Privacy Policy

What Did You Make? (whatdidyoumake.com) is a site where makers launch products and visitors discover, upvote and discuss them. It is run by the team behind What Did You Make?, who is responsible for your personal data under this policy. Questions, requests and complaints: hello@whatdidyoumake.com, or the contact form (pick “Privacy or my data”).

Your account. Name, email address, and a password stored only as a salted PBKDF2 hash (never the password itself), or, if you sign in with Google, the details in the next section. Whether and when you confirmed your email.

Your public profile, if you fill it in. Username, headline, bio, website, X handle and avatar image.

What you post. Launches (name, tagline, description, website, category, tags, pricing, platforms, images, video link, schedule), upvotes, comments, and the upcoming launches you ask to be notified about.

Payments. Payments are processed by Dodo Payments, which acts as the merchant of record. We never see or store your card details. We receive and keep the plan or item bought, the amount, currency, status, refunds and disputes, your billing email, and the customer and payment ids Dodo assigns.

Sponsor bookings. The name, one-line pitch, link and logo you submit for a sidebar slot.

Email. If you sign up for the Monday digest, your email address and when you confirmed or unsubscribed. If you use the contact form, the name, email and message you send.

Security and technical data. Your IP address is used to rate-limit sign-in, sign-up and other actions, and is recorded in a security log with sign-ins, launches, payments and admin actions. For product pages we count views, unique visitors and website clicks. A visitor is counted with a one-way hash of the IP address, browser user-agent and date: the raw IP is never stored for analytics, and the hash changes every day. We also record which site referred a visit, by domain only.

Launch autofill. When you press Autofill, we fetch the website address you typed, read its public title, description, icon and share image, and may send that address to You.com to read the page and draft a description. Only the public page is involved, not your personal data.

If you choose “Continue with Google”, we ask Google only for the basic sign-in scopes (openid, email, profile). From Google we receive your name, email address, whether Google has verified that email, and your Google account's unique ID. Google may also send a profile picture link; we don't store or use it.

• Use. Only to sign you in, to create your account or link it to an existing account with the same verified email, and to mark your email as confirmed. We don't access your Gmail, Drive, contacts, calendar or any other Google data.
• Storage. Your name, email and Google account ID are stored with your account in our database. We don't keep Google access tokens or refresh tokens after sign-in.
• Sharing. We don't sell, rent or share Google user data with anyone, don't use it for advertising, and don't use it to train AI or machine-learning models. It is processed only by the service providers that host our database and site (listed below), on our behalf.
• Deletion. Delete your account from Profile and the Google link and your account data are erased (see how long we keep it). You can also remove our access at any time at myaccount.google.com/permissions.

What Did You Make?'s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• To run your account and sign you in, and to show your launches, profile, votes and comments on the site.
• To rank launches (Featured, leaderboards, Product of the Day and Week) by votes, and to show makers their own analytics.
• To take payments and apply what you bought: your plan, boosts, sponsor bookings and refunds.
• To email you about your account: confirming your email, your launch going live, a badge check, comments and replies (which you can turn off), sponsor reviews, and the digest if you subscribed.
• To check that free launches link back to us, by fetching the website you gave for that launch.
• To keep the site safe: rate limits, spotting abuse and vote rings, and investigating problems.

Our legal bases, where the GDPR applies: performing our contract with you (your account, launches and purchases), our legitimate interests (security, preventing abuse, product analytics without tracking), your consent (the digest, which you can withdraw at any time), and legal obligations (keeping payment records).

Launches that are live, your public profile, your comments and vote counts are visible to everyone and may be shown in the digest, in /llms.txt and to search engines. Scheduled and held launches stay private to you until they go live, unless you choose to list one on Upcoming. Your email address is never shown publicly.

We don't sell personal data. We share it only with the service providers that run parts of the site for us, and only what each needs:

• Cloudflare: hosting, content delivery, image storage (R2), and the DNS lookups made when we check a launch's website.
• Our database and cache providers: storage of everything described above.
• Dodo Payments: payment processing and invoicing, as merchant of record, under its own privacy policy.
• Resend: sending email.
• Google: only if you use Google sign-in.
• You.com: the public website address and page text when you use launch autofill.
• YouTube, Vimeo and Loom: if a maker adds a demo video, it loads from that provider when you view the product page, and the provider may set its own cookies. YouTube videos use its privacy-enhanced (no-cookie) domain.

We may also disclose information when the law requires it, or to protect the rights and safety of our users or the site. If the site is ever sold or merged, your data would pass to the new owner under this policy, and we'd tell you first.

We use two cookies, both strictly necessary, and no advertising or cross-site tracking cookies:

• wdym_session: keeps you signed in. Up to 30 days, or until you log out.
• wdym_oauth: only during Google sign-in, to protect the redirect. Up to 10 minutes.

Because these are essential, we don't show a cookie banner. Embedded videos may set their own cookies, as described above.

• Your account, profile and launches: until you delete them or your account.
• When you delete your account: it is erased at once, with your launches, images, votes, Notify me sign-ups, the Google link and your digest subscription. Your comments are blanked to “deleted”.
• Payment records: kept as long as tax and accounting law requires (generally up to 8 years), with the link to your account removed when you delete it.
• Security log: IP addresses are removed after 90 days, and log entries are deleted after 2 years.
• Raw payment notifications from Dodo: 2 years.
• Rate-limit counters: 15 minutes. Daily visitor hashes: 2 days.
• Digest sign-ups that are never confirmed: 7 days. Addresses that unsubscribed: 30 days.
• Email confirmation and sign-up links: until used, or 48 to 72 hours.
• Contact form messages: in our email inbox, for as long as needed to handle the request.

• See and correct your details in Profile, and your launches in the dashboard.
• Delete your account yourself in Profile. Cancel any paid plan first, so it doesn't keep renewing.
• Stop emails: unsubscribe from the digest with one click in any issue, and turn comment emails off in Profile.
• Get a copy of your data, restrict or object to how we use it, or ask any other question: write to hello@whatdidyoumake.com. We reply within 30 days.

Depending on where you live (for example the EU and UK under the GDPR, or California under the CCPA), these are legal rights, and you can also complain to your local data protection authority. We don't sell or “share” personal information as the CCPA defines those terms.

Connections are encrypted (HTTPS). Passwords are hashed, sign-in tokens and email links are stored only as hashes, payment notifications are verified by signature, and admin access is checked on every request. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.

Our service providers may process data in countries other than yours, including the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses.

The site is not for children. You must be at least 16 to create an account. If we learn that a younger child has given us personal data, we delete it. Think that has happened? Tell us at hello@whatdidyoumake.com.

If we change this policy, we update the date at the top. If a change matters, for example new kinds of data or new ways of using it, we tell signed-in users by email before it takes effect.