Privacy Policy
Last updated: 29 September 2026
This page explains what personal data d2build collects, why we collect it, and what you can do about it. We wrote it in plain English on purpose. If anything is unclear, write to privacy@d2build.org.
Who is responsible for your data
d2build (d2build.org) is run by one person, not a company.
Data controller: [Your name], [city], Italy Contact: privacy@d2build.org
d2build is an independent, non-commercial community project. It is not affiliated with Bungie, Inc. or Sony Interactive Entertainment.
What we collect
When you sign the open letter
- Your email address (required, used to confirm your signature and prevent duplicates)
- Your first name or display name (required)
- Your country (optional)
- Roles you declare for yourself, such as developer, designer, tester, translator, or creator (optional)
- Whether you agreed to be contacted again about the campaign (opt-in, off by default)
When you create an account
- Your email address (used to send you the magic link)
- Your display name
- Your country and roles, if you choose to add them
When you use the gallery
- The concepts you publish: title, text, up to three mechanics, phases, and any image you upload
- Earlier versions of a concept when you edit it
- The concepts you like
- Whether you marked a concept or image as created with AI
Automatically, when you visit
- Technical logs: IP address, browser type, time of request, and pages requested. Our hosting providers keep these to run the site securely.
- A session cookie so you stay signed in
- A bot-protection check on forms (Cloudflare Turnstile), which may process your IP address and some browser signals to decide whether you are human
We do not collect payment data. We do not show advertising. We do not use analytics trackers.
Why we use it and on what legal basis
The GDPR requires a legal basis for each use of your data. Here they are.
| What we do | Legal basis |
|---|---|
| Record and confirm your signature on the open letter | Your consent (Art. 6(1)(a) GDPR) |
| Contact you again about the campaign, if you opted in | Your consent (Art. 6(1)(a) GDPR) |
| Create and run your account, publish your concepts, record your likes | Our contract with you, meaning the Terms of Use (Art. 6(1)(b) GDPR) |
| Send you magic link sign-in emails | Our contract with you (Art. 6(1)(b) GDPR) |
| Keep logs, block bots, prevent abuse, moderate content | Our legitimate interest in keeping the site secure and usable (Art. 6(1)(f) GDPR) |
| Answer your requests about your data | Our legal obligations under the GDPR (Art. 6(1)(c) GDPR) |
You can withdraw consent at any time. Withdrawing does not affect anything done before you withdrew.
We do not make automated decisions about you and we do not build profiles.
What we will do with the signatures
The open letter will be delivered to Bungie. Here is exactly what may be shared publicly and with Bungie:
- The total number of signatures
- The first names or display names of people who opted in to be listed
- Statistics by country and by role, for example "310 signatures from Germany" or "85 developers"
Your email address is never shared with Bungie or with anyone else. It stays on our servers and is used only to confirm your signature, prevent duplicates, and, if you opted in, to contact you again.
Who processes your data for us
We do not run our own servers. These companies process data on our behalf, under data processing agreements:
| Provider | What they do for us | Where your data is |
|---|---|---|
| Supabase | Database, sign-in, image storage | European Union (Frankfurt, Germany) |
| Vercel | Hosts the website | Our server code runs in Vercel's Frankfurt region. Vercel's global network may handle requests and short-lived logs outside the EU. Vercel is a US company; transfers are covered by standard contractual clauses. |
| Resend | Sends sign-in and campaign emails | Resend is a US company. Your email address and message content may be processed in the United States under standard contractual clauses. |
| Cloudflare | Turnstile bot protection on forms | Global network. Cloudflare is certified under the EU-US Data Privacy Framework. |
We do not sell your data and we do not share it with anyone beyond these providers, except when the law requires it.
How long we keep it
- Signatures: for the length of the campaign and until the open letter has been delivered to Bungie, plus 12 months. After that we delete the records or keep only anonymous counts and statistics.
- Recontact consent: until you withdraw it or your signature is deleted, whichever comes first.
- Account, concepts, images, likes, and edit history: until you delete your account.
- Technical logs: usually no more than 30 days, unless needed to investigate abuse.
- Emails you exchange with us: up to 24 months.
Concepts are published under the CC BY 4.0 license (see the Terms of Use). Deleting a concept removes it from d2build, but copies that others made before deletion are outside our control.
Your rights
Under the GDPR you can:
- Access: get a copy of the data we hold about you
- Rectification: have wrong data corrected
- Erasure: have your data deleted
- Portability: receive your data in a machine-readable format, such as JSON
- Objection: object to processing based on our legitimate interest
- Restriction: ask us to pause processing while a dispute is resolved
- Withdraw consent: at any time, for your signature and for recontact
- Complain: to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority in the EU country where you live
To use any of these rights, email privacy@d2build.org from the address linked to your signature or account. We answer within 30 days.
How to delete your account or signature
Email privacy@d2build.org from the address you used, with the subject "Delete my account" or "Remove my signature".
Deleting your account removes your profile, your concepts and their edit history, your uploaded images, and your likes. Removing your signature takes you out of the letter count. We confirm by email once done, within 30 days.
Cookies
d2build uses only strictly necessary cookies:
- A session cookie set when you sign in, so you stay signed in. It expires when you sign out or after a period of inactivity.
- Cloudflare Turnstile may set a short-lived cookie or use browser storage to complete its bot check.
There are no advertising cookies, no analytics, and no third-party tracking. Because these cookies are essential, no consent banner is needed and there is nothing to opt out of. If we ever add non-essential cookies, we will ask first.
Minors
d2build is for people aged 16 and over. If you are under 16, please do not sign the letter or create an account. If we learn that we hold data about someone under 16, we delete it.
Security
Your data is stored in the EU, encrypted in transit and at rest. Sign-in uses one-time magic links, so there is no password to steal. Only the site owner has access to the database.
Changes to this policy
We may update this policy when the site changes. The date at the top shows the current version. For significant changes we will post a notice on the site and, if you opted in to be contacted, email you. We will not use your data for a new purpose without telling you first.