Privacy Policy

1. Information we receive

• Google account information: your account identifier, email address, name, and profile image made available through Google sign-in. Your Google name and profile image are used as account profile defaults. You can edit your display name and upload a replacement profile photo. Invited and verified users can claim a username and have a public profile. Custom profile photos are processed on our server, stripped of embedded metadata, and stored publicly in Cloudflare R2. Your Google email remains private. Authentication records are handled using Supabase. We do not receive your Google password or request access to your Gmail messages or Google Drive files.
• Invitations and community content: members create shareable invitation links without supplying a recipient email. We store a hash of the invitation token, who created and redeemed the invitation, creation and expiry times, its use or revocation status, and short-lived sign-in attempt hashes. We use the creation time to manage the annual invitation allowance. We also store the username, profile information and links you choose to publish, your posts, comments, votes, and relevant timestamps. Your Google email is not displayed on your public profile. By default, public profiles list the members who joined through that person’s invitations. You can hide this list from your own profile using the Show invited members setting.
• Advertising information: your account ID, tool listings, sponsor updates, campaign details, logos and other creative materials, destination URLs, checkout and subscription references, payment and subscription status, billing-period dates where applicable, and the version and time of acceptance of purchasing terms.
• Content checks and moderation: before publishing a community post, comment, reply, or comment edit, we send the submitted text to TypeSafe’s Jev model to assess spam and safety concerns, and the relevance of new posts to design and web development. For comments we include limited context from the post and parent comment. Submitted post URLs have query parameters and fragments removed. We do not add your account ID, Google email, profile name, or avatar to these requests. Text you submit or quote may itself contain personal information. Flagged submissions and unsuccessful checks are saved as private drafts for administrator review; a flagged edit does not replace the published comment. We store submission details, review outcomes, and administrator moderation records privately to manage publication and prevent abuse.
• Verification requests: the purchase and invitation eligibility used to determine your verification price, your request status, and the administrator’s review decision and time. Administrators can review your account profile and email to process your request. Paid verification status controls the public badge and ranking benefits.
• Payment information: Creem handles payment and billing details. We receive transaction and subscription information needed to manage your placement or verification request, but our application does not collect or store full payment card numbers or security codes.
• Technical information: hosting, authentication, security, and content-delivery providers may process IP addresses, request times, browser and device information, error details, and security logs when delivering the service.
• Optional analytics: if you allow analytics, TypeUI Insights measures visits to public pages, approximate click and scroll positions, engagement, device category, referring site, and campaign attribution. It uses a random session identifier. Page paths exclude query strings; campaign parameters such as UTM tags and referral codes are processed separately. We do not send your name, email, account ID, form contents, or comment text as custom analytics events.
• Correspondence: information you choose to provide when contacting us, such as your name, email, order reference, and message. When you open support chat through Chat with us, Crisp processes the messages and contact details you supply, along with technical information needed to provide the chat, such as your IP address, browser, and current page.

Community members’ profiles, published posts and comments, and published advertising materials are public and may be indexed by search engines. Drafts held for moderation are not public. Community access can be granted through an invitation, a confirmed advertising purchase, or approved paid verification. Profiles for accounts without active community membership are visible only to their owner. Votes contribute to public totals; individual voting records are not publicly listed. Do not post private or sensitive information you do not want published. Historical Curated entries are migrated editorial records and are not linked to newly created member accounts.

Invited and verified users also appear on the public leaderboard with their public name, username, avatar, and aggregate contribution counts, including upvotes received and given, comments, posts, and members invited. These totals determine their ranking. Hiding the invited-members list on your profile hides the list of recipients there; it does not hide your aggregate invitation count on the leaderboard.

2. Purposes and legal bases

We process account, profile, contribution, and advertising information to provide services you request and perform our contract with you, including authentication, publication, discussion, reserving a placement, billing reconciliation, granting community access after a verified purchase, and handling cancellation or support. We process invitation details under our legitimate interest in managing community access. Information necessary for these functions must be provided to use them; browsing public news does not require an account.

We rely on legitimate interests to maintain security, prevent abuse, diagnose failures, and establish or defend legal claims, balanced against your rights. We process records required for accounting, tax, or lawful requests to comply with legal obligations. Where an optional use requires consent, we will request it separately; you may withdraw it for future processing.

3. Service providers and disclosures

We use Google for sign-in, Supabase for authentication and private database records, Vercel for application hosting, Cloudflare R2 for image storage and delivery, Creem for payments and subscription management, TypeSafe for content safety and relevance checks, Crisp for support chat when you open it, and TypeUI Insights and Cloudflare Workers/D1 for analytics when you consent. They receive information needed for their respective functions. Google and Creem may also process information independently under their own policies.

Checked content can be published automatically or held privately for an administrator to approve or reject. Administrators can also remove published content. You may contact us about a moderation decision. Automated checks evaluate the submitted text and discussion context; they do not fetch or verify linked pages or inspect images.

We may share relevant information with professional advisers or authorities where necessary for legal obligations, legitimate claims, or protecting the service. If ownership changes, relevant information may transfer subject to applicable law and appropriate notice.

We do not sell personal information or share account information with advertisers for their independent marketing. Sponsored placements do not give advertisers access to your Google account or our private user database. Clicking an advertiser’s link takes you to a separate website governed by its own privacy practices.

4. Cookies, browser storage, and external content

Crisp support chat loads only when you select Chat with us in the footer or Contact us on the support page. It uses cookies to maintain your chat session. Closing chat hides the widget; it does not delete the conversation or session cookie. Opening chat does not enable optional analytics, and we do not automatically pass your signed-in account details to Crisp.

Authentication uses cookies or browser storage to complete Google sign-in, maintain a session, and support security. Accepting an invitation uses a short-lived, HttpOnly cookie to link an invitation to the browser completing sign-in; the invitation expires seven days after creation and the sign-in attempt expires after ten minutes. Signing out clears the app’s active session; you can also clear stored site data in your browser. Blocking essential storage may prevent sign-in or subscription management.

Optional TypeUI Insights analytics loads only after you select “Accept analytics.” Selecting “Reject optional” keeps it disabled. Your choice is stored in this browser for up to 180 days. Use “Cookie preferences” in the footer to change your choice or withdraw consent at any time. Withdrawal stops future collection and clears the tracker’s local session identifier; it does not automatically erase information already received by the analytics service. Optional analytics is based on your consent, and declining it does not prevent you from using the site.

With the same analytics consent, we use Cloudflare to measure public-page visitors, views of news, tools and advertising placements, and clicks on their external links. We create a random browser identifier that expires after 30 days; it is not your account ID. Requests contain that identifier and a signed measurement token identifying the public content or advertising placement, without page URLs, query strings, email addresses, or profile information. Our Worker stores a keyed hash of the identifier, processes the request IP address and browser user-agent for abuse prevention, and does not write either to our measurement database. Cloudflare may also process network information to operate and secure its infrastructure. Withdrawing consent stops these requests and removes the browser identifier.

Cloudflare visitor hashes are removed after about 30 days without a visit. Daily impression and click deduplication hashes are kept for up to three days, daily aggregate counts for up to 1,101 days, and campaign and public-content totals for the lifetime of reporting. We store public post identifiers with content totals so published news and tools can show their total views and external-link clicks. These statistics do not reveal visitor identities or individual browsing histories. Advertisers can see detailed aggregate reports for their own placements. Our advertising page shows aggregate consented visitor numbers and the number of registered users.

The tracker is excluded from sign-in, invitation, account, profile, submission, and billing pages. Account controls, contribution forms, and comment content are excluded from click measurement. Third-party sign-in, checkout, linked sites, and externally hosted images may involve provider requests and technologies outside this site. Their own privacy notices apply to that processing.

Browser new-tab extensions

Our Chrome, Microsoft Edge, and Firefox extensions display public news, projects, tools, and sponsor placements in your new tab. They work without an account. Chrome and Edge can send your existing website session to our extension API to display your name, profile image, username, and membership status and let you vote. They follow only the sign-in tab they open and return you to your original new tab after the website verifies your session. These versions do not extract or store authentication cookies or access tokens.

Firefox uses its browser-managed Google sign-in window and a separate Supabase session protected with PKCE. It keeps the session tokens in the extension’s temporary session storage, which is cleared when you sign out or the browser closes. It does not persist those tokens in local storage or feed snapshots, receive your Google password, or retain Google provider tokens. Firefox account requests use that session rather than your website’s cookies. Website account pages may ask you to sign in separately. None of our extensions accesses your browsing history, unrelated tabs, or content on other websites. Comments, submissions, billing, and profile editing open on our website.

The extension requests public story titles, descriptions, links, images, and counts from WebDesignerNews and stores appearance preferences, its own analytics choice, and public-feed snapshots locally. Search text is sent to our website to return matching stories; it is not included in measurement requests. A snapshot may be displayed for up to 24 hours when a connection is unavailable. Optional Cloudflare measurement starts only after you choose “Allow analytics” in the extension and follows the counting, hashing, and retention practices described above. It counts visible items and external-link clicks within the extension, without collecting activity on the destination website. The signed token identifies the public item or placement being counted. A view requires at least half the item to be visible for one second in an active tab. Extension and website consent choices and random identifiers are separate; using both can count as two visitors.

Use “Cookie preferences” in the extension footer to withdraw consent. This stops future collection and clears the extension’s measurement identifier and local deduplication records. Removing the extension clears its local storage. No remotely hosted analytics script runs inside the extension. Essential requests and image delivery still involve the hosting, authentication, and image providers described in this policy. These providers process normal connection information, including IP addresses, to deliver and secure requests. The extension does not request GPS or precise device location.

Firefox also requires its optional data-collection permissions before analytics can run. Declining or withdrawing those permissions in Firefox’s extension settings stops measurement, even if you previously allowed analytics inside the extension. These optional permissions are separate from the necessary data processing for displaying content, searching, and using your account.

Our use and transfer of extension user data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We use it to provide, secure, and improve the disclosed start-page experience and statistics. We do not sell this information or use it for personalized advertising or credit decisions. Public statistics and advertiser reports contain aggregate counts, not personal identifiers or individual browsing histories.

Transfers of extension user data are limited to service providers as necessary for those functions, legal obligations, preventing fraud or abuse, or an ownership transfer with your explicit prior consent. These limits also apply to aggregated or derived extension data and take precedence over the general disclosure provisions above. Human access to non-public extension user data is limited to support you explicitly authorize, security investigations, legal requirements, or aggregated and anonymized internal reporting. Sponsored placements are not personalized using extension user data.

5. Retention and security

We retain account information while it is needed to provide your account, public contributions while published, invitation records for access administration and abuse prevention, and campaign and subscription records for service delivery, accounting obligations, dispute handling, and substantiating consent. Retention depends on the type of record, legal requirements, whether a subscription or claim remains open, and provider backup schedules. We delete or anonymize information when it is no longer needed for those purposes.

We use access restrictions and technical safeguards appropriate to the service. No system can guarantee absolute security. Please protect your Google account and do not send payment credentials in support messages.

Deleting an account does not itself cancel a recurring subscription. Cancel renewal through the billing portal first, or include a cancellation request when contacting us. Records required for legal obligations or ongoing claims may remain after account deletion, with access restricted as appropriate.

6. International processing

Our providers may process information outside Romania or the European Economic Area. Where applicable law requires a transfer mechanism, transfers must be covered by an applicable adequacy decision or appropriate safeguards, such as approved standard contractual clauses. Contact us for information about the safeguards applicable to your data or to request a copy where available.

7. Your rights and choices

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal information; object to processing based on legitimate interests; and withdraw consent where processing relies on it. We may need proportionate information to verify your identity. We respond within the time required by law and explain any lawful limitation.

You can complain to your local supervisory authority or Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP). You do not have to contact us before exercising that right. We do not use your information for solely automated decisions producing legal or similarly significant effects.

8. Children

Accounts and advertising purchases are intended for adults aged 18 or older. We do not knowingly solicit personal information from children. Contact us if you believe a child has provided information so we can investigate and take appropriate action.

9. Updates and contact

We will update the date above when this policy changes and provide additional notice of material changes where required. New purposes that require consent will not be applied to existing information without that consent.

Bergside SRL (presented in English as Bergside LLC)
Constantin Titel Petrescu Nr. 7
Timișoara, Timiș, 300103, Romania
VAT identification number: RO42244256

For account, advertising, legal, or privacy requests, email support@webdesignernews.com or write to the postal address above. Include the relevant account email or order reference so we can identify your request. Do not send passwords or payment card details.