Privacy Policy.

activebuilders.dev is the home of the Active Builders community. You create your member account here; the one-time membership payment is processed by Creem, our merchant of record, and the community itself lives in a private Discord server.

Your account. Your name, email address, a securely hashed password (we never see or store the plain text), when you signed up, your membership date, and, if you connect it, your Discord user id. If you sign in with Google we also receive and store your Google profile picture URL. All of this lives in our own database on our own server.

Sign-in records. Each active session stores your IP address and browser user-agent string. We use these to keep you signed in and to investigate abuse or suspicious logins. Sessions expire after 7 days.

Connected accounts. If you sign in with Google or connect Discord, we store the access tokens those services issue us, so we can add you to the Discord server and, if you ask, fetch your Discord profile picture.

Your profile. If you fill one in: your bio, your website, your social profile links, and your uploaded photo. See section 06 for what becomes public.

Emails we send you. We keep a copy of every email we send to you, including its contents, so we can confirm what was sent and debug delivery problems. Password reset and verification links are stripped out of that copy before it is stored. Only site admins can read this log.

If you email us, we receive whatever you put in that email.

A session cookie keeps you signed in. It is httpOnly, restricted to this site, and lasts 7 days. A second cookie remembers your light or dark theme preference for a year. Both are set by us, and there are no advertising or tracking cookies on this site.

For traffic stats we use Umami, which we host ourselves on our own server, so those numbers are not shared with an analytics company. It sets no cookies and records aggregate page views, referrers, rough country, and device or browser type. It does not track you across sites or build a profile of you.

Pages load fonts from Adobe Fonts (Typekit) and icons from Font Awesome via their CDNs. Your browser requests those files directly, so those providers may receive your IP address and request details under their own privacy policies.

We use Sentry to catch application errors. It is configured not to send personal data: error reports carry stack traces and technical context, not your IP address or the contents of your requests.

If you ask us to pull in your Gravatar, we send a one-way hash of your email address to Gravatar (Automattic) to look it up. This happens from our server, not your browser, and only for the profile photo feature. If you never use it, nothing is sent.

Membership and sponsorship checkouts run on Creem, our merchant of record. Creem collects your billing details and processes the payment; we receive your email and order details (so we can unlock your membership) but never your card number.

If you connect your Discord account, we receive your Discord user id and use it to add you to the private server. We deliberately do not request your Discord email address. We keep the access token Discord issues so we can fetch your profile picture if you ask for it. Anything you share in Discord or on X is governed by those platforms. Please review the privacy policies of Creem, Discord, and X for how each handles your data.

We use these details to run the community, fulfill sponsorships, reply to you, and send the occasional important update. We do not sell your information.

A selection of member names and photos is public on our home page. You are not listed unless you turn it on yourself: the setting is off by default and lives under Your profile in the members area.

When you turn it on, your name and photo become visible to anyone, including search engines, and are published in a machine-readable format that search engines and crawlers can index. Your email address is never shown. Turning the setting off removes you immediately, though search engines may take time to drop what they already cached.

The first time you save a profile without a photo, we try once to find one from your connected Discord account, then from Gravatar. You can replace or remove that photo at any time. Photo files themselves are served from an unguessable URL and are not otherwise access-controlled, so treat anything you upload as public.

We keep your account data for as long as your account exists. Sign-in sessions expire after 7 days. We do not have a fixed deletion schedule beyond that, because a lifetime membership is meant to outlast one.

You can change your name, email, password, and profile yourself from the members area. To get a copy of your data, or to have it deleted, email support@activebuilders.dev and we will take care of it. We aim to action deletion requests within 30 days.

Deleting your account removes your account record, your sign-in sessions and their IP addresses, your connected-account tokens, your profile, and your uploaded photo. Two things survive on purpose: our payment records at Creem, which we are required to keep for tax and accounting, and a stripped-down line in our email log recording that a message of a given type was sent on a given date, with the contents removed and your address replaced by a keyed fingerprint, so we do not accidentally email you again. That fingerprint cannot be turned back into your address without our server key. Content you posted in Discord or on X is managed on those platforms.

Active Builders is not directed to anyone under 16. If you believe a child has provided personal data, contact us and we will help get it removed from the relevant platform.

We will update this page when our practices change. The date at the top reflects the latest version.

Questions about privacy go to support@activebuilders.dev.