Privacy Policy

1. Who is responsible

Museum of Websites is responsible for the personal information described in this policy. Privacy questions and requests may be sent to the Privacy Officer through our contact form.

This policy applies to the Museum of Websites website and services. It does not govern websites that we archive or link to, or independent services that you choose to visit.

2. Information we collect

Information you provide

• Account and authentication information: email address, password and authentication records processed through Supabase, account identifier, account dates, and verification or sign-in status. If you use a supported third-party sign-in provider, we may also receive the name, profile image, provider identifier, and other profile details you authorize that provider to share. Museum of Websites does not store your password in readable form.
• Profile and community information: display name, avatar, comments, ratings, reviews, moderation history, and the dates and website designs associated with those actions. If username and biography features become available and you choose to use them, we will also collect the username and biography you provide.
• Likes: which website designs you like or unlike and when you do so.
• Newsletter information: email address, subscription status, consent record, and engagement data made available by the newsletter provider, such as delivery, opening, or link-click information.
• Communications and submissions: your email address, subject, message, attachments, support requests, privacy requests, bug reports, website submissions, and other information you choose to send.

Information collected automatically

• Request and device data: IP address, date and time, requested page, referrer, browser, operating system, device type, language, and approximate country or region.
• Usage data: pages viewed, links or interface elements used, page and modal views, session duration, and navigation paths.
• Performance data: loading, rendering, responsiveness, and stability measurements such as Core Web Vitals.
• Session replay and heatmap data: for a sample of visits, visible page text, mouse movement, clicks, scrolling, page navigation, and form interactions. Input fields are intended to be masked. Do not enter sensitive personal information into free-text fields.
• Security and diagnostic data: failed sign-ins, API errors, server logs, and information used to identify abuse or troubleshoot the Service.

We may combine information from these sources when reasonably needed for the purposes below.

3. What is public and private

• Public: your display name, avatar, comments, ratings, reviews, and their timestamps may be visible to anyone and indexed by search engines. If you add a username or biography when those features become available, they may also be public and indexed. Do not include information you want to keep private.
• Private to your account: your email address, account details, and list of liked website designs are not intentionally shown to other users.
• Public in aggregate: total like counts, rating averages, rating distributions, review counts, comment counts, and view counts may be public. These totals do not identify which account supplied an individual like unless you disclosed that separately.

4. How and why we use information

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier processing unlawful. Where we rely on legitimate interests, we consider the effect on people and use only information reasonably needed for the stated purpose.

5. Cookies, local storage, and analytics

Account and preference storage

Authentication cookies are necessary for the account features you request. Blocking them may prevent sign-in or other account functions.

Umami analytics, heatmaps, and session replay

We run Umami on infrastructure controlled by Museum of Websites to measure visits and understand how people use the site. Umami creates a session identifier from a one-way hash of the IP address, user agent, and website identifier and is designed to do this without analytics cookies. Reports can include approximate country, browser, operating system, pages visited, referrer, and navigation activity.

For sampled sessions, Umami may also record interactions for replay and heatmap analysis. Replays can include visible page text, clicks, pointer movement, scrolling, navigation, and form interaction. Input fields are intended to be masked, but you should not submit sensitive personal information through the site.

Vercel Web Analytics and Speed Insights

Vercel provides site hosting, traffic analytics, and real-user performance measurement. Web Analytics can report pages, referrers, country, browser, device type, and operating system. Speed Insights collects performance measurements from your device, such as loading speed, responsiveness, and layout stability.

Your controls

These analytics and replay technologies currently load automatically when you visit. You can clear or block cookies and local storage in your browser and may use browser privacy protections or content blockers. Blocking necessary storage can break account or preference features.

6. Who receives information

We disclose information only as reasonably needed for the purposes in this policy:

We may disclose information as part of a merger, financing, reorganization, or sale of all or part of the Service. Any recipient would be required to handle personal information consistently with applicable law. We may also disclose information with your direction or consent, or in aggregated or de-identified form that does not reasonably identify you.

7. No sale of personal information

We do not sell personal information. We do not disclose personal information to third parties for their own direct marketing or for cross-context behavioural advertising. If this practice changes, we will update this policy and provide any notice, consent, or opt-out required by law.

8. International processing

Museum of Websites is based in Canada. Our providers may process or store information in Canada, the United States, the European Union, or other countries where they or their subprocessors operate. Information processed outside your province or country may be subject to different laws and may be accessible to courts, law enforcement, or national-security authorities in those places.

Where required, we use contractual or other lawful safeguards for international transfers. Contact us if you want more information about the processing location or safeguards relevant to your information.

9. How long we keep information

We keep personal information only as long as reasonably needed for the purposes described above, including providing the Service, maintaining security, resolving disputes, and meeting legal obligations. In general:

• account information is kept while the account is active and for a limited period after deletion where needed for security, backups, legal obligations, or dispute resolution;
• likes are kept until you remove them or your account is deleted, subject to limited backups and legal retention;
• comments, ratings, and reviews are kept until deleted or removed; after account deletion, we may delete them or keep them without a link to your account where reasonably needed to preserve a discussion or rating total;
• newsletter information is kept until you unsubscribe, after which we may retain a minimal suppression record so we do not subscribe you again against your choice;
• Umami session replays are ordinarily retained for up to 30 days;
• analytics, aggregate statistics, server logs, support records, and security records are kept for periods appropriate to their purpose and then deleted or de-identified; and
• backups may retain deleted information temporarily until they are overwritten under the applicable backup cycle.

10. Security

We use reasonable administrative and technical safeguards appropriate to the nature of the information. These include encrypted HTTPS connections, secure and HTTP-only authentication cookies, restricted database access, and provider security controls. Password authentication is handled by Supabase; we do not store readable passwords.

No online service is completely secure. You are responsible for using a unique password, protecting access to your email account, and notifying us promptly through our contact form if you suspect unauthorized use. If a breach creates a real risk of significant harm or otherwise requires notice, we will investigate, notify affected people and regulators as required, and take reasonable corrective action.

11. Your choices and rights

Depending on where you live and the law that applies, you may have rights to:

• know whether we hold personal information about you and receive access to it;
• correct inaccurate or incomplete information;
• delete information or your account;
• withdraw consent, including newsletter consent;
• object to or restrict certain processing;
• receive certain information in a portable format; and
• complain to a privacy regulator.

You can remove an individual like by using the like control and may delete your account using an account-deletion control we provide. If a control is unavailable or you cannot access your account, or if you want to make another privacy request, use our contact form. You can unsubscribe from marketing email through the link in each message.

We may ask for information needed to verify your identity and authority. We will respond within the period required by applicable law and explain if an exception prevents us from fulfilling all or part of a request. We will not discriminate against you for exercising a privacy right.

12. Children

The public archive is intended for a general audience, but accounts and community features are not directed to children under 16. We do not knowingly allow children under 16 to create accounts or submit personal information through community features. If you believe a child under 16 has done so, contact us so we can investigate and delete the information where appropriate.

13. Automated decisions

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about you.

14. External sites and embedded content

The Service links to archived websites and may embed content or assets from third parties, such as videos, avatars, fonts, or social platforms. When your browser loads third-party content or you follow a link, the third party may receive your IP address, device information, referrer, and other information under its own privacy policy. We do not control those third parties.

15. Changes to this policy

We may update this policy when the Service, providers, or law changes. We will post the new version, revise the date above, and provide additional notice for material changes where appropriate. If a change requires consent, we will request it.

16. Contact and complaints

Send privacy questions, requests, or complaints to:

We will try to resolve your concern directly. You may also contact the Office of the Information and Privacy Commissioner for British Columbia, the Office of the Privacy Commissioner of Canada where it has jurisdiction, or the privacy regulator where you live.