Privacy Policy

1What we collect, and when

Nothing that identifies you, if you only read. Browsing this site sets no cookies. We do count visits, using Plausible: it records the page, the referrer, the country, and the browser and device type, all of it aggregated, and it stores no cookie, no device identifier and no IP address. There is no profile of you because there is nothing to attach one to, and nothing here follows you to another site. Our host also records standard server logs — IP address, page requested, timestamp, user agent — for security and troubleshooting.

When you buy a licence, Paddle collects your name, email address, billing address, VAT number where applicable, and payment details. Paddle is the seller of record: it takes the payment and handles the tax, and we never see your card details. From Paddle we receive the transaction record and your email address.

Your GitHub username and account ID, which GitHub gives us when you sign in with it at checkout. We ask GitHub for no permissions — not your private email, not your repositories, no access to act on your account — so it shows us only your public profile. We keep your username and account ID and discard the rest, including any email your profile makes public, and we ask GitHub to revoke the sign-in token as soon as we have read them. We use them for one purpose: to invite that account to the private webrot9/thefabrica repository, and to be sure it is your own. Without them we cannot deliver what you paid for.

2Why we are allowed to hold it

Your email and GitHub username are processed to perform the contract — you bought a licence and we have to deliver it (GDPR Art. 6(1)(b)). Transaction records are kept because tax law requires it (Art. 6(1)(c)). Server logs rest on our legitimate interest in keeping the site up and unabused (Art. 6(1)(f)).

We do not process your data for marketing, and we do not profile you or make automated decisions about you.

3Who else sees it

Four companies, each doing one job:

• Paddle.com Market Ltd (United Kingdom) — merchant of record. Takes the payment, handles VAT, and holds the billing data. Paddle is a controller in its own right for that data; its own privacy notice governs it. It also keeps, with the transaction, the GitHub username and account ID you signed in with: that is how the sale records whose access it bought.
• GitHub, Inc. (United States) — signs you in at checkout and hosts the repository. Tells us the username you sign in with, and receives it back from us with the invitation.
• Vercel Inc. (United States) — hosts this site and keeps the server logs described above.
• Plausible Insights OÜ (Estonia) — counts visits. Runs on servers in Germany, sets no cookies, and receives no personal data: what reaches it is an aggregate count, not a record about a person.

Nobody else. We do not sell data, and we do not share it for advertising.

4Data leaving the EU

GitHub and Vercel are United States companies, so hosting this site and delivering your licence involves a transfer outside the EEA. Those transfers rely on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where the recipient is certified under it. You can ask us for a copy of the safeguards in place.

Our analytics are not part of that. Plausible is an Estonian company running on German servers, so counting your visit involves no transfer out of the EEA at all — which is the reason we chose it over the American alternatives.

5How long we keep it

Transaction records: ten years, because Italian tax law requires it. Your GitHub username and account ID: with the transaction record, so for as long as it; and on the repository, for as long as your licence is active, since that is the record of who has access. Server logs: a short rolling window set by our host, typically days rather than months.

6Your rights

You can ask us for a copy of your data, to correct it, to delete it, to receive it in a portable format, or to object to processing based on legitimate interest. Write to the address above and we will answer within one month.

One honest limit: deleting your GitHub username also removes your repository access, because the two are the same fact. Ask and we will say so before acting. Records we are legally required to keep for tax purposes cannot be deleted on request.

If you think we have handled your data badly you can complain to your national supervisory authority — in Italy, the Garante per la protezione dei dati personali.

7Cookies

Reading this site sets none of its own, which is why you have not seen a consent banner. Analytics are the usual reason a site needs one, and ours do not: Plausible stores nothing on your device and keeps no identifier, so there is no consent to ask for.

Signing in with GitHub to buy sets two of our own, both strictly necessary for the purchase you asked for, which is why they need no consent: fabrica_oauth_state, for ten minutes, so that the reply from GitHub can only finish the sign-in you started; and fabrica_buyer, for an hour, which remembers the GitHub username and account ID you signed in as until you pay. Neither tracks you, and nobody but us reads them.

Opening the Paddle checkout loads Paddle's script, which sets cookies necessary to process your payment and prevent fraud; that happens only on the pricing page, and only there. If we ever add anything that does store an identifier on your device, this section and a consent banner arrive together.

8Changes

If this policy changes in a way that affects you, we will email licence holders rather than quietly updating the date at the top.