Privacy Policy

Who we are

CraftFolio ("we", "us") operates this portfolio and networking platform for Minecraft creators. We are the data controller for the personal data described in this policy. For any privacy question or request, open a support ticket from your account or use the contact details in the "Contact" section below.

What we collect

• Account data — email address, username, display name, and password (stored hashed, never in plain text). If you sign in with Google or Discord, we receive your basic profile from that provider.
• Profile content — anything you add to your public profile: bio, skills, portfolio items, experience, links, and images.
• Activity data — messages, comments, vouches, connections, and support tickets you create on the platform.
• Payment data — payments are processed by Stripe. We never see or store your card details; we store only your Stripe customer reference and subscription status.
• Technical data — standard server logs (IP address, browser type, pages requested) kept briefly for security and abuse prevention.

Why we process it (legal bases)

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — operating your account, displaying your profile, delivering messages and notifications, and processing subscriptions you purchase.
• Legitimate interests — keeping the platform secure, preventing spam and abuse, and moderating content.
• Consent— optional cookies and stored preferences (see "Cookies" below). You can withdraw consent at any time.
• Legal obligation — retaining records where tax, accounting, or other laws require it.

What's public

Your profile, portfolio, experience, vouches, and comments are publicly visible by design — this is a portfolio platform. Private messages, support tickets, email address, and account settings are not public.

Third parties and international transfers

We rely on Supabase (database, authentication, and file storage) and Stripe (payments). Each processes data only as needed to provide their service to us, under data processing agreements. These providers may store data in the United States or other countries; where data leaves the EU/UK, transfers are protected by Standard Contractual Clauses or an equivalent safeguard. We do not sell your personal data, and we do not share it with advertisers.

How long we keep it

Account and profile data are kept while your account is active and deleted or anonymized when your account is deleted, except where we must keep records longer (for example, payment records for tax law, or moderation records needed to enforce bans). Server logs are kept for a short period and then deleted.

Your rights

Depending on where you live (including under the EU/UK GDPR and the California Consumer Privacy Act), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (most of it you can edit directly in Settings and your profile).
• Erasure — ask us to delete your account and associated data.
• Portability — export your portfolio data from Settings in a machine-readable format.
• Restriction and objection — limit or object to certain processing based on legitimate interests.
• Withdraw consent — for anything based on consent, at any time, without affecting prior processing.
• Non-discrimination — we will never treat you differently for exercising a privacy right.

To exercise any of these rights, open a support ticket and we will respond within 30 days. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

Cookies

We keep cookies to a minimum:

• Essential cookies — authentication cookies that keep you signed in. The site cannot function without them, so they are always on and do not require consent.
• Optional storage — with your consent, we save preferences (such as your theme choice) on your device so they persist between visits. If you decline, the site still works — preferences simply reset each visit.

We do not use advertising, analytics, or cross-site tracking cookies. A consent banner is shown on your first visit; your choice is remembered, and you can change it any time by clearing this site's data in your browser, after which the banner will appear again.

Children

CraftFolio is not intended for children under 13 (or the higher minimum age required in your country, such as 16 in parts of the EU). We do not knowingly collect data from children below that age; if you believe a child has created an account, contact us and we will remove it.

Security

We protect your data with encryption in transit (HTTPS), hashed passwords, database access controls, and least-privilege access for staff. No system is perfectly secure, but if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

Changes to this policy

If we make material changes, we will update the date at the top of this page and, for significant changes, notify you on the site or by email before they take effect.

Contact

For privacy questions or to exercise your rights, open a support ticket from your account, or reach us through the About page. We aim to answer all privacy requests within 30 days.