Explore
Last updated 7 November 2026
What we store about you, why, who else handles it, how long we keep it, and what you can ask us to do with it.
WhatWeMade (www.whatwemade.app) is run by Christian Werther and Mickey, as private individuals in Copenhagen, Denmark. We decide how your personal data is used, which makes us the data controller under the EU's General Data Protection Regulation (GDPR).
Write to us about anything in this policy at hello@whatwemade.app, in English or Danish.
You sign in with GitHub, Google or a link sent to your email. From GitHub or Google we get your email address, your name, your username and your profile picture. With an email link we get only the address. We use this to create your account, sign you in and set up your profile.
Your public handle is your GitHub username, your Google name, or the part of your email address before the @. We don't keep a GitHub access token: when you import a repo, we read your public repos through GitHub's public API.
Legal basis: it's needed to provide the account you asked for (GDPR article 6(1)(b)).
When you make an account, we also note where your visit came from: the address of the page that linked to us (without anything after a ?), or the campaign named in the link you followed. It isn't stored in your browser; it travels with the sign-in and is saved once, with your new account. Only our staff see it. Legal basis: article 6(1)(f), to know which places bring people who share their work.
What you add to your profile is public: your name, bio, location, role, links, a support link (Ko-fi, Buy Me a Coffee and the like), the agents you use, whether you write code, and your picture. So are your badges, followers and when you joined. If you turn on GitHub activity, we fetch your public contribution graph from GitHub and show it on your profile.
Legal basis: article 6(1)(b).
Projects (text, images, video, icons, links, repo details, build recipes, and the agents and stack behind them), discussions, comments and follows are public once published. Upvotes and saves are private; only the totals are public. Drafts are seen only by you and our moderators. Uploaded files are stored at public addresses, so anyone with the link can open them.
Public content can be read by anyone, including search engines and AI tools. We make it easy for them on purpose: projects are also available as Markdown, through /llms.txt, and through a public search for AI agents.
Legal basis: article 6(1)(b).
If you connect your own AI agent, we store each key's name, its first few characters, when it was made and when it was last used. Instead of the key itself we keep a fingerprint (a hash) we can check it against. Notes your agent leaves and changes it proposes are kept for you to review.
Legal basis: article 6(1)(b).
If you subscribe, we store your email address, the topics you picked, where you signed up, and when you subscribed, confirmed or unsubscribed. If you sign up with an address, we first send an email asking you to confirm. Members get it at the address they signed in with.
You can change topics or unsubscribe on the newsletter page, or with the link in every newsletter.
Legal basis: your consent (article 6(1)(a)), which you can withdraw at any time.
We store reports you make (the reason and your note), moderators' decisions (warnings, hidden content, limits and suspensions), the notices we send you and your answers to them, the results of automatic checks on what's shared (for example, a scan for secret keys), the notifications we show you, and a log of what staff do.
Legal basis: our legitimate interest in keeping the site safe and useful, and in handling complaints (article 6(1)(f)).
For each project we count views and clicks (live link, clone, download, repo, recipe, share) per day. Nothing about the visitor is stored: no IP address, no account and no cookie. Your browser remembers for the rest of the visit that it has counted a project, so it's counted once.
Legal basis: article 6(1)(f), to show makers how their projects do.
Vercel Web Analytics counts page views without cookies, and a few moments: signing up and how (GitHub, Google or email), starting and finishing a share, opening a project's link or code, signing up for the newsletter, and whether a search found anything. It tells visits apart with a fingerprint of the request that's thrown away within a day, and we see only totals, never who did what. Legal basis: article 6(1)(f), to know what's used and what isn't working.
When a search finds nothing, we keep the words you typed, but not who typed them, to see what's missing from the site. Don't search for anything personal. Legal basis: article 6(1)(f).
It doesn't count the admin, the pages behind newsletter links, or the team's own browsers. We used Google Analytics, only if you allowed it, until November 2026; we've stopped. See Cookies for everything stored in your browser.
Our hosting (Vercel) and our database and sign-in provider (Supabase) keep technical logs, including IP addresses, to run the service, keep it secure and find faults. They keep them for a short time under their own policies.
Legal basis: article 6(1)(f).
We use a few services to run the site. They handle data for us, under data processing agreements, and only for the purposes above.
Some of these are based in the US or the UK. Data sent to the UK is covered by the EU's adequacy decision for the UK. Data sent to the US is covered by the EU-US Data Privacy Framework where the company is certified, and otherwise by the EU's standard contractual clauses.
We don't sell your data, and there are no ads on WhatWeMade.
Go to Settings and choose Delete account. That deletes your profile, your projects (with every comment on them, other people's too), your discussions (with their replies), your comments, upvotes, saves, follows, notifications, the reports you made, your agent keys, the newsletter subscription on your account, and the files you uploaded.
A few things stay. Versions other people built on yours are theirs, so they stay, without the link to yours. Moderation records about you, and entries in the staff log that mention your handle, are kept as described above. Deleting a single project removes it from the site straight away; its uploaded files are removed when you delete your account, or sooner if you ask.
Write to hello@whatwemade.app and we'll answer within a month. If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk, or to the authority where you live.
You need to be 16 or older to have an account. If you think someone younger has one, tell us and we'll delete it.
When this policy changes, we update the date at the top. If a change matters for how we use your data, we tell members on the site before it applies.
