Privacy Policy

This policy describes how Reactopia (https://reactopia.me), operated by Yash Mahajan, handles personal data. It applies to the public website as deployed today.

Last updated: 7 October 2026

Who is responsible

Data controller for this site: Yash Mahajan (Reactopia). Contact: contact page.

Data we collect

Account data (sign-in only): if you authenticate with Google, we receive and store your name, email address, and profile image via OAuth, and persist account records in PostgreSQL (via Prisma) to maintain your session.
Usage and performance data: in production, Vercel Analytics and Speed Insights collect aggregated, anonymized metrics (e.g. page views, performance timings). We do not sell this data.
Hosting logs: Vercel and related infrastructure may log IP addresses, timestamps, URLs, and user-agent strings for security, abuse prevention, and operations.
Content you submit: if you use features that store user-generated data (e.g. directory or profile features), that content is stored as needed to provide the feature. Do not submit sensitive personal data unless the feature requires it.
Browser storage: theme preferences may be stored locally in your browser. Authentication uses session cookies (see Cookie Policy).

Legal bases (EEA/UK users)

Where GDPR or UK GDPR applies, we rely on:

Contract / service: processing needed to provide sign-in and account features you request.
Legitimate interests: securing the site, understanding aggregated usage, and improving performance, balanced against your rights.
Consent: where required for non-essential cookies or future optional features; we will ask before relying on consent.

AI and automated processing

The site does not currently ship AI features that process your personal data or send your content to model providers. If that changes, this policy will be updated before such processing begins, including description of providers and your choices.

Third-party processors

Google: OAuth sign-in.
Vercel: hosting, analytics, and speed insights.
Supabase (PostgreSQL): application database.
Unsplash: imagery for directory features (server-side API use).

Each provider processes data under its own terms and privacy policies. Data may be processed in countries outside your own, with safeguards provided by the vendor where applicable.

Retention

Account data is kept while your account exists. Logs and analytics are retained according to vendor defaults unless a shorter period is configured. You may request deletion of account data via the contact page.

Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability or to withdraw consent. To exercise these rights, contact us via the contact page. You may also lodge a complaint with your local data protection authority.

Children

Reactopia is not directed at children under 13 (or 16 where local law requires). We do not knowingly collect personal data from children. Contact us if you believe a child has provided data.

Changes

Material changes will be posted on this page with an updated "Last updated" date. Continued use after changes constitutes acceptance where permitted by law.