Privacy

The short version

• You can use hackshop without an account.
• Analytics count visits and clicks. They never include the text of your idea.
• Signed out, your saved builds stay in your browser.
• Signed in, your builds are stored with your account and only you can see them.
• Ideas you post on the Ideas page are public.
• We don't sell your data and we don't run ads.

What we collect and why

Analytics

We use Google Analytics and PostHog to count visits and product actions, such as running the planner, starting a build or copying an agent prompt. These events carry metadata like counts, timings, which button was used and which page you were on. They never include the text of your idea, your constraints or your inventory. PostHog also records page views and basic error reports so we can fix bugs.

Google Analytics runs with IP anonymization and with ad personalization and Google signals turned off. It is skipped entirely when your browser sends Do Not Track.

Agent and API traffic

Fetches of agent files such as /llms.txt, /agents.md and /.well-known/ files, and calls to the API and the MCP endpoint, are counted with a one-day anonymous id and a coarse client type (for example "browser" or "script"). The id is a hash that changes every day. The raw IP address is not stored in analytics.

Your account (optional)

Sign-in is optional and handled by Clerk. If you sign in, Clerk holds your email address and sign-in details. We use your account to sync saved builds, send a shopping list you ask for, and link the ideas and votes you post.

Saved builds

When you're signed out, saved builds live only in your browser's local storage. We don't receive them. When you're signed in, they are stored in Supabase, linked to your account: the title, your idea, the board, status, checklist, part statuses and notes. Only you can see them.

Ideas and votes

On the Ideas page, signed-in people can post ideas and upvote them, one vote per person per idea. We store the idea, the display name you choose (if any), your account id and your votes. Ideas and display names are public and anyone can see them. Your account id and email are not shown.

Email

If you use the contact form, your message and the name and email you choose to add are sent by email through Resend to our inbox. They are kept only in that inbox. If you ask us to email you a shopping list, we send it through Resend to the verified email on your account, and only that address.

Hardware scout

The hardware scout on the home page sends what you type to Anthropic's Claude API to write its suggestions. If you ask for a diagram, the request goes to OpenAI's image API. We don't store what you type there. The Muse planner works on our own server and doesn't send your idea to an AI service.

The npm package

The open-source hackshop-mcp server that runs on your computer sends anonymous usage pings: the tool name, timing, success, version, MCP client name, operating system, Node version and a random install id. It never sends tool inputs, ideas, results or keys. Set HACKSHOP_TELEMETRY=0 (or DO_NOT_TRACK=1) to turn this off.

Server logs

Our host keeps standard request logs (such as IP address, page and time) for a short period for security and debugging.

Services that process data for us

• Vercel: hosts the site, the API and the MCP endpoint.
• Clerk: sign-in and accounts.
• Supabase: saved builds for signed-in people, and ideas and votes.
• Resend: contact form messages and shopping-list emails.
• Google Analytics and PostHog: analytics.
• Anthropic and OpenAI: only for the hardware scout's suggestions and diagrams.

Cookies and local storage

• Local storage keeps your saved builds and your hardware inventory in this browser.
• Analytics cookies and storage from Google Analytics and PostHog tell repeat visits apart.
• Sign-in cookies from Clerk keep you signed in.

We don't use advertising cookies.

How long we keep it

• Saved builds stay until you delete them or ask us to delete your account.
• Ideas and votes stay until you ask us to remove them or we remove them.
• Contact messages stay in our inbox only as long as we need them.
• Analytics data is kept under each analytics provider's retention settings.
• Data in your browser stays until you delete it or clear your browser storage.

Your choices

• Delete any saved build in My builds.
• Clear your browser's site data to remove builds saved only in this browser.
• Turn on Do Not Track or use a blocker to skip analytics.
• Ask us to delete your account, your saved builds or your ideas, or to send you a copy of your data, through the contact page.
• Turn off the npm package's pings with HACKSHOP_TELEMETRY=0.

Children

hackshop is not meant for children under 13, and we don't knowingly collect their information. If you think a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy. When we do, we change the date at the top of this page.

Contact

Questions or requests about your data? Use the contact page.