Privacy Policy

Last updated: October 20, 2026

1. Who we are

Somebody Build This (somebodybuildthis.dev) is a personal side project run by Troy Karraker. For anything about your data, contact hello@somebodybuildthis.dev or use somebodybuildthis.dev/feedback.

2. What we collect

When you sign in

• Email address. Needed to send you sign-in emails and to identify your account. If you sign in with GitHub, we get your email from GitHub.
• Name. For email sign-ins we store the part of your email before the @; for GitHub sign-ins we store your GitHub username. We use it only to suggest your first handle. It's never shown publicly.
• GitHub details (only if you use GitHub). We ask GitHub for permission to read your basic profile and email addresses (scopes read:user and user:email). We store your GitHub account ID, your profile picture URL (shown only to you, in the site menu). We do not store any GitHub access token.
• Handle. Your public name. We keep a record of handles you've used so old ones keep redirecting to you and nobody else can take them.
• Sessions. When you sign in we create a session and store, with it, your IP address and browser user agent, plus when it was created and when it expires (30 days, renewed as you use the site). We use these for security (spotting misuse of an account) and debugging.
• Sign-in codes and links. Each sign-in email has a six-digit code and a link. For the code we store a keyed hash of it, filed under a keyed hash of your email address (not the address itself), with a count of wrong tries (after 5 the code stops working). For the link we store its one-time token, hashed. Both work once and expire after 10 minutes; asking for a new email replaces the code.
• Temporary sign-in state (only if you use GitHub). While you sign in with GitHub, we briefly store a random code and the page to send you back to, so we can check that GitHub's reply belongs to the sign-in you started. It expires after 10 minutes.
• Timestamps such as when you joined and when you last changed your handle.

When you use the site

• Ideas you post: title, description, tags, time posted. Public.
• Interest marks: which ideas you've marked. The count is public.
• Builds: the idea, status (building, paused, shipped), the link, a one-line description, an optional screenshot, and dates. Public, with your handle. Screenshots are stored as public files that anyone with the link can open.
• Links to existing projects ("Already exists?" on an idea page): the idea, the link, a one-line description, whether you said you made it, and when you added it. Public, with your handle.
• Reports: what you reported, the reason and any note. Private to admins, who see your handle with it.
• Email you send us. Email sent to any @somebodybuildthis.dev address (such as hello@somebodybuildthis.dev) is received by Resend, which stores the full message as sent (headers, body and any attachments). A plain-text copy (sender address, subject and text; attachments are listed, not forwarded) is then forwarded to the operator's personal mailbox. This is separate from the website feedback form, which stores no email address.
• Notifications: when someone else starts building one of your ideas, ships a build of it, or links an existing project to it, we store a notification for you: which idea and build or link it's about, who did it (their account, shown to you by handle), when it happened, and whether you've read it. Private to you. You see them under the bell at the top of the site, at /notifications.
• Notification settings: which kinds of notifications you want on the site and by email. We store only the choices you save; anything you haven't changed is on.
• Feedback: what you write and the optional page it's about. Private to admins. If you're signed in, it's linked to your account and admins see your handle; if not, we store no name, email or IP address with it.
• Your public profile at /u/your-handle shows your handle, when you joined, your ideas and your shipped builds.

Automatically

• Rate-limit counters. To prevent abuse, we count requests in short counting windows, keyed to your account, to a request's IP address (for sign-in and other account requests), or to a keyed hash of an email address (how many sign-in emails it was sent and how many wrong sign-in codes were entered for it, per hour and per day). The counter rows can persist after a window ends. Counters keyed to your account or your address are deleted with your account or on request; counters keyed to an IP address may be shared by several people and are cleared separately after their windows end.
• Analytics. We use Vercel Web Analytics to count page views and a few anonymous actions, such as how many ideas are shared or shipped. Vercel describes it as not using cookies and not identifying individual visitors; it records things like the page, referrer, country and device type in aggregate.
• Bot detection. On selected posting and account-management forms, Vercel BotID checks whether the request comes from a person or an automated bot. It runs a script in your browser and looks at signals about the browser and request.
• Server logs. Our host keeps standard request logs (such as IP address, time, page, and user agent) for a limited time.

We don't ask for or store payment details, phone numbers, location beyond what an IP address implies, or contacts.

3. How we use it

• To run the site: sign you in, show what you post with your handle, count interest, and build the gallery.
• To keep it safe: bot checks, rate limits, reviewing reports, and spotting abuse.
• To improve it: reading feedback and looking at aggregate numbers (for example, how many ideas were posted or shipped this week).
• To contact you only about your account and your own ideas: sign-in emails, account-deletion confirmation emails, notification emails when someone starts building, ships, or links an existing project to one of your ideas (rate-limited, and you can turn each kind off), and replies to requests you make. We don't send marketing email. Notification emails are plain text. Email links aren't tracked for opens or clicks, and our emails contain no tracking images.

Legal bases (for people in the EEA/UK): running the service you asked for (contract) for accounts and posting; our legitimate interest in keeping the site secure and working, and in understanding aggregate use, for sessions, logs, bot checks, rate limits, analytics and moderation.

We use AI tools to help run the site (for example, to help review reports or summarize feedback).

4. What's public

Your handle, your ideas, your builds (link, description, screenshot, status, dates), links you add to existing projects (link, description, whether you made it, date), your join date, and interest counts are public and can be indexed by search engines and shown in link previews. You can hide your profile from search engines in Settings: we then ask search engines not to index your profile page and leave it out of our sitemap, though your ideas and builds stay public and may still appear in search results. Assume anything you post publicly can be copied and kept by others, even after you remove it.

5. Who we share it with

We don't sell your personal information, and we don't share it for advertising. We share it only with providers that run parts of the site for us, and only what each needs:

We may also disclose information if the law requires it, to protect people from harm, or to deal with abuse of the site. If the project is ever handed to a new operator, your data would go with it under this policy, and we'd tell you first.

6. Cookies

We use only cookies needed for the site to work:

• Sign-in cookies (set by our login system, Better Auth): a session cookie that keeps you signed in for up to 30 days, a short-lived cache of your session (5 minutes), and temporary cookies used during GitHub sign-in.
• Bot-protection cookies set by Vercel BotID on the forms where it runs.

No advertising or cross-site tracking cookies. Because these are strictly necessary, we don't show a cookie banner.

Unposted ideas in your browser. If you write an idea while signed out and choose “Continue: sign in to post,” we save its title, description and tags in this browser’s local storage, so it’s waiting for you after you sign in. It isn’t sent to us until you click “Post idea.” Anyone using this browser could see it until it’s removed. We remove it when you post it, discard it or sign out (if your browser allows), and we won’t restore it after a day. If you never come back, it can stay in storage until you clear this site’s data in your browser. We also keep a small sign-in marker in local storage (an internal account ID or “signed out”, never your email) so open tabs stay in step.

7. Where data is stored

Our database is in the United States (AWS US-East). Our other providers may process data in the United States and elsewhere. If you're outside the US, your data is transferred to the US.

8. How long we keep it

• Account and posted content: kept while your account exists.
• If you delete your account (in Settings) or ask us to: we delete your account, sessions, GitHub link, interest marks, reports, notifications, notification settings, the builds you made (and their screenshots), the links to existing projects you added, and ideas you posted that nobody else has built on (with any links other people added to them). Reports other people made about content we delete are deleted with it. Screenshots are removed from file storage right after deletion; if that fails, we retry daily until it succeeds.
• Ideas other people have built on: these are reassigned to an anonymous placeholder account and withdrawn from public view, rather than erased, so other people's builds stay intact. Those builds show the idea as unavailable. The idea is no longer linked to you.
• Feedback: stays, unlinked from you.
• Notifications: kept while your account exists. A notification is deleted along with the idea, build or link it's about. If that idea, build or link is hidden or withdrawn, its notifications stop showing.
• Old handles: stay reserved, without any link to you.
• Withdrawn or hidden content: kept (hidden) until you or we delete it, so it can be restored.
• Sessions: expire after 30 days of inactivity.
• Sign-in codes and links: expire after 10 minutes. Codes and links still pending for your address are deleted with your account.
• Temporary sign-in state: expires after 10 minutes. Expired sessions, sign-in codes and links, and sign-in state are deleted daily.
• Feedback: deleted 2 years after you send it, or sooner on request.
• Reports: deleted 1 year after we resolve them, or sooner on request. Reports we haven't resolved yet are kept until we do.
• Inbound email: kept by Resend under its retention settings, and in the operator's mailbox until deleted. We delete it on request.
• Backups: our database provider keeps backups and they expire on its schedule; deleted data may remain in backups until then.
• Analytics and host logs: kept by Vercel under its own retention periods.

9. Your choices and rights

You can:

• See the data we hold about you, and get a copy.
• Fix it. You can change your handle in Settings; for anything else, ask.
• Delete your account and data. You can do it in Settings, or ask us through the feedback page while signed in, or email hello@somebodybuildthis.dev from your account address.
• Hide your profile from search engines in Settings.
• Choose your notifications in Settings: turn each kind on or off, separately for the site and for email. Every notification email also has a link that turns off that kind of email in one step, without signing in.
• Remove a post from public view, or ask us to permanently delete it.
• Object to how we use your data, or ask us to limit it.

To make a request, use the feedback page while signed in or email hello@somebodybuildthis.dev. We'll confirm the request comes from the account holder (usually by replying to your account email) and respond within 30 days. We won't treat you differently for using these rights.

If you're in the EEA or UK, you can also complain to your local data protection authority. If you're in California or another US state with a privacy law, you have the rights that law gives you; we don't sell or "share" personal information as those laws define it, and we don't use sensitive personal information.

10. If you appear in a "found elsewhere" idea

Some ideas are paraphrased from public posts on other sites. We link to the public post and credit it by role only, never by username or personal details. If it's your post and you'd like it removed or the credit changed, tell us and we'll do it.

11. Children

The site isn't for children. You must be at least 13 to sign up (16 in the EEA/UK). If we learn that a child under that age has an account, we'll delete it. If you think that's happened, tell us.

12. Security

We use HTTPS, store sign-in tokens hashed, never show emails publicly, and limit admin access. No system is perfectly secure; if we learn of a breach affecting your data, we'll tell you as the law requires.

13. Changes

If we change this policy in a way that matters, we'll update the date at the top and note it on the site before it takes effect. If we ever want to use your data in a new way, we'll ask first.

14. Contact

Troy Karraker · hello@somebodybuildthis.dev · somebodybuildthis.dev/feedback