Privacy Policy
This policy explains what Audja Makers collects about you, why, who helps us process it, how long we keep it and what you can ask us to do. We keep it short and specific. Makers has no advertising, no tracking pixels and no data sales.
1. Who is responsible
The controller is MTR Studio ("Audja", "we"), Estonia. Privacy questions: support@audja.com.
2. What we collect
| Data | Where it comes from |
|---|---|
| Account: email address, password (stored hashed by our auth provider), sign-up date, whether the email is confirmed | You, when you create your Audja account |
| Profile: username, display name, avatar, bio, links to your other sites, level, lifetime points, badges, email preferences | You, in Rewards → Profile; points and levels are computed by us |
| Content: designs and files, pictures, videos you link, print photos, notes, comments, ratings, reactions, collections, follows | You, when you publish or interact |
| Activity: downloads, boosts, prints, views, likes and saves per design, with the time and your account id | Created when you use the site; this is what points and the leaderboard are made of |
| Technical: IP address, browser type, the pages and API endpoints requested, error logs | Your browser, automatically |
| Fraud signals: device fingerprint of the Audja app if you activated one, IP address per download, clusters of accounts downloading the same creator | Derived by us to keep the prize pool fair |
| Payout details: a crypto wallet address (USDC on Polygon) or a gift-card email, the amounts paid, transaction ids | You, only if you win a prize and enter a payout method |
We do not collect payment card numbers, government IDs or precise location. We do not buy data about you from anyone.
3. Why, and on what legal basis
- Running the service (accounts, publishing, downloads, comments, collections, follows): performance of our contract with you (GDPR art. 6(1)(b)).
- Points, levels and the monthly prizes: performance of the contract; the leaderboard needs the download, print and boost records.
- Notifications and emails about your activity: performance of the contract; you can turn emails off any time (section 8).
- Fraud prevention (IP-based limits, device checks, cluster analysis, voiding fake activity): our legitimate interest in keeping the prize pool honest (art. 6(1)(f)).
- Paying prizes and keeping payment records: performance of the contract and our legal obligations to keep accounting records (art. 6(1)(c)).
- Security, logs and abuse prevention: legitimate interest.
- Marketing use of Gold+ makers' designs: the license you grant in the Terms; you can opt out by email.
4. What is public
Makers is a public community. Your username, display name, avatar, bio, links, level, lifetime points, badges, follower counts, published designs, print photos, comments, reactions, ratings and public collections are visible to everyone, including people without an account and search engines. Private collections and hidden designs are visible only to you. Your email address is never shown to other users. Download counts are shown per design, not per downloader.
5. Who processes data for us
| Provider | What for |
|---|---|
| Supabase | Authentication and the database (accounts, profiles, activity) |
| Cloudflare | Hosting the site and API, file storage (R2) for designs and pictures, rate limiting, DDoS protection; Cloudflare sees IP addresses and requests |
| Resend | Sending notification and account emails |
| Polygon network via a Safe multisig wallet | Prize payouts in USDC; blockchain transactions are public by nature |
| Gift-card providers | Prize payouts by gift card, when you choose that method |
| YouTube, TikTok, Instagram, Facebook | Only when a design page embeds a video a maker linked; the platform may set its own cookies when the video plays |
These providers act on our instructions under data processing agreements. Some are outside the EU; transfers rely on the EU Standard Contractual Clauses or an adequacy decision. We do not sell or rent personal data, and we share it with authorities only when the law requires.
6. How long we keep it
- Account, profile and content: as long as your account exists. Deleted designs are removed from the site immediately; old file versions are deleted from storage within 30 days; backups roll off within 90 days.
- Activity records (downloads, prints, boosts): kept while your account exists because they are the basis of points and past leaderboards. When you delete your account they are anonymised.
- Technical logs: up to 30 days.
- Payout records: 7 years, as accounting law requires.
7. Cookies and local storage
Makers sets no advertising or analytics cookies. Your sign-in session is kept in your browser's local storage by our auth provider so you stay signed in; a few preferences (for example a chosen tab) and downloaded 3D previews are cached locally to make the site faster. Cloudflare may set a security cookie to protect against bots. Embedded videos from other platforms can set their own cookies once you press play.
8. Emails
We email you about your own account (sign-in, password reset) and, if you keep the switch on, about activity on your designs and makes: likes, comments, downloads, makes, boosts, new followers, new designs from makers you follow, monthly ranks and payouts. One email per event, nothing bundled. Turn them off under Rewards → Profile → Notifications. We do not send newsletters from Makers.
9. Your rights
Under the GDPR you can ask us to: access the data we hold about you, correct it, delete it, restrict or object to processing based on our legitimate interests, and receive your data in a portable format. Most profile data you can edit yourself in Rewards → Profile; designs and makes you can delete on their pages. For everything else email support@audja.com; we answer within 30 days. You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or the authority in your own country.
10. Children
Makers is not for children under 16. We do not knowingly collect data from them; if you think a child has an account, tell us and we will remove it.
11. Security
Traffic is encrypted (HTTPS), passwords are hashed, file downloads use signed, expiring links, uploads are checked against size limits, and the API applies rate limits. No system is perfectly secure; if we learn of a breach affecting you we will tell you and the authorities as the law requires.
12. Changes and contact
We will post updates here and, for material changes, notify you on the site or by email. Questions: support@audja.com. See also the Terms of Service.