Privacy Policy

Effective October 16, 2026

This policy explains what artifact.cafe collects, why, and what you can do about it. The short version: we collect what it takes to host artifacts and carry comments, we don't sell personal data, and reviewers never need an account.

What we collect

If you sign in

Your email address, display name and avatar, from the one-time email code or from Google or GitHub when you choose them. We also keep session records, your workspaces, memberships and roles, and the API keys you create (stored hashed).

If you publish

The files you upload, their versions, titles and settings. Publish tokens, claim links, invite links and share tokens are stored hashed and shown to you only once.

If you review

Your comments, reactions, the spot on the page they point at, and the guest name you type. Your browser keeps a guest identity so you can edit or delete your own comments later. Signed-in members comment under their account name.

If an artifact collects data

Some artifacts include forms or collections that save what visitors enter. That data belongs to the artifact's owner, who decides what it asks for. We store it for them, with the visitor's guest or member identity attached. Ask the owner about how they use it.

Automatically

To count views and stop abuse, we use your IP address in a one-way hashed form. Raw IP addresses aren't stored with comments, view counts or reports. Owners see aggregate views, unique viewers and time on page for their artifacts, never who the viewers were. Our hosting providers keep standard request logs for security and reliability. On the main site we also measure visits and sign-ups with a first-party analytics tool; when you're signed in, it links those to your account.

Cookies and local storage

We use cookies to keep you signed in, to remember a password you entered for a protected artifact, and to let you into artifacts shared with you. Local storage remembers interface choices, your guest identity, and which comments you've already seen. We don't use advertising cookies or cross-site trackers.

How we use it

• To host and render artifacts, and carry comments between people.
• To send the emails you've asked for: sign-in codes, invites, and comment and mention notifications. You can turn notifications off.
• To enforce limits, fight spam and abuse, and keep the service secure.
• To understand how the service is used so we can improve it.
• To meet legal obligations.

We don't sell or rent personal data, and we don't use your artifacts or comments to train AI models.

Who can see what

Artifacts and their comments are visible to whoever the artifact's settings allow: anyone with the link, a workspace's members, or the specific people it's shared with. Your guest name or account name shows next to your comments. Agents working for the author can read the comments on that author's artifacts.

Service providers

We use a small set of providers to run the service, each only for its job: Vercel (website and API hosting), Cloudflare (artifact storage and delivery), Neon (database), Resend (email), Google and GitHub (sign-in, if you choose them), and Hellyeah (site analytics). They may process data in the United States and other countries. We may also share data when the law requires it, to protect people or the service, or as part of a merger or sale, in which case this policy keeps applying.

How long we keep it

• Unclaimed artifacts are deleted 24 hours after their last publish.
• Deleting an artifact removes its versions, files, comments and collected data.
• Deleted comments are stripped of their text and kept only as a placeholder so replies still make sense.
• Account data stays until you ask us to delete your account. Backups and logs roll off on their own schedule.

Your choices and rights

You can edit or delete your own comments, delete your artifacts and workspaces, and change your profile from the dashboard. To get a copy of your data, correct it, or delete your account, email hello@artifact.cafe from the address on the account. Depending on where you live, you may also have the right to object to or restrict how we use your data and to complain to your local data protection authority. Where the law asks for a legal basis, we rely on running the service you asked for, our legitimate interest in keeping it safe and improving it, and your consent where we ask for it.

Security

Artifacts render on their own separate domain in a sandbox, apart from your account. Secrets are stored hashed, and traffic is encrypted in transit. No system is perfectly secure; if you find a problem, please tell us at hello@artifact.cafe.

Children

The service isn't meant for children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

Changes

When this policy changes, we update the date at the top. For material changes we'll give notice on the site, or by email if you have an account. Questions: hello@artifact.cafe. See also the Terms of Service.