Privacy Policy

Last updated: September 12, 2026

1. The Short Version

Plain English: an account is your name, a username, your email, and a password we can never read. Your username is public on the Market; your real name and email are not. We also look at your IP address, the rough part of the world it points to, and a device signal — only to stop one person making ten accounts to farm free BuildBux. That check is automatic, it can hold back free credit, it can never touch anything you paid for, and it can never close your account. A real human will look again if you ask: GadgetUpSupport@gmail.com. No trackers, no ad pixels, nothing sold to anyone. Your idea text goes to an AI to make your plan — section 8 names which ones — and your saved inventions live in your own browser. If you turn on pay-as-you-go, Square holds your card and we never see the number.

2. What We Collect, Why, and How Long We Keep It

This is the whole list. If something is not in this table, we do not collect it.

Four columns — swipe the table sideways to read the retention and where it goes.

Data	Why we need it	How long we keep it	Where it goes
Your full name and your username	To label your account, to sign the builds you publish, and to address the emails we send you	For as long as your account exists. Deleted when you ask us to delete the account.	Cloudflare KV. Never sold, never shared.
Your email address	It is your login, it holds your BuildBux balance, and it is where ordered build instructions are sent	For as long as your account exists. Deleted when you ask us to delete the account.	Cloudflare KV. Messages are delivered by our email provider. Never sold, never shared.
Your password, stored only as a salted one-way hash	So you can sign in, and so that nobody — including us — can read your password	For as long as your account exists. Replaced when you change it, deleted with the account.	Cloudflare KV, hashed. It is never emailed, never logged, and never leaves our Worker in readable form. See section 3.
The six-digit sign-in code we email you	To prove you own the address before we hand over an account	10 minutes, then it expires and is deleted automatically. It is also deleted the instant it is used, so a code works once.	Cloudflare KV; the code itself is emailed to you.
Your sign-in session token	To keep you signed in without retyping anything	180 days, then it expires by itself. Signing out ends it sooner.	Cloudflare KV, plus your own browser's localStorage.
Your username	To hold the name for you so that nobody else can take it	For as long as you hold it. Released when you change it or delete your account.	Cloudflare KV. Your username is public — it appears on the builds you publish.
A password-reset ticket, when you ask for one	To let you set a new password after we have checked your email	15 minutes, then it expires automatically.	Cloudflare KV.
If you turn on two-factor sign-in: the shared secret your authenticator app uses, one-way hashes of your eight backup codes, and when a code was last used	To check the six-digit code at sign-in	Until you turn two-factor off, which deletes it.	Cloudflare KV. The secret has to be readable to work; the backup codes are hashed and single-use.
Your IP address, stored only as a salted one-way hash — plus a hash of the surrounding network block (the /24 for IPv4, the /64 for IPv6)	Fraud prevention: stopping one person from farming free BuildBux across many accounts. See section 4.	30 days in the signup history. The decision it fed into is kept 180 days, so an appeal months later can be judged on what was actually seen.	Cloudflare KV. The signup check never writes your raw IP address into our storage — only the hash, which cannot be turned back into an address. The one exception is the owner's allowlist, two rows below.
Coarse location from Cloudflare: country, region, and the first three characters of your postal code. The decision record also holds the city, time zone, and the name of your internet provider's network.	The same fraud check. "Same town" is the question; "same street" is not, and we never ask. See section 4.	30 days in the signup history. 180 days in the decision record.	Cloudflare KV. We never ask your browser for GPS, and no street address is ever stored.
A device signal: a random identifier your browser stores, combined with your browser's user-agent string and hashed	The same fraud check — it makes a second account opened in the same browser visible. On its own it can never cost you your free credit; it is only ever a hint. If your browser does not hand us that identifier, we do not read your user-agent for this check either.	30 days. Clearing your browser storage clears the identifier on your side.	Cloudflare KV, hashed. It is not an advertising ID and it is not shared with anyone.
A shortened form of your email address (the part before the @, with the domain and the digits removed) and a shortened form of your name (lowercased, words sorted). These two are not hashed.	To notice that "bobsmith12" and "bobsmith2", or "Bob Smith" and "Bob J Smith", are one person opening a second account. The test that matters is similar, not identical, and similarity cannot be computed over hashes — a hash only ever answers yes or no. So these two are stored readable, which is precisely why they expire quickly.	30 days in the signup history, which is the copy the check actually reads. Both also sit inside the decision record in the next row for 180 days.	Cloudflare KV. The email form has the domain stripped off, so it is not an address and cannot be mailed.
A separate index of email-root sightings, filed under a salted hash of that root. The entries hold only hashes: which account, and which network it came from.	To notice the same email root turning up again from a different network weeks later — the one signal that survives someone switching to mobile data	90 days.	Cloudflare KV, hashed. The root itself is not stored in this index; it is only used to compute the key.
The anti-fraud decision itself. In full: the score, the band it landed in, the written reasons, the size of the grant, your username, the hashed signals above — and, stated plainly because it is the one readable thing in it, your email address in normalised form along with the shortened name and email-root forms.	So that if you appeal, a person can see what the check actually saw rather than trying to remember it. The readable address is what lets us match your appeal email to the right decision.	180 days, then it deletes itself.	Cloudflare KV. Read by the site owner when reviewing an appeal, and by nobody else.
A count of failed password attempts on your account, with the time of the first one	To stop someone guessing their way into your account. After 8 failures within 15 minutes, password sign-in on that account pauses for 15 minutes — the emailed code still works, so the real owner of the address is never locked out. The counter is keyed on the email, never on the IP, so one person mistyping cannot lock out a whole school.	1 day.	Cloudflare KV. It holds a number and a timestamp, never a password or an attempted password.
The owner's network allowlist, when he adds one: the IP address he typed, in readable form, plus a note and the date	To switch the fraud check off for a network we know is a school or a family — the fix for a whole class being flagged at once. It is set by hand, only ever by the site owner.	Until the owner removes it. It does not expire on its own.	Cloudflare KV. This is the only place a readable IP address is stored, it is an address the owner typed rather than one we harvested, and removing it deletes it.
A manual decision the owner made about one account: the band he set, a note, and the date, filed under the salted hash of your email	How an appeal is actually resolved — a person overriding the software, permanently, so the same wrong call cannot happen to you twice	Until the owner removes it. It does not expire on its own.	Cloudflare KV, filed under a hash. It contains no readable address.
A review-queue entry, only when a signup is not clean: your username, the band, and the score	So a human looks at borderline accounts instead of leaving every call to software	90 days.	Cloudflare KV. Seen only by the site owner.
If you appeal: what you wrote, your email, and any other contact you gave us. If an account is ever restricted: the reason, the date, and the recovery link	So a person can read the appeal and put things back	Appeal text 180 to 400 days; a block record 400 days.	Cloudflare KV. Read by the site owner only.
A marker recording that the one-time welcome grant has been claimed. It is filed under your email address in normalised form — lowercased, with any "+tag" removed, dots removed on providers that ignore them, and a few provider aliases folded together (hotmail and live become outlook). It is stored readable, not hashed.	So the same person cannot collect the one-per-person welcome grant again under a new spelling of the same address	Kept indefinitely, deliberately. Deleting it would hand the same person the welcome grant a second time, which is the exact thing it exists to prevent.	Cloudflare KV. It holds nothing except the fact that the grant was claimed, but the address itself is readable in the record, so we are not going to describe it as anonymous. It is never used to email you, and it is not linked to a live account once the account is deleted.
The idea text you type into the invention box	To generate your invention plan	Not kept as a separate record. It survives only inside the build it produced, which is kept for 60 days.	Our Cloudflare Worker, then an AI model provider that generates the plan.
A Bench Chat session: the messages you and the chat exchanged about one build, plus a copy of that build's parts, wiring and steps pinned to the session, and the meter (model seconds run, BuildBux charged)	So the chat remembers the conversation and can answer from your actual build rather than guessing, and so the meter you can see is the meter you are billed from	6 hours from your last message, then it deletes itself. Every new message pushes that out again, so an active session never expires mid-conversation.	Cloudflare KV. Your messages are sent to an AI model provider to generate each answer.
The builds you generate (plan, parts, 3D model)	So you can reopen, order, edit, or publish a build	60 days from when it was made. Builds you publish to the Market stay up until you or we take them down.	Cloudflare KV.
Your maker profile: which 3D printer you have, the filament on your shelf, your experience level, and tools you said you can borrow	So builds are sized to your printer and written for your skill, and you are asked once	For as long as your account exists.	Cloudflare KV, under your email.
The first 160 characters of the idea behind each build, next to your email and what that build cost us in tokens	So the owner can see which idea blew the AI budget	120 days.	Cloudflare KV. Read by the site owner only.
Order records: which build you ordered, your name, your email, and your shipping address	To send the parts list and instructions, and to answer questions about an order	120 days.	Cloudflare KV.
Subscription and payment records: which plan, the price paid, the date, and the card brand and last four digits	To credit the right BuildBux, run renewals, and answer billing questions	Purchase records 120 days. The subscription record itself is kept while the subscription runs and afterwards for as long as we may need it for billing disputes, chargebacks, and tax records.	Cloudflare KV, plus Square, our payment processor. Full card numbers go straight to Square and never reach us.
Which plan you tapped "Join the waitlist" on, with your name and email	So we can tell you when payments open and know which plan people want	120 days.	Cloudflare KV.
A BuildBux expiry record, written only when a monthly plan that does not roll over replaces your balance: your email address, the date, which plan and which payment it belonged to, the balance before, the amount that expired, and the balance after	Because the one thing on this site that takes something away from you should be the best-documented thing on it. If a replacement is ever wrong, this record is what lets us put the exact number back without asking you to prove what your balance was, and it is what lets the site owner check that the rule fired for the right reason. Section 2c of the Terms sets out when a balance is replaced and the five situations in which it is not.	400 days, which outlasts every card chargeback window, then it deletes itself. Nothing is written at all for accounts on Pro, Pro Builder +, or the free plan, because nothing expires on those.	Cloudflare KV. Read by the site owner when checking or reversing an expiry, and by nobody else. Never sold, never shared.
Your pay-as-you-go settings, only if you turn that feature on: whether it is on, whether auto top-up is on, the top-up amount and monthly ceiling you chose, a word-for-word copy of the consent text you agreed to and when you agreed to it, and a card reference — the brand, the last four digits, the expiry month and year, and Square's own customer and card identifiers	Because it is a standing authorisation to charge a card, and the record of what you were shown when you gave it is what settles any later question about whether you agreed. The card references let Square take the charge you authorised.	Kept while the authorisation exists and afterwards as a record of it. It does not expire on its own, because deleting an authorisation record is deleting the proof of what was agreed.	Cloudflare KV, filed under a salted hash of your email so the key listing is not a list of who has a card on file. Your card number and security code never reach us at all — they go straight to Square, which holds them under its own privacy policy.
Your pay-as-you-go ledger: for each build, the input and output token counts the AI provider reported, what that cost in BuildBux, what was actually taken from your balance, which stage and model produced it, and a row for every card charge, failed charge, opt-in and opt-out	So the meter you can read is the meter you are billed from, and so a disagreement about a charge is settled by looking at the actual numbers rather than by whose memory is better. You can ask for your own ledger at any time.	400 days, which outlasts every card chargeback window. Records of a charge, a failed charge, or an opt-in or opt-out are kept as a permanent record of money and consent.	Cloudflare KV, filed under the same salted hash.
The list of builds on your "My builds" shelf: for each one, its id, name, tagline, difficulty, part count, estimated parts cost, build time and category — not the build itself	So your builds are waiting for you on any device you sign in on, instead of only the browser you made them in	400 days. The builds it points at expire after 60, so an older entry simply stops resolving.	Cloudflare KV.
A copy of each email we send you, held briefly in the outbound queue: the address, the subject, and the message body	So a message that fails on the first attempt can be delivered rather than silently lost	14 days, then it deletes itself.	Cloudflare KV, plus the email provider that delivers the message.
Your email address, readable, on the do-not-email list, only if you unsubscribe	So we never email you again	Until you ask to be emailed again; it has no expiry on purpose.	Cloudflare KV.
If you email support: your address, the subject, and the text of the last dozen messages in the thread	So the assistant and the owner can see what was already said	60 days; a thread handed to a human is indexed for 90.	Cloudflare KV; the message text is also sent to an AI model (section 8).
Promo-code and referral records, holding hashed forms of the email, device, and IP involved	To stop one person redeeming the same offer over and over, and to pay a referral only once the money is real	Working records expire on their own, between 45 and 400 days depending on the record. The fact that a one-time reward was already claimed is kept for as long as the offer exists, because that is the whole point of it.	Cloudflare KV, hashed.
A daily count of visits	To know roughly how busy the site is	45 days.	Cloudflare KV. It is one number per day with nothing personal in it — not a profile, not a visitor list.
A one-way, shortened hash of your email address next to the day and the kind of thing you did (signed up, built, published, tapped buy)	So the weekly report can say "8 builds by 3 people" without a mailing list	120 days.	Cloudflare KV, hashed and truncated; it cannot be turned back into an address.
Your answer to one signup question ("Where did you hear about GADGET UP?"), plus how long the options were on screen before you chose; a marker under a salted hash of your email saying you were asked; and, only if you picked "somewhere else", up to 60 characters of free text with any email address or phone number stripped out	To learn which channel actually brings people here, and to never ask twice	Answers 400 days, the asked-marker 400 days, free text 120 days.	Cloudflare KV. The answer record holds no person at all.
Standard hosting logs (IP address, user agent, timestamps)	Our host keeps these to serve the site and block attacks	Cloudflare's own standard retention, which we do not set and cannot shorten.	Cloudflare, under their policies.

2b. Your Email Address

Plain English: we keep your email so your BuildBux balance works and so we can send the instructions you ordered. Reply "stop spam" and we stop emailing you.

Your email address is your login and the address your build instructions and parts lists are sent to. Email is sent from GadgetUpSupport@gmail.com through a third-party email provider that delivers the message on our behalf.

We never sell, rent, or share your email address, and we do not send advertising for other companies. To stop all email, reply to any message with "stop spam", click the unsubscribe link in any message, or use our unsubscribe page. Unsubscribing does not delete your account or your saved builds. Billing notices for a paid subscription — receipts, renewal and price-change notices, cancellation confirmations, and the notice we send on Starter and Starter + before a month's unused BuildBux are replaced — keep coming while that subscription is active, because the law requires several of them and because the rest are about your money; they stop when the subscription ends.

3. Your Password

Plain English: we never store your password. We store a scrambled version that cannot be unscrambled, so even we cannot read it.

When you set a password, we do not save it. We save a salted, iterated one-way hash of it: PBKDF2-HMAC-SHA-256, 100,000 iterations, producing a 256-bit key, with a unique 128-bit salt generated for your account alone. A one-way hash cannot be reversed — there is no setting, no admin screen, and no database query anywhere in GADGET UP that will show your password, to us or to anyone who steals a copy of our data. When you sign in, we hash what you typed and compare the two hashes.

Why 100,000 and not more, since we would rather tell you than round the number up. 100,000 is the ceiling our host allows: Cloudflare's Web Crypto implementation refuses a PBKDF2 request above 100,000 iterations outright. It is not a budget we chose to spend — asking for more does not cost more, it fails. The iteration count is stored with each password record rather than assumed, so if that ceiling is ever raised we can move to a higher count without locking anybody out. Iterations are one part of the protection; the per-account salt, which defeats precomputed rainbow tables, is the other.

Your password is never stored, logged, or emailed in plain text, and it is never sent to any third party.
We will never ask you for it — not by email, not in chat, not on the phone. Any message that does is fraud; forward it to us.
If you forget it, we cannot look it up and tell you, because we genuinely do not have it. We can only help you set a new one.
Reusing a password is still the real risk. Hashing protects the copy we hold. It cannot protect an account whose password you also use on a site that has been breached, so please do not reuse one here.
We ask for length, not symbols. The minimum is 10 characters. We do not force a capital, a number and a punctuation mark, because that rule reliably produces the same handful of passwords across a whole school; a long ordinary phrase is stronger and easier to remember.
You do not have to have one. You can sign in with a six-digit code we email you instead. The code lasts 10 minutes and works once.
Wrong guesses pause the password box, not your account. After 8 wrong passwords in 15 minutes, password sign-in on that account pauses for 15 minutes. The emailed code keeps working the whole time, so whoever can read your inbox is never locked out. That counter is kept against your email address and never against your IP address — otherwise one person mistyping in the library would lock out a whole school.

3b. Payments, and What We Never See

Plain English: your card lives at Square, not here. We get the brand, the last four digits, and a reference number. We never see the card number or the three digits on the back — not once, not anywhere.

Card details are collected and held by Square, our payment processor, under its own terms and privacy policy. Your card number and security code go straight to Square. They never reach this website, our Worker, our storage, or our source code. Nobody at GADGET UP can read your card number, for the same reason nobody here can read your password: we do not have it.

What we do hold, and only if you have a subscription or have switched on pay-as-you-go: the card brand, the last four digits, the expiry month and year (so we can warn you before a card expires), Square's own reference identifiers for you and for the saved card, and the record of what you agreed to when you authorised a charge. Those references let Square take a charge you have already authorised; they cannot be turned back into a card number and are worthless to anyone who steals them without also stealing our Square access token.

If you turn on pay-as-you-go (section 2h of the Terms), we additionally record how many AI tokens each of your builds used and what that cost, because that is what you are billed on and you are entitled to check it. Ask and we will send you your own ledger. If you turn on auto top-up, every single charge sends you an emailed receipt at the moment it happens, and you can switch the whole thing off in one click at any time.

We do not use your payment data for anything except taking payment, giving you the BuildBux you paid for, and answering billing questions. It is never used for advertising, never sold, and never shared with anyone but Square.

4. Fraud Prevention, Automated Decisions, and Your Appeal

Plain English: free BuildBux are worth real money to us, so a computer checks whether a new account is a real new person. It looks at your IP, roughly where that IP is, and your device. If it decides you are a repeat, you may get less free credit or none. A human will check it if you ask — and on a school network, where everyone shares one connection, asking is expected.

What this is for. Every free build costs us a real payment to an AI provider. One person with six email addresses collecting the welcome grant six times is not a rounding error at our size, so before we grant free credit we check whether the account is likely to be a new person rather than the same person again.

What the check looks at. Your registration details (full name, username, and email address), your IP address and the network block around it, the coarse location Cloudflare derives from that address, a device signal made from a random identifier in your browser plus your browser's user-agent string, and how many accounts have recently been opened from the same network. The IP address, the network block, the device signal, and your identity are converted to salted one-way hashes before they are stored. Three things are stored readable, deliberately, and they are all in the table above: a shortened form of your name and a shortened form of your email root, because the question is whether two accounts are similar and a hash can only answer whether they are identical; and, inside the 180-day decision record only, your email address in normalised form, so that when you email us an appeal we can find the decision it is about.

What it does not look at. Not your password, not your builds, not what you type into the idea box, not anything you have published, and not your payment details. The check runs once, at signup, and never again on a normal sign-in.

Right now the check scores and flags, and pays everybody in full anyway. We would rather tell you that than let you read the next paragraph and believe your grant was at risk when it is not. Acting on the score is a switch the site owner has deliberately left off: today every signup receives the full welcome grant of 5 BuildBux whatever it scores, and the only thing a low score does is put the account on a list for a human to look at. The paragraph below describes what the bands would do if that switch is ever turned on, which would happen only if the flag list starts showing real account farms.

What the check can do, if acting on the score is switched on. Each signup gets a score, and the score falls into one of four bands:

Clean — the full welcome grant of 5 BuildBux, and nothing is flagged.
Watch — the full 5 is still paid, but the account is put on a list for the owner to look at. Shared networks land here on purpose: a whole class signing up at once cannot score past this band, because IP, network, provider, coarse location and device are capped below the level that can cost anyone credit unless a name or an email root also matches.
Limited — a reduced welcome grant of 2 BuildBux instead of 5. The account works normally in every other way.
Denied — a reduced welcome grant of 2 BuildBux, the same as Limited, plus a flag for the owner. Nobody is ever granted zero, not even in the worst band: a build costs 5 BuildBux, an account holding nothing cannot do anything at all, and turning a real fifteen-year-old away at the door to stop a farmer who has not turned up yet is a bad trade. You can build with credit you earn, the monthly free top-up, or a plan, on top of that 2.

The check can never close or block your account, whatever it scores. The most it is allowed to do is shrink or hold back free credit, and you are told which happened and how to appeal in the same breath.

The check can also refuse a referral reward or a promo code, and an account we believe is a duplicate can be closed. This decision is made automatically and no person necessarily reviews it before it takes effect. We are telling you plainly because it is a decision made about you, by software, using your personal data.

What the check can never do. It cannot touch anything you paid for. It does not cancel a subscription, does not stop a paid plan's monthly BuildBux, does not remove BuildBux already delivered for a month you paid for, and does not take back builds you already ordered. Section 2e of the Terms says the same thing in contract language.

Coarse location, precisely. What the check compares is your country, your region or state, and the first three characters of your postal code — enough to ask "same town", nowhere near enough to ask "same street". The 180-day decision record additionally holds the city, the time zone, and the name and number of your internet provider's network, so the owner reading an appeal can see whether two accounts really were on one school connection. All of it is Cloudflare's estimate from your IP address: it is not GPS, it is not a street address, and it is frequently just the nearest large city or wherever your provider routes traffic. We never ask your browser for its location — there is no location permission prompt anywhere on this site — and we do not track where you go.

Your appeal, to an actual human. These checks get it wrong, and there is one situation where they get it wrong constantly: a school or a family shares one internet connection, so a whole class can look like one person making many accounts. That is normal, it is not fraud, and it is exactly what appeals are for.

Email GadgetUpSupport@gmail.com with the word APPEAL and your username, from the address on your account. A person — not a filter — reads it, replies to you, and puts the credit back where the check got it wrong. The decision record is kept for 180 days precisely so that a late appeal can be judged on the evidence rather than on somebody's memory. Appealing is free, there is no limit on how often you may do it, and appealing never counts against your account. You may also ask what the decision was based on, and we will tell you in plain language.

5. What We Do NOT Collect

No cookies for tracking, no analytics trackers, no ad pixels, no Meta Pixel
No sale or sharing of personal data with data brokers or advertisers — ever
No card number, no security code (CVV), and no bank details — payments are handled by Square. The only card-related things that ever reach us are the brand, the last four digits, the expiry month and year, and Square's own reference identifiers for the customer and the saved card. Those references are useless to anyone who steals them without also stealing our Square access token, and none of them can be turned back into a card number
No precise or GPS location, no contacts, no microphone, no camera, no browsing history from other sites
No readable password, at any point, anywhere (section 3)
No selling or profiling of anyone under 18 for advertising

6. Where Your Inventions Live

Saved inventions are stored in YOUR browser's localStorage on YOUR device. We never see them and cannot recover them. Clearing your browser data deletes them. Builds you generate through your account are also kept server-side for 60 days so you can reopen and order them, and builds you publish to the Market are public until they come down.

7. Do Not Share Sensitive Information

Plain English: the idea box is for invention ideas, nothing else.

Never type passwords, Social Security numbers, financial details, medical information, or other sensitive personal data into the idea box or the build chat. Anything you submit there is processed by an AI system — keep it about gadgets.

8. Who Else Sees Any Of This

Nobody buys it, and nobody receives it for their own purposes. The only companies that touch your data are the ones that run the Service for us, and only to do that job:

Cloudflare. Hosting, Workers, and the KV store where account records live.
AI model providers. They receive your idea text and your Bench Chat messages in order to generate plans and answers. Named, because you should know whose machine is reading what you typed: Anthropic, which runs Claude Opus 5, the engine behind paid builds; NVIDIA, whose NIM service runs NVIDIA's own Nemotron 3 Ultra and Moonshot AI's Kimi K3, the free tier's engines, which also race alongside Opus on paid builds and run the design review that checks every build; OpenRouter, through which we reach the same Nemotron model a second time as a backup; and TokenRouter, an API gateway we use to reach Kimi K3 for Bench Chat on free accounts, the setup questions before a build, firmware writing when Opus is off, and the support assistant. For builds and Bench Chat we send them your idea text and chat messages and nothing else: not your name, not your email address, not your password, and not your payment details. The one exception is support email. When you write to GadgetUpSupport@gmail.com, an automated assistant called Builder drafts the first reply, and to do that it is shown your email's text plus your plan, your BuildBux balance, the names of your recent builds and your orders. Every reply it writes says at the top and bottom that a machine wrote it, and a person takes over the moment money, safety, or anything unclear comes up. We may change providers as better models ship, and this list is updated when we do.
Our email providers. Brevo or Resend deliver most messages; when neither is available, mail is queued and sent from our Gmail account (Google). Each receives your email address and the message, in order to deliver it.
Telegram. It delivers the site owner's alerts to his phone. An alert can include your email address and username (a flagged signup or an appeal), your name and email (a kit reservation), the buyer's email on a sale, and, at most once every 15 minutes, the page a visitor landed on, the site they came from and their country. Telegram holds those messages under its own privacy policy; we do not store them beyond what the table above says.
Square. The payment processor, for subscriptions and for pay-as-you-go top-ups. It collects and holds your card details under its own privacy policy; we never see them.
Google Fonts and jsDelivr. Google Fonts serves the site's typefaces and jsDelivr serves the 3D viewer's code library. Like any font or script host, each sees your IP address and browser when the file loads.

Parts links point to third-party retailers such as Amazon. When our Amazon Associates tag is switched on, the link tells Amazon the click came from GADGET UP so we can earn a commission; it carries nothing about you, and it is not a sale or sharing of your personal information under the CCPA. Their sites have their own privacy policies. We may also disclose data if the law actually requires it, or to protect someone's safety.

9. Your Privacy Rights and Data Labels (California CCPA/CPRA, and everyone else)

Plain English: here is the label. What we collect, why, who gets it, and how to make us delete it. We do not sell your data and we never will.

Categories of personal information we collect, in the language California uses:

Identifiers — your name, username, email address, IP address (stored hashed), and the device signal.
Account credentials — your password, stored only as a one-way hash.
Commercial information — which plan you bought, order records, BuildBux balance and ledger, BuildBux expiry records, and, if you use pay-as-you-go, your card references (brand, last four, expiry, and Square's identifiers), your spending settings, and your billing ledger.
Internet or network activity — the builds you generated, the AI token counts each build used, standard hosting logs, a daily visit count, usage events (hashed), your survey answer, and support threads.
Records of consent — a copy of the agreement text you were shown and the moment you accepted it, for the Terms, for auto-renewal at checkout, and for pay-as-you-go and auto top-up.
Coarse geolocation — country, region, and city estimated from your IP address. We do not collect precise geolocation.
User content — the idea text you type, the messages you send in Bench Chat, what you type into the setup conversation and into a support email, and anything you publish to the Market.

Why we collect each one: to run your account, to generate and deliver what you asked for, to take and manage payment, to prevent fraud and abuse of free credit, and to keep the site up. Nothing is collected for advertising, and we do not build profiles about you.

Sold or shared? No. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. We have never done so, including in the past twelve months. We do not use or disclose sensitive personal information for any purpose beyond running the Service.

Who receives it: nobody except the service providers named in section 8, and only so they can perform their function for us.

Your rights. Wherever you live, you may ask us to: tell you what we hold about you and give you a copy; correct anything wrong; delete your account and the personal data attached to it; opt out of all email; and — because some decisions here are automated — have a human review a decision that reduced or withheld your free credit (section 4).

How to exercise them. Email GadgetUpSupport@gmail.com from the address on your account, or from another address with enough detail for us to be sure it is you. Say what you want: a copy, a correction, deletion, or an appeal. We aim to reply within a few days and will always respond within 45 days. There is no charge, and using any of these rights never costs you anything, never degrades your account, and never changes what you pay. An authorised agent may act for you if you confirm it in writing.

What deletion actually deletes. Deleting your account removes your name, username, email address, password hash, BuildBux balance and ledger, and your saved build records. A few things do not vanish at that moment, and you should know about every one of them:

Records we have to keep for tax, billing, and chargeback purposes, if you ever paid us.
Your pay-as-you-go authorisation record and billing ledger, if you ever turned that feature on. It is the proof of what you agreed to and what was charged, so it is kept for as long as a charge could still be disputed. It holds card references, never a card number. Ask us and we will delete it once no charge on the account can still be disputed.
The marker recording that the welcome grant was already claimed. This one is kept indefinitely, because deleting it would let the same person claim the grant again — which is the entire thing it exists to prevent. It is filed under your email address in normalised form, so unlike the rest of the anti-fraud data it is readable rather than hashed. It holds no other information about you, it is never used to contact you, and after deletion it is not attached to any live account.
The anti-fraud records described in section 4, which are not deleted on request but expire by themselves on the schedule in the table above — 30 days for the signup history, 90 for the email-root index and the review queue, 180 for the decision record. They are kept for that window so that an appeal, including yours, can still be judged fairly, and they are hashed or shortened rather than held as your actual details. The single exception is the decision record, which holds your normalised email address readable so an appeal can be matched to it; it deletes itself after 180 days like the rest.
A manual allowlist or override the site owner set by hand, if one applies to you or to your network. These have no expiry because they exist to stop a wrong call repeating, but the owner removes them on request.

Unused BuildBux end when the account does, because the balance is a field on the account record and deleting the record deletes it. That is the only routine deletion of a balance there is: cancelling a subscription does not empty your BuildBux, and neither does a plan lapsing — see section 2c of the Terms. If you want the credit and not the account, spend it before you ask us to delete, because we cannot get it back afterwards and we cannot pay it out in any other form.

10. Children — Under 13 Not Permitted

GADGET UP is for people aged 13 and over. The Service is not directed to children under 13, we do not permit them to create accounts, and we do not knowingly collect personal information from them. This matches the age requirement in section 10 of the Terms.

If we learn that an account belongs to someone under 13, we delete the account and the personal information attached to it. If you are a parent or guardian and believe a child under 13 has given us personal information, email GadgetUpSupport@gmail.com and we will delete it. If you are between 13 and 18, you need a parent or guardian's permission to use the Service, and builds need adult supervision.

11. Changes

We may update this policy; the date at the top reflects the latest version. Material changes — including any change to what we collect, why, or how long we keep it — will be posted on this page.

12. Contact

Privacy questions, copies of your data, corrections, deletion, and appeals against an automated decision: GadgetUpSupport@gmail.com