Privacy Notice

1. Who is responsible

Morad ICHCHOU is responsible for personal data used by Meet to Make. This notice covers accounts, collaboration features, support, safety, optional email updates and optional analytics. For any privacy request, write to [email protected]. Meet to Make is for people aged 18 or older.

2. Sign-in with Google or Twitch

Meet to Make uses Google sign-in to let adult creators create an account and return to their collaboration workspace. When you select Continue with Google, Google authenticates you and sends basic identity information to Meet to Make through its OAuth and OpenID Connect services. Ordinary Google sign-in requests only the openid, email and profile permissions. The following table explains the Google user data we access and why.

These permissions do not give Meet to Make access to your Gmail messages, Google Drive files, Google Calendar events, contacts or YouTube account. Meet to Make does not request those permissions or perform actions in those Google services. The calendar inside Meet to Make uses availability and proposals that you enter in the application; it does not read or synchronise your Google Calendar. We do not receive your Google password.

Storage and protection of Google data: the application on Railway in Amsterdam processes the sign-in response, and the account records described above are stored in our Supabase project in Frankfurt. We use HTTPS connections, encrypted application-session cookies, server-only credentials and database access rules to protect private identity and contact records. Access to those private records is restricted to authorised account, support, security and legal operations. Authentication tokens are processed only to complete sign-in. We do not retain Google access tokens or refresh tokens in the application database or your Meet to Make session. Our application logs exclude provider identifiers, email addresses and tokens. Section 5 explains provider roles and international transfers.

Sharing of Google data: Railway and Supabase process the data needed to host the application and store your account. Cloudflare provides site security and can process network information for requests passing through its service. Your profile display name and selected avatar are shown to members as described above. Private Google identifiers and contact emails are not shared with community partners or other members. The operator may access relevant private records to handle a support request, investigate abuse or security problems, or comply with a valid legal obligation; a disclosure to an authority is limited to what that obligation requires. If you write to our contact addresses, Cloudflare forwards the correspondence to the operator's Gmail inbox as described in section 5. This mailbox use is separate from Google sign-in and does not give us access to your Gmail account. If you choose optional launch and product emails, Resend also processes the verified contact address, subscription status, email content and delivery metadata for that purpose. We do not send Google account identifiers, names, avatars or provider tokens to Resend.

Limits on use of Google data: we use the Google sign-in information described above to provide your account and the visible profile and collaboration features you request, and to protect the service. We do not sell Google user data or use or transfer it for advertising, data brokerage, credit decisions or training general-purpose AI or machine-learning models. We do not send Google account identifiers, names, email addresses, profile-picture URLs or provider tokens to PostHog. Optional product analytics uses a separate internal Meet to Make profile ID and the limited events described in section 3, only after your analytics consent. Meet to Make's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the applicable Limited Use requirements.

Retention and deletion of Google data: we keep the private Google identity and contact records for the life of your Meet to Make account, subject to the specific retention rules in section 6. An unlinked Google identifier remains reserved to the same account to prevent reassignment until account deletion. Deleting your account through Account Settings removes its Google identity records, contact records and profile, and removes a managed avatar where one exists. Separately held support or security evidence can remain only for the limited purposes and periods described in section 6. Backups expire through the providers' rolling cycles, and deletions are reapplied before restored data returns to use. For a deletion request without signing in, write to [email protected]; we verify your identity proportionately and normally respond within one month. Deleting Meet to Make does not delete your Google account or the original Google profile picture.

Your sign-in choices: Google and Twitch are alternative sign-in providers. Twitch supplies the equivalent basic account identifier, display name, profile-picture URL and email verification information where available; its sign-in does not allow us to post to your account. When account linking is enabled, explicit Google linking or unlinking checks request openid and profile without email access; the equivalent Twitch identity-management checks omit email access too. You may unlink a provider in Account Settings while another remains connected. You can also revoke Meet to Make's Google access in your Google Account connections settings. Revocation stops future use of that authorisation, but does not itself delete the data already stored in Meet to Make or close all existing application sessions. Sign out to close your current session and use Account Settings or the privacy contact to delete the account. We notify you of material changes to Google data use and obtain any new authorisation required before using additional data or permissions.

3. What we use and why

Required fields are needed for the account or feature concerned. Without them, that feature may be unavailable. Optional profile fields and communication choices can be left blank. Refusing analytics or referral cookies does not reduce your access. Recording that the Privacy Notice was shown is separate from cookie consent. Launch and occasional product emails are optional and off by default. You choose them after sign-in or in Account Settings. Refusing or withdrawing this choice does not affect your account or access. Every update includes an unsubscribe link that works without signing in. We also show the current subscription in Account Settings; reading it never resubscribes you. Email open and click tracking are disabled.

4. Who can see the data

• Profiles and shared forum or event content are visible to the signed-in audience allowed by each feature. Avatar images use public image URLs, so someone with an image URL can view or copy the image.
• Private messages and proposals are available to their participants. The operator may access relevant information when necessary for support, a safety or security investigation, or a valid legal request.
• Contact emails, access applications, reports and privacy requests are not public. They are available only to people authorised to handle them and the providers needed to run the service.
• Other participants receive content you choose to share. Infrastructure and analytics providers receive the data needed for their stated role.

Avoid sharing unnecessary sensitive information, identity documents or personal data about someone else. If content exposes private information, contact [email protected] with the relevant reference.

5. Providers and international transfers

A European server location does not exclude support access or processing outside the European Economic Area. Our hosting, security and analytics providers' data-processing agreements include the European Commission's standard contractual clauses for transfers where required. Contact emails go to an ordinary Gmail inbox under Google's consumer terms and privacy notice. Google and Twitch are responsible for their own account and service processing. Google's transfer framework describes its use of standard contractual clauses and recognised adequacy decisions. You can read the linked documents or ask [email protected] for information or a copy of the safeguards applying to your data. Resend's data-processing agreement incorporates standard contractual clauses and describes primary processing in the United States; selecting Ireland for sending is not an EU-only storage guarantee.

6. How long we keep data

• Account, profile, contact, identity and ordinary product data: while your account and the relevant feature remain in use. After 24 months of inactivity, the account is reviewed and you are warned before any deletion.
• Account deletion removes your profile, identity records, referral attribution and content linked to it. It can also remove shared posts or events you created. Conversations and content belonging to other participants may remain for them.
• Closed moderation reports, illegal-content notices and reviews: normally up to 24 months after closure, unless an investigation, binding order or specific legal claim requires longer. Some account-linked records disappear sooner when the account is deleted.
• Support and privacy correspondence: while needed to handle the request. A minimal record of a completed request or legal matter may be kept for up to five years where necessary to demonstrate compliance or handle a claim. Temporary identity evidence is deleted after verification.
• Identifiable PostHog analytics and technical error events: no more than 12 months. Withdrawal stops product analytics and queues known identifiers for deletion without undue delay. Irreversibly anonymous statistics may remain.
• Security and infrastructure logs: for the log-history period supplied by the provider and only as needed to investigate faults or abuse. Selected incident evidence may be kept separately while that case or a legal requirement continues; it is deleted when the reason ends.
• Browser cookie choices: six calendar months. The optional referral cookie lasts up to 30 days; the Cookies section gives each storage duration.
• Backups are overwritten through the providers' rolling backup cycles. Deleted data is kept out of ordinary use; if a backup is restored, deletions are reapplied before the data is used.
• Optional email preferences: the latest choice, statement version and change date remain with your account. Resend processes your contact address and subscription preference to send these emails and honour withdrawals; unsubscribing stops further emails. When you delete your account, we also request removal of your Resend contact. If a technical problem prevents this, your account is still deleted and we follow up separately to remove the remaining contact. Delivery logs and abuse-prevention records expire under the provider's applicable retention rules.

An exception for an investigation, legal claim or binding order concerns only the records needed for that matter. Access is restricted and the records are deleted when the reason ends. Deleting Meet to Make does not delete your Google or Twitch account.

7. Your choices and rights

Depending on the use of your data, you can request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You can change or withdraw analytics and referral-cookie consent at any time through Cookie preferences. Withdrawal does not affect the lawfulness of data collected while consent was valid; consent-based identifiable analytics still held are queued for deletion without undue delay.

Write to [email protected], preferably from the account's contact address. We ask for additional identity evidence only where there is reasonable doubt, collect the minimum and remove it after checking. We normally respond within one month. If the law permits an extension for a complex or multiple request, we explain it within that month; the extension can be up to two further months.

Account Settings provides a JSON export and account deletion. The export covers application records; a full access request can also include relevant analytics, logs or correspondence, which we handle separately. You can complain to the French data-protection authority, the CNIL.

8. Security, decisions and age

We use encrypted connections, restricted access, session security, database access rules, rate limits and limited logging. Report a suspected security incident to [email protected]. Access applications and moderation decisions are reviewed by a person. We do not use automated decisions with legal or similarly significant effects.

We ask you to confirm that you are 18 or older, without routinely collecting your date of birth or identity document. A credible report about a minor can lead to restriction, necessary verification and deletion. We will notify you of material changes to this notice where required.

9. Community and partner referrals

A referral code is optional. When you submit one at signup, through a link, an authorised referral cookie or manual entry, we save the community or partner identifier, the attribution date and its association with your account. We use these records to administer and assess the partnerships you choose to credit, based on legitimate interests. The records are private to authorised administrators and our hosting/database providers; this feature does not give partners a list of users.

Referral attribution is included in your account export and deleted with the account, subject to the specific retention exceptions above. You can request a correction, deletion or object to this use at [email protected]. Withdrawing referral-cookie consent deletes the browser cookie; it does not itself delete the attribution already submitted with an account. The alpha is free: partners receive no payment, and users receive no financial reward or discount.