Privacy policy
This policy explains which personal data FidgetMaker processes when you use this website and the FidgetMaker app, why, and which rights you have under the General Data Protection Regulation (GDPR, in Germany: DSGVO). Last updated: 22 August 2026.
1. Controller
The controller responsible for data processing on this site is the operator of FidgetMaker (see the Imprint). Contact for all privacy matters: [email protected].
2. What we process, and why
Visiting the site
When you open a page, our hosting provider records technical access data: IP address, date and time, the page requested, the referring page, browser and operating system. This is needed to deliver the site, keep it secure and find errors. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, secure site). Access logs are kept only as long as needed for security and error analysis.
Account
If you create an account, we store your email address, your password (only as a hash, handled by our authentication provider), your account role and sign-in times. Purpose: signing you in and providing the app. Legal basis: Art. 6(1)(b) GDPR (providing the service you asked for). Kept until you delete your account.
Images and generated files
Images you upload are processed to generate your fidget toy and stored with your account so you can come back to your toys; the generated files are stored the same way. They are used for nothing else: not shared, not sold, not used to train AI models. Legal basis: Art. 6(1)(b) GDPR. Kept until you delete them or your account.
Optional AI helpers
Some optional tools (for example turning a photo into a cartoon) send the image you choose to process to a third-party AI provider (OpenAI) only when you trigger that tool. The image is used solely to produce your result; under the provider's API terms it is not used to train their models. Legal basis: Art. 6(1)(b) GDPR.
Launch updates
If you leave your email address to be notified about the launch, we store it for that purpose only. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time by emailing us; the address is then deleted, and in any case after the campaign.
Contacting us
When you email us we process your address and message to answer you. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) where your request concerns a contract. Deleted once the matter is settled and no retention duty applies.
3. Cookies
The site uses only technically necessary cookies: the session cookies of our authentication provider that keep you signed in. There are no analytics, advertising or tracking cookies and no tracking pixels, which is why there is no cookie banner. Legal basis: § 25(2) TDDDG together with Art. 6(1)(f) GDPR.
4. Service providers
- Supabase provides authentication, the database and file storage.
- Railway hosts the app and keeps the access logs described above.
These providers process data on our behalf under data processing agreements (Art. 28 GDPR). Where processing takes place outside the EU or EEA (for example in the USA), it rests on the EU standard contractual clauses or, where available, the EU-US Data Privacy Framework. Fonts are served from our own server; no request goes to Google Fonts or any other font service.
Links to MakerWorld (Bambu Lab) lead to an external site with its own privacy policy. Nothing is sent to MakerWorld before you click such a link.
5. Payments
No payments are processed on this site at the moment. Pledges for the crowdfunding campaign are handled on MakerWorld under its own terms and privacy policy.
6. Your rights
- Access to the data we hold about you (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16).
- Erasure (Art. 17) and restriction of processing (Art. 18).
- Data portability (Art. 20).
- Objection to processing based on legitimate interest (Art. 21).
- Withdrawal of consent at any time, with effect for the future (Art. 7(3)).
- The right to lodge a complaint with a supervisory authority, in Germany the data protection authority of your federal state.
To exercise any of these rights, or to have your account and all associated data deleted, email [email protected].
7. Security, children, changes
All traffic is encrypted (TLS) and access to stored data is limited to what running the service requires. The site is not directed at children under 16 and we do not knowingly collect their data. We may update this policy when the service changes; the current version is always the one on this page.