Privacy Policy

What Buildfolk collects, why, who sees it, how long we keep it, and the choices you have.

Last updated: 19 October 2026

1. Who we are

Buildfolk ("we", "us") is run by Tenali Prem, Vidhya Nagar 1st Line, Guntur, Andhra Pradesh 522001, India. We decide how and why your personal data is used for the services described here, so we are responsible for it (the "data fiduciary" or "data controller").

Questions or requests about your data: nexushubcodebased@gmail.com. Grievance Officer: Tenali Prem, nexushubcodebased@gmail.com.

This policy covers the Buildfolk website and everything inside it: accounts, the AI workspace, the Arcade, Communities, Buildfolk Social (posts, Waves, messages and calls), Shopping, the Seller studio, Product trends and the Buildfolk Assistant.

2. What we collect

When you create an account

• Full name, email address, date of birth, country and password. We store your password only as a scrambled one-way hash (scrypt), so nobody at Buildfolk can read it.
• Mobile number, only if you choose to give it. It is optional and not verified.
• When you accepted the terms, and whether your email was verified with a one-time code.

We need your date of birth to apply our age rules (Buildfolk is for people aged 13 and over, and some features are for adults only). We need your email to verify your account and to send you security and order messages.

Parent or guardian consent (members aged 13–17)

Before an account of someone aged 13–17 opens, we email the parent or guardian they name. When the parent agrees, we record their name, email address, year of birth (to check they are an adult), the time, and the network (IP) address and browser they agreed from, as proof of consent. Until a parent agrees, the account is locked; if nobody agrees within 7 days, or the parent withdraws consent, the account and its data are deleted. The parent receives an email when the teen gets a new contact and a daily summary of who the teen chatted with or called. Parents never see message text.

Shopping and selling (not open yet)

Shopping is coming soon. Nothing below is collected until it opens.

• Orders: the delivery name, phone number and address you enter, the items, prices, order status and courier tracking numbers.
• Payment: Buildfolk currently accepts cash on delivery only. We do not collect or store card numbers, bank account details or UPI IDs.
• Sellers: business name, phone number and pickup address, approval status, and your listings (photos, descriptions, prices and stock).
• Reviews, wishlist and reports: your star rating and review text, the products you save, and listings you report.

Buildfolk Social

• Your profile: @name, photo, bio, and whether your account is private.
• Your developer profile (optional): what best describes you (for example student, engineer or working developer), up to 3 interests, a headline, your About me text, up to 15 skills, what you are open to (internships, jobs, freelance work, collaboration) and up to 5 links. We use it to show your profile and to suggest relevant projects and people. Teens' links and About section are shown only to people they follow. You can change or remove it any time in Developer profile, and it is deleted with your account.
• Project analytics: when someone opens a project page or clicks its live-demo or GitHub link, we add one to that project’s daily totals so the builder can see how their project is doing. To count unique visitors we keep a code made from the visitor’s IP address and browser with a secret that changes every day; it can’t be turned back into an IP address and can’t link visits on different days. We don’t use cookies for this, don’t store IP addresses or names, and don’t count the builder’s own visits. Only the builder sees their project’s analytics, and they are deleted with the project or the account.
• Windows app email (optional): if you tick “Email me when the Windows app is ready”, we send you one email when it launches. It is off unless you turn it on, you can turn it off any time in Developer profile, and it is deleted with your account.
• What you share: posts, photos, videos and Waves, captions, comments and likes, plus who you follow, block and report.
• Messages: stored on our server so you and your contact can read them. We do not read your messages. The only exception is a message someone reports to us, which our moderators may review.
• Calls: we record who called whom, when, and how long it lasted. The sound and video go directly between the two browsers, are encrypted by the browser, and are not recorded. Because calls are peer-to-peer, the other person's device can see your network (IP) address.
• Buildfolk Stage: if you are 18 or over and your account is public, the projects you publish appear on the public Stage feed together with a public portfolio page showing your name, photo, headline, fields, About me, skills, what you are open to, follower counts and your projects. Anyone can see them, including people without an account. We store the projects you like and save, and show the builder how many likes their project has; deleting your account deletes your likes and saves. Making your account private removes your projects and portfolio from Stage. Members under 18 are not on Stage unless they turn on "Show my projects on Buildfolk Stage"; their projects then appear as made by a "Teen builder", without their name, photo, profile, follower count or links, only other members under 18 can read and write comments on them, and they can turn it off at any time. A project's demo video, like its screenshots, can be seen by anyone who can see the project and is deleted with the project or the account.
• Opportunities: the listings you save (to remind you two days before they close) and the opportunities you suggest, with whether they were listed. Opportunities link to other organisations' websites; what you share with them is covered by their own privacy policies. Saves are deleted with your account, and your suggestions are no longer linked to you.
• Teams: when a builder adds you to a project's team and you accept, your name, @name, photo and role are shown on that project and the project appears on your portfolio. You can leave a team at any time. Teams are either all adults or all members under 18.
• Weekly email (optional): if you turn it on, we use your fields, your unread notifications and new projects and opportunities to write one email a week. It is off unless you turn it on, and each email has a one-click unsubscribe link.
• Search: what you type in search is used only to find results and is not stored. Search follows the same rules as the rest of the site: adults and members under 18 do not find each other unless they already follow each other, and blocked people are never shown.
• Stage review for members under 18: before a teen's project appears on Stage, the Buildfolk team looks at its text, screenshots and video to check that nothing shows who they are.
• Communities: the communities you join or create, your role in them, and the messages you post on their text pages (including replies, @mentions and projects you share) and the reactions you add, stored so the community can read them and deleted with your account. We note which messages you have read, to show unread counts. In voice rooms we keep only who is in the room while it is open; the sound goes directly between the browsers, is encrypted by the browser and is not recorded, and because voice rooms are peer-to-peer, the other people in the room can see your network (IP) address. Reports about community messages are kept so we can review them. Announcements create a notification for every member.

AI features

• AI with your own API key: your chats are sent from your browser directly to OpenRouter using your own OpenRouter key. They are not sent to the Buildfolk server.
• Buildfolk Assistant: your question, plus the parts of your own account it needs (for example your orders) and public shop listings, are sent from our server to OpenRouter to get an answer. We do not store your questions; we only count how many you ask each day to apply the daily limit. The free AI models we use may be run by providers who keep or use what is sent to them, including to train their models, under their own terms. Do not put sensitive personal information into AI chats.

Security and technical data

• Your network (IP) address, a description of your browser and device, sign-in times, and a random device identifier (a cookie; we store only a scrambled copy). We use these to keep you signed in, send new-device sign-in alerts, apply optional sign-in codes, and block attacks such as password guessing.
• Security logs, such as failed sign-ins and blocked requests.

Analytics, only if you agree

If you choose "Accept analytics cookies", Google Analytics records how the site is used: pages viewed, approximate location, and device and browser type. Google Signals and ad personalisation are switched off. Analytics is never used for teen accounts, and we respect the Global Privacy Control signal from your browser. See the Cookie Policy.

3. Data kept only on your device

Some workspace features save their data only in your own browser, not on our server: AI chat history, notes, saved projects, image cards, Arcade high scores, productivity tools, and your own OpenRouter API key. This data is erased from the browser when you sign out or when a different account signs in on that browser.

4. How we use your data

We do not sell your personal data. We do not show advertising based on your personal data. Promoted posts in Buildfolk Social are chosen by sellers, not by profiling you.

5. Who we share it with

• When Shopping opens, sellers you buy from: get your name, phone number and delivery address for that order, so they can deliver it.
• Other members: what you choose to make visible, such as your public posts, profile, and reviews (shown with your first name and last initial). Seller pickup addresses are never public.
• A linked parent or guardian, as described above.
• Service providers that run parts of Buildfolk for us:
  • Google (Gmail), to send verification codes and account emails.
  • OpenRouter and the AI model providers it uses, for the Buildfolk Assistant.
  • Google Analytics, only if you accept analytics cookies.
  • Google Fonts, which loads the fonts the site uses. Your browser contacts Google's servers, which can see your IP address.
  • Google public STUN servers, which help two browsers connect for calls. They can see your IP address.
  • Our hosting provider (Railway), which runs the site and stores its database, and Cloudflare (R2 storage), which stores the photos and videos members upload. Private photos and videos are opened only through short-lived links that the site creates after checking who may see them.
• Authorities, when the law requires it, or to protect someone's safety, including reporting child sexual abuse material to the appropriate authorities.
• A future owner of Buildfolk, if the business is sold or reorganised. They would have to respect this policy.

Voice dictation in the AI workspace uses your browser's built-in speech recognition. Some browsers, such as Google Chrome, send the audio to the browser maker to turn it into text.

6. Where your data is processed

Our server, and the providers listed above, may process your data in India, the United States and other countries. Where the law requires it, we rely on appropriate safeguards for these transfers.

7. How long we keep it

• Your account and what you post: until you delete it, or delete your account.
• Orders: kept after an account is deleted, with their delivery details, as business and tax records for as long as the law requires.
• Security logs: one year, as required by India's Digital Personal Data Protection Rules, 2025 and CERT-In directions.
• After you delete your account: your sign-up details (name, email, phone number, date of birth, country and parent consent records) are kept locked away for 180 days, and so is content we removed for breaking the rules, because India's IT (Intermediary Guidelines) Rules, 2021 require it for possible investigations. Only the site owner can reach them, and they are deleted after 180 days.
• Teen accounts without a parent's consent: deleted 7 days after sign-up, or 7 days after consent is withdrawn.
• Sign-in sessions: 12 hours. The device cookie lasts up to about 13 months.
• Verification codes: 10 minutes.
• Backups: we keep encrypted backups of the database to recover from mistakes or failures. Backups are replaced automatically on a rolling basis, and we delete older backup copies regularly. Until a backup is replaced or deleted, data you deleted can remain inside it, encrypted and unused.

8. Your rights and choices

• Get a copy of your data: Account → Your data → Download my data. You get a file with everything we hold about you, except passwords and security codes.
• Correct your data: edit it in your account, or email us.
• Delete your account: Account → Your data → Delete my account. This erases your personal details, posts, messages, reviews and saved items. Orders are kept as described above. You can also ask us by email.
• Withdraw consent: change your analytics choice with "Cookie settings" at the bottom of any page. A teen's parent can ask us to unlink parental control.
• Object or restrict: you can object to uses based on our legitimate interests.
• Nominate someone (India): you can name a person to exercise your rights if you die or become unable to.
• Complain: contact our Grievance Officer first. You can also complain to your data protection authority (for example the Data Protection Board of India, or your local authority in the EU or UK).

We reply to requests within 30 days at the latest. We may need to confirm it is really you before acting on a request. We will not treat you differently for using your rights.

9. Children and teens

Buildfolk is not for children under 13. Our sign-up refuses anyone whose date of birth shows they are under 13. If we learn that we have personal data from a child under 13, we delete the account. If you think a child under 13 is using Buildfolk, contact nexushubcodebased@gmail.com.

For accounts aged 13–17:

• They cannot sell.
• A parent or guardian must agree before the account opens (see section 2), and can withdraw that consent at any time.
• Their social accounts are private by default (always private under 16).
• Adults cannot find them in search or start chats or calls with them.
• Analytics is never used for them.

Date of birth is self-declared, so this is not proof of age. Parents and guardians can contact us to review, correct or delete their teen's data. Projects by members under 18 appear on Buildfolk Stage only if they choose it, after our team reviews them, and never with their name, photo or profile. See also our Safety page.

10. Security

Here is how we protect your data:

• Passwords are hashed.
• Sign-in cookies cannot be read by page scripts.
• The live site uses HTTPS.
• Requests from other websites are blocked, and password guessing is slowed down.
• Off-site backups are encrypted.

No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay, and report it to CERT-In, as the law requires.

11. Extra information by region

India

We process digital personal data under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and their rules. Contact the Grievance Officer named above for any complaint (see Contact and grievances); if you are not satisfied, you can complain to the Data Protection Board of India.

United States, including California

In the last 12 months we collected the categories described in section 2: identifiers, personal records, account and commercial information, internet activity, approximate location, and age. We use them for the purposes in section 4.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Depending on your state, you may have the right to know, access, correct and delete your data, and to appeal our decision. Use the contact details above. We honour Global Privacy Control.

European Economic Area and United Kingdom

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can complain to your local data protection authority. The legal bases we rely on are listed in section 4.

12. Changes and contact

If we make important changes to this policy, we will tell you on the site or by email before they take effect. The date at the top shows when it was last updated.

Contact: Tenali Prem, Vidhya Nagar 1st Line, Guntur, Andhra Pradesh 522001, India. Email: nexushubcodebased@gmail.com. Grievance Officer: Tenali Prem, nexushubcodebased@gmail.com.