This page describes what makefx stores about the people who use it, where that data lives, how long it is kept and how to have it removed. It is written from the code that runs the service, and it changes when the code does.
What is stored, and where
Account. Signing in with Google creates an account holding the Google account identifier, the email address, the display name and the profile picture Google shares. Nothing else about the Google account is requested or kept. Accounts live in a Cloudflare D1 database.
Sessions. A browser sign-in creates a session record on the server and sets an HttpOnly cookie that names it. The cookie lasts thirty days. Signing out ends the session.
Connected agents. When an agent or an application asks for access, the consent it is given is recorded as a grant naming the client, the scopes approved and the times it was created and last used. Refresh tokens belong to that grant. Authorization codes and pending sign-ins are held for a few minutes in Cloudflare KV and expire on their own. Grants can be reviewed and revoked from your account; revoking one invalidates every token issued under it.
Spaces and assets. A space holds its assets (name, kind, status, recipe, position, tags, note, traits, star, who created it and when) in a per-space SQLite store on Cloudflare. Deleting an asset or a space is a soft delete that keeps the row marked with who deleted it and when.
Credit purchases. Stripe receives the account billing name, address, email and applicable tax ID to calculate tax and issue invoices. Makefx keeps the account, initiating user or agent, purchase amounts, credit ledger, Stripe references and hashes used to prevent repeated payments in Cloudflare D1. It does not store card data or raw payment tokens. Financial records are retained for accounting and refund reconciliation, including after account deletion.
Request logs. Cloudflare records each request (address, URL, user agent, timing) for operating the service and is the processor for that data. Logs are kept for the period Cloudflare's observability product keeps them and are not used for profiling.
What is not collected
There are no analytics scripts, advertising networks or third-party tags on any page. The content security policy allows scripts only from this origin, so nothing else can load. Email addresses are used to sign you in, answer your messages and deliver purchase and billing communications.
Who else sees data
Google, to sign you in; Cloudflare, which hosts the service and stores the data above; Stripe, which processes credit purchases and their billing documents. Agents you connect see only what the scopes you approved allow, and only while the grant stands.
Your choices
Sign out from your account. Revoke a connected agent from the same place. To export or delete your account and everything held under it, contact krasnoperov.me and name the address on the account so the request can be matched to it.
Changes
The date at the top of this page's entry in the sitemap is when it last changed. Questions about anything here go to the contact page.