We collect as little as we can: what your account, your projects and your export quota need to work. There are no ads, no analytics trackers and no third-party cookies on this website or in the app.

Who is responsible

The controller of your personal data is to be confirmed before launch, to be confirmed before launch. For anything related to privacy, write to to be confirmed before launch.

What we collect

Data	Where it comes from	What for
Email address	You, when you create your account	Signing in, account emails (confirmation, password reset), contacting you about your account
Password	You	Signing in. It is stored only as a salted hash by our authentication provider; we never see it
Display name and language	You, in your profile	Greeting you and choosing the language of the app and our emails
Tier and invite redemptions	The codes you redeem	Unlocking your tier; a record of which code upgraded your account and when
Projects	You, while you design	Saving your designs: name, workflow, parameters (including artwork you upload), a thumbnail, and when they were created and changed
Export records	The app, each time you export	Counting your monthly quota: date, workflow, format and number of pieces
Failed invite-code attempts	Automatically	Stopping code guessing: the failed attempt, its reason and time, and the network it came from (an IP address or its network prefix)
Technical data	Your browser, automatically	Delivering the website and app and keeping them secure: IP address, browser type and request logs, processed by our hosting and authentication providers

What stays on your device. Print files are generated in your browser and downloaded directly — we don’t receive them. SVG files you upload are processed in your browser too; only the cleaned-up artwork is saved as part of the project.

Legal bases

Contract — to provide the account, projects, exports and license you signed up for.
Legitimate interests — to keep the service secure, prevent abuse such as code guessing, and fix problems.
Legal obligations — where the law requires us to keep or disclose information.

Who helps us

We use a small number of service providers (“processors”) who handle data only on our instructions:

Supabase — authentication and database: your account, profile, projects, invite redemptions and export records. Database region: to be confirmed before launch.
Cloudflare — hosting and delivery of this website and the app, including protection against attacks. It processes technical data such as IP addresses to serve pages.
Email delivery — account emails are sent through to be confirmed before launch.

Where a provider processes data outside the European Economic Area, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses. We never sell your data.

Cookies and browser storage

We use only what is needed for the site and app to work and to remember your choices. Nothing is used for advertising or tracking.

Name	Type	Where	What it does	Kept for
`pm_locale`	Cookie	Website and app	Remembers your language; set only when you choose one	1 year
`pm_theme`	Cookie	Website and app	Remembers light or dark theme; set only when you choose one	1 year
`pm_theme`	Local storage	Website and app	Remembers light or dark theme	Until you clear it
`pm_locale`	Local storage	App	Remembers your language in the app	Until you clear it
`pm_sidebar`	Local storage	App	Remembers whether the sidebar is collapsed	Until you clear it
`pm_editor_…`, `pm_section:…`, `pm_export_format`, `pm_accessory_…`	Local storage	App	Remembers editor and accessory preferences: open tabs and panels, expanded sections and advanced settings, your last export format, pegboard type, board thickness and colour	Until you clear it
`pm_export_pending`	Session storage	App	Lets you retry an interrupted download without counting a second export	Until you close the tab
`sb-…-auth-token`	Local storage	App	Keeps you signed in (your session)	Until you sign out
`pegboard-maker`	IndexedDB	App	Local drafts of your projects, to recover unsaved changes	Until the project is saved or you clear it

Because all of these are strictly necessary or store preferences you set yourself, we don’t show a cookie banner.

How long we keep data

Account, profile and projects — for as long as your account exists. Deleted projects are removed right away.
Export records and invite redemptions — for as long as your account exists, because they determine your quota and document your tier and license.
Failed invite-code attempts — 30 days, then deleted automatically.
Provider logs — according to the providers’ own retention, typically days to weeks.

When you ask us to delete your account, we delete your profile, projects, export records and invite redemptions.

Your rights

You can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw any consent you gave. You can download all your projects yourself at any time (Account → Your data). To exercise any right, write to to be confirmed before launch. You also have the right to complain to your data protection authority.

Children

Pegboard Maker is not directed at children. If you believe a child has created an account without permission, contact us and we will delete it.

Changes

If we change this policy in a way that matters, we’ll tell you in the app or by email before the change applies. The date at the top shows the latest version.