Privacy Policy

Effective Date: November 13, 2026
Last Updated: November 13, 2026

This Privacy Policy explains how Polytab ("Polytab," "we," "us," or "our") collects, uses, and shares information when you visit or interact with https://polytab.store (the "Service").

1. Core Principles

Polytab aims to minimize data collection. Much of the Service is a static website; you can browse projects without creating a Polytab account.

2. Information We Collect

Depending on how you use the Service, we may process:

Public GitHub endorsement data: If you endorse a project by submitting a GitHub issue, information you submit (such as your GitHub username/profile, issue content, and timestamps) is public on GitHub and may be included in public, auditable snapshots/data used by the Service.
Provider-verified endorsement data (OAuth): If you use a verified sign-in/endorsement flow (e.g., GitHub, Google, Discord, Facebook, TikTok, as available) via endorse.polytab.store, we receive limited information from the provider to verify your account and record a deduplicated endorsement.
- We use your provider account identifier to create a one-way cryptographic keyed hash (HMAC) for deduplication/counting.
- We do not intentionally store your provider password or OAuth access tokens in our endorsement records.
- Where available, we may store a private account reference/label or profile URL associated with the verified endorsement (for deduplication, integrity, and anti-spam/abuse purposes). This information is not exposed by the public endorsement counts API, but it may be accessible to service operators/administrators with backend access.
Local/device data (browser storage): The site may use browser storage (e.g., localStorage) for preferences or local-only features (such as device-local feedback/settings) stored on your device.
Hosting/network logs: The Service is delivered using third-party infrastructure (e.g., GitHub Pages and/or Cloudflare). These providers may process standard technical data such as IP address, user-agent, request metadata, and timestamps for delivery, security, and abuse prevention.
Stewardship documents: If you apply for stewardship, government-ID verification is handled strictly out-of-band — never uploaded to this site, this repository, or GitHub issues. Verification documents are deleted within 30 days of the review outcome unless retention is required by law or a fraud investigation. We do not sell, rent, share, or monetize stewardship data.
On-chain & repository transparency: Contributions on Base are publicly visible on the blockchain (the shared escrow address and every sweep transaction are public record). Sweep receipts posted to the GitHub repository are public audit records and may reference organization names/IDs and destination wallets.
Communications: If you contact us (e.g., by email), we receive the information you provide and related metadata needed to respond.

3. How We Use Information

We use information to:

Operate, display, and maintain the Service (projects, endorsements, counts, and related features).
Verify and deduplicate endorsements and prevent spam, fraud, and abuse.
Maintain security, reliability, and integrity of the Service and infrastructure.
Respond to inquiries and support requests.
Comply with legal obligations and enforce our Terms.

4. Cookies & Browser Storage

We do not intentionally use third-party advertising or cross-site behavioral tracking cookies. The Service may use strictly necessary browser storage/cookies/tokens (including short-lived OAuth state/security parameters) for functionality and security.

5. How Information Is Shared

We do not sell your personal information. We may share information:

Publicly: Endorsements/content you submit via public channels (e.g., GitHub issues) and derived public snapshots/counts are publicly accessible.
With service providers/infrastructure: Providers that help operate the Service (e.g., GitHub, Cloudflare, identity providers) process data according to their own terms/policies.
For legal/safety reasons: If required by law or to protect rights, safety, security, and integrity of the Service and users.

6. Data Retention

OAuth access tokens: Used transiently for verification and not intentionally persisted in endorsement records.
Verified endorsement records: Retained as needed to maintain counts, deduplication, integrity, and abuse prevention, unless/until removed or updated as part of data/source updates or valid requests (where feasible).
Public third-party records (e.g., GitHub issues): Governed by the third-party platform; changes there may be reflected in subsequent snapshots/updates.
Communications/support records: Retained as needed to respond and for legitimate operational/legal purposes.

7. Your Privacy Rights & Choices

Depending on your location, you may have rights to access, correct, or delete certain personal information, or to object/restrict certain processing. Because some data is public (e.g., GitHub issues) or necessary for integrity/deduplication, deletion/changes may be limited or may require action on third-party platforms.

To make a request, contact [email protected]. We may need to verify your request and your relationship to the relevant account/record.

8. Data Security

We use reasonable technical and organizational measures (including HTTPS/TLS in transit, limited data handling, and cryptographic hashing for deduplication identifiers) to protect information. However, no method of transmission or storage is completely secure.

9. Children's Privacy

The Service is not directed to children under 13 (or a higher age where required by local law), and we do not knowingly collect personal information from children in violation of applicable law. If you believe a child has provided personal information, contact us so we can take appropriate steps.

10. Changes to This Policy & Contact

We may update this Privacy Policy from time to time. Changes are effective when posted at https://polytab.store/privacy with an updated "Last Updated" date.

Email: [email protected]
Website: https://polytab.store