Privacy policy
Draft. This policy is not in force yet. Sign-up stays closed until it is approved. Parts marked like this are still to be filled in.
Last changed: 10 November 2026
Handcoded Bits is a place to build small animations and UI pieces by hand. This page says what the site keeps about you, why, who else handles it, and what you can do about it. We keep as little as we can.
Who is responsible
Handcoded Bits is run by name and postal address of the owner. For anything about your data, write to contact email address.
What we keep, and why
Your account
| What | Why |
|---|---|
| Your email address | To sign you in, to recover your account, and to tell you about changes to it. It is never shown to others. |
| Your handle | Your public name on the site. Everyone can see it. |
| Your password | Kept only in a scrambled form that cannot be turned back into the password. We cannot read it. |
| When you joined, when you last signed in, and when you accepted the terms | To run your account and to show that the terms were accepted. |
| Your role (member, editor or admin) | To decide what you may do on the site. |
We do not ask for your real name or your date of birth. At sign-up you confirm that you are 16 or older, and we keep only the fact that you accepted the terms.
If you sign in with GitHub or Google
The provider tells us your email address, the number it uses for your account, and your username there (GitHub) or your email address there (Google). We keep those and nothing else from your profile: no name, no picture, no contacts. We never see your password for that provider, and we keep no key that would let us act on your account there.
If you turn on the second step
We keep the secret your authenticator app shares with us, and your recovery codes, in encrypted form, so that we can check the codes you enter.
Cookies
The site sets two cookies, and only when they are needed: one that keeps you signed in, and one that protects its forms from being submitted by other sites. Both are necessary for the site to work, so there is no cookie banner. There are no advertising cookies, no analytics and no tracking of any kind.
Keeping the site safe and working
- Sign-in protection. To stop someone guessing passwords, the site counts sign-in attempts by network address (IP address). It remembers an address for a few minutes and then forgets it.
- The server's log. The server notes each request: the time, the page asked for and the kind of browser. It does not record your network address. The log is kept for how long, to be confirmed.
- Notices about your account. When your password, your email address or your second step changes, we email you about it. That email names the network address and the kind of browser the change came from, so you can tell whether it was you. We do not keep them.
- Error reports. When something breaks, a report with the technical details of the failure is sent to our error service. It is set up to leave out who you are: no network address, no cookies and no account.
Our grounds for using your data
- To give you the service you signed up for (a contract with you): your account, signing in and recovery.
- Our legitimate interest in a safe and working site: sign-in protection, the server's log and error reports.
- The law, where it requires us to keep or hand over something.
We do not sell your data, and we do not use it for advertising or to build a profile of you.
Who else handles your data
| Who | What for | Where |
|---|---|---|
| Scaleway (France) | Runs our server and our database, and sends our emails | The server and the database are in Amsterdam, the Netherlands. Email is sent from inside the EU. |
| Sentry (United States) | Receives error reports, without your identity | Stored in Germany |
| GitHub (United States) | Signs you in, only if you choose "Continue with GitHub" | Under GitHub's own privacy policy |
| Google (Ireland and United States) | Signs you in, only if you choose "Continue with Google" | Under Google's own privacy policy |
Your account is stored in the EU. If you sign in through GitHub or Google, that company learns that you used Handcoded Bits, and handles that sign-in under its own policy.
How long we keep it
We keep your account for as long as you have it. When you delete it, it is deleted from the site at once, with everything it held. Copies in our database backups disappear within number of days, to be confirmed.
Results of competitions that have already finished stay, without your name.
Your rights
You can do the most important things yourself, in your settings:
- See and take your data: download everything we keep about your account as one file.
- Correct it: change your handle, your email address and your password.
- Delete it: delete your account.
You can also ask us to limit how we use your data, or object to a use that rests on our legitimate interest. Write to the address above and we will answer within one month.
If you think we have handled your data wrongly, you can complain to the data protection authority of the country you live in, or to the authority of the owner's country.
Age
Handcoded Bits is for people aged 16 and over. If we learn that an account belongs to someone younger, we remove it.
Changes to this policy
When the site starts keeping something new, this page changes first. If a change matters to you, we tell you by email before it takes effect.