Privacy policy

1. Anonymous sticky notes & voting (Default)

Pinning an automation idea and voting on the board are anonymous by default. To prevent duplicate votes and automated spam without requiring an account:

• I set one strictly necessary, cryptographic HttpOnly cookie (sb_vid) containing a random UUID signed with HMAC-SHA256 (retained for up to 12 months) so your browser remembers which notes you upvoted.
• I use short-lived rate-limit counters scoped to normalized IP prefixes (expired automatically within 15 minutes) to block bot floods.
• When you cast a vote, the request includes basic browser environment signals (hwSignals: screen dimensions, time zone, and CPU core count) used strictly for short-lived anti-bot fraud detection. These signals are never stored as a personal profile or used for cross-site tracking.
• When you pin an idea with Show my country checked, I store only your 2-letter ISO country code (derived from the edge request header x-vercel-ip-country or cf-ipcountry, never your IP address) to display a small flag next to your idea. You can uncheck this box before posting.
• I record aggregate, cookie-free interaction counts (pageview, vote, pin, share, copy_note, video_play, and try_glow_click) without advertising trackers or profiling cookies.
• When you use the Report a bug dialog in the footer, reports are anonymous by default. Basic device context (OS, browser name, and window size, e.g. macOS · Chrome · 1440×900), a screenshot, or your email address (to notify you when the fix is deployed) are only included if you explicitly toggle or enter them before sending.

2. Optional email notifications (Double Opt-In via Resend)

If you choose to enter your email address when pinning a note or after voting on an automation idea:

• Double opt-in (GDPR Art. 6(1)(a)): I send a single confirmation email from “Seb from sebbuild” <updates@mail.sebbuild.com> (with replies routed to seb@sebbuild.com) containing a cryptographically signed link (valid for 48 hours). Your address is never added to the subscriber list unless you click that confirmation link.
• What emails you receive: Once confirmed, you only receive emails you asked for: a Friday notification if a sticky note you pinned wins the weekly vote, a notification when an idea you pinned or voted for goes live on YouTube, and the Friday build release. Repeat votes or pins with an already-confirmed address are linked automatically without sending another confirmation email.
• What is stored in Resend: Your confirmed email address and signup source (vote, pin, or copy_note) are stored in Resend (our email delivery processor), not in the public board payload. Open and click tracking pixels are disabled.
• One-click unsubscribe: Every Friday build broadcast includes a 1-click unsubscribe link and RFC 8058 List-Unsubscribe header so you can opt out instantly at any time.
• Data processors: The board is hosted on Vercel Inc. and email broadcasts are delivered via Resend Inc. I never sell, rent, or share your email address with third parties.

3. YouTube embeds

Walkthrough videos load static poster images first and only connect to youtube-nocookie.com (privacy-enhanced mode) after you explicitly click Play.

4. Your GDPR rights & contact email

You can request access to, correction of, or immediate deletion of your email address, country flag, or any sticky note and vote data you submitted by emailing privacy@sebbuild.com (or general questions at hello@sebbuild.com).