itself does not use Anthropic's services.
Nobody else. We do not sell or rent your data, and we show no advertising.
Transfers outside the European Union
Some of these providers are based in the United States, so your data may be processed there. Each transfer is covered by:
- Cloudflare, Inc. (United States) — the EU–US Data Privacy Framework
- Convex, Inc. (United States) — the European Commission's Standard Contractual Clauses
- Google (Gemini API) — the EU–US Data Privacy Framework
- GitHub (Microsoft) and Google — the EU–US Data Privacy Framework
- YouTube (Google) — the EU–US Data Privacy Framework
- Google (Gmail) — the EU–US Data Privacy Framework
- Anthropic (Claude) — the European Commission's Standard Contractual Clauses
Your rights
- Access the data we hold about you, and get a copy in a portable format.
- Have it corrected or deleted.
- Restrict or object to its use when it rests on our legitimate interest.
- Withdraw your consent at any time — for the newsletter, with the link in every email.
- Give instructions on what happens to your data after your death.
To exercise these rights, write to contact@makerlabs.dev. We answer within one month, and may ask you to write from the address linked to your account so we know the request is yours.
Some things you can do yourself: edit your profile on your account page, delete your comments, remove favourites, or unsubscribe from the newsletter.
If you think your rights are not respected, you can file a complaint with the CNIL, the French data protection authority.
Security
The site is served over HTTPS only. Sign-in links and the codes in our emails are stored only as hashes; the mail archive sits in private storage with no public address; and access to the database is limited to the site's operator.
Changes to this policy
We update this policy when the site changes how it uses personal data. The date at the top shows the version in force.