Privacy Policy

1. Cookies and local storage

This site uses no advertising cookies and no audience trackers (no Google Analytics, no social pixel, no ad network). Only three technical items are tied to your browser:

• a functional cookie (maximum duration: 12 months, readable by the site's JavaScript) which remembers the interface language on this device;
• a piece of information kept in your browser's local storage, which records that the information banner was seen;
• a session cookie when you are signed in (unreadable by the site's JavaScript), which keeps you signed in.

The language cookie is set in four cases: when you choose a language (switcher, “Interface en français / English” banner), when you follow a link pointing to a given language, when you browse a page of the site in a given language (including if you were redirected there based on your browser's language), and, for a signed-in account with no language choice yet on this device, from the preference stored in the account (see “2 bis”). The cookie only changes the interface (menus, buttons): it never changes the language of project content.

You can delete these items at any time in your browser settings. Deleting the language cookie does not erase the preference stored in your account.

Public forms (project submission, reporting, sign-in) load the Cloudflare Turnstile anti-bot challenge, which receives your IP address, as with any website you visit. It places no advertising cookie. Fonts are self-hosted: no request is made to Google Fonts.

2. Personal data

Simply browsing the site creates no account and asks for no personal information. Technical data is nevertheless processed, including while browsing:

• host technical logs (Cloudflare): IP address, date, requested URL, user agent; duration set by Cloudflare and visible in its own dashboard;
• anti-abuse counters: for reports, requests are counted per IP address. The IP address is not stored in clear text: only a non-reversible fingerprint (truncated HMAC computed with a dedicated server key) is stored, for 1 days;
• image upload counter (hourly quota per account): kept for 30 days.

2 bis. Account, language preference and published content

Creating an account records: your username, your email address (and its verification status), the identity of the provider if you sign in with GitHub or Google, the registration date, and the country and biography you provide. Your contributions (projects, discussion messages, stars, favourites, forks, affiliate links) and your contribution score (scrugs) are added. This data is used to operate your account, display your public contributions and award reputation points.

Sessions keep the user agent associated with each session, for revocation and technical diagnosis. The IP address is not recorded in the database: the authentication library's IP tracking is disabled and no session IP column is populated. Sessions expire after 30 days of inactivity and expired rows are purged after 30 days.

If you choose an interface language (switcher, a link pointing to a given language, or signing up from a French page), that preference is stored in your account so it can be restored on your other devices and to select the language of our emails. It is kept until you change it, or until your account is deleted or anonymised.

The country you provide in your settings (ISO 3166-1 alpha-2 code) is displayed next to your username in the public activity leaderboards (stars received, projects published, forks). It remains entirely optional: no country is displayed if you leave it empty.

Content you publish (DIY projects, reviews, comparisons, discussion messages, images, affiliate links) is public: it is visible to everyone, indexable by search engines, and reusable under the licence stated on each project. Do not publish personal information in content if you do not want it to be public.

3. Reports (content and messages)

Every project and every discussion message has a report button. You can report content as an anonymous visitor (a Cloudflare Turnstile anti-bot challenge is then displayed) or from your account. A report contains: the target, the chosen category (illegal content, copyright infringement, spam, harassment, dangerous content, other), a free-text explanation and, if you wish, a contact address.

• If you leave an address, it is used only to acknowledge your report and to inform you of the decision; you can report without leaving an address.
• The anti-abuse counting uses a non-reversible IP fingerprint (see “2”), kept for 1 days.
• Reports and their handling (decision, resolution note) are kept for 12 months; the contact address, if any, is then erased (set to empty) and the report remains, anonymised of your address.
• Repeated abusive or clearly unfounded reporting may result in the report being dismissed.

For manifestly illegal content, a dedicated page exists: report illegal content.

4. Moderation, audit log and automated tool

Every moderation decision is recorded in an audit log (measure taken, content concerned, ground, moderator's note, date and notification outcome). This log is append-only: no administration interface allows a line to be modified or deleted; it is purged only automatically once its retention period expires, and that purge is itself logged. Moderation decisions are kept for 2 years.

Moderation of projects may use an automated tool provided by a provider established outside the European Union. When enabled, the data transmitted is the project's: title, content type, summary, textual content (limited to the first 4,000 characters), skills, hardware, software, review and comparison data. No account data (username, email address, identifier, passwords) is transmitted to it. The tool returns an assessment (flagged or not, ground, category) which never on its own triggers permanent deletion: the decision is logged and can be reviewed on request by a human.

The same provider may be used to prepare the draft of the newsletter from the titles, summaries and links of published projects; no subscriber data is transmitted to it.

Given this transfer outside the European Union, you may, as for any other processing, exercise your rights by writing to privacy@scrugo.com.

5. Newsletter

Subscribing to the newsletter is a two-step process: after leaving your address, you receive a confirmation email; nothing is sent before you confirm. The date and source of consent are recorded, and a time-limited confirmation token is stored as a hash: it is never stored in clear text.

Every newsletter email contains a link that is specific to you; the link is signed and only acts after a click confirmation (a mere preload by software unsubscribes nobody). A one-click unsubscription mechanism is also offered directly from your mail client.

Your address and consent are kept until you unsubscribe. No subscriber data is transmitted to the modelling provider.

6. Deleting your account

Deletion is requested from your settings with the “Request deletion of my account” button. An acknowledgement email is sent to you, stating the announced processing period: one month.

On deletion, your account is anonymised: username, email address, picture, biography, external links, country and language preference are erased or replaced with “Deleted account”; your sessions, sign-in identities (GitHub/Google), newsletter subscription, stars, favourites, forks and badges are deleted.

The content you published is kept (projects, images, discussion messages), attributed to “Deleted account”, because other users refer to it and it is part of the site's public history. If you also want your publications deleted, state it in your request: they are deleted under the rules of article 7 (immediate hiding, permanent deletion after the grace period). This point is subject to a legal assessment documented in the site's open questions.

7. Deletion of publications and retention periods

When a publication (DIY project, review, comparison) is deleted, it is immediately hidden from public listings and the site; its data is kept for a grace period of 30 days (allowing restoration on request), then permanently deleted by the automatic purge task, including the associated files. Images no longer referenced by any content are deleted after 48 hours.

Status at launch. The automatic purge tasks first run in simulation mode: they record what they would delete without deleting anything. No automatic database backup is produced at this stage. The durations below are therefore target durations; the date on which the purges become effective will be published on this page.

Target retention periods:

• Account and profile: as long as the account exists; anonymised on deletion.
• Language cookie: 12 months; account language preference: as long as the account exists.
• Sign-in session: expires after 30 days of inactivity; expired rows purged after 30 days.
• Email verification / reset tokens: expired, then purged after 7 days.
• Deleted publication: hidden immediately, erased after 30 days.
• Unreferenced images: 48 hours.
• Reports: 12 months, then contact address erased.
• Anti-abuse counter per IP (fingerprint): 1 days.
• Image upload counter: 30 days.
• Pending referral invites: 12 months.
• Administration log and moderation log: 2 years.
• Automatic task execution log: 3 months.
• Database backups: disabled at launch (no automatic backup is produced); once enabled they will be kept for 30 days, will contain personal data and will be accessible only to the publisher. In the event of an incident, Cloudflare's point-in-time restore (Time Travel) can go back up to 7 days (free plan) or 30 days (paid plan).
• Host technical logs: duration set by Cloudflare.

8. Recipients, processors and transfers outside the European Union

To operate, the site relies on:

• Cloudflare, Inc. (United States): hosting, database, image storage, anti-bot (Turnstile) and technical logs;
• Gumroad, Inc. (United States): sale of premium content (the transaction and payment data are processed by Gumroad, never by Scrugo);
• GitHub and Google: only if you choose to sign in with those accounts (identifier and email address transmitted by the provider).

No other third-party domain is contacted by your browser: fonts are self-hosted and no audience measurement tool is loaded. These providers are bound by data-processing agreements and, for transfers outside the European Union, by the safeguards provided for by the GDPR (standard contractual clauses or equivalent regime). The detail of those safeguards remains to be confirmed with each provider.

9. Hosting

This site is hosted on Cloudflare Pages. Data is stored on Cloudflare D1 (database) and Cloudflare R2 (images), within Cloudflare's infrastructure. The host and its address are given in the legal notice.

10. Your rights

In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to give instructions on the fate of your data after your death.

How to exercise them: write to privacy@scrugo.com. We reply within one month; this period may be extended by two months for complex requests, with notice of the extension. Proof of identity may be requested in case of reasonable doubt.

Export: your data can be exported in a structured format on request, through the same channel.

11. Affiliate links

Some links on the site are affiliate links (AliExpress, Amazon, etc.). When you click on these links, a temporary cookie may be placed by the partner platform to attribute the commission. These cookies are subject to the privacy policy of the platform concerned; they are only placed after you click the link.

12. Updates

This policy may be modified at any time. Last updated: October 2026.

13. Related documents and contact

This policy is accompanied by the terms of use and the legal notice (hosting). To add affiliate links to your projects, see the dedicated guide.

Personal data and rights: privacy@scrugo.com.
Illegal content: report illegal content.
Security: security@scrugo.com.