Privacy Policy

• Account details: your email address, password (stored scrambled by our sign-in provider; we can’t read it), and, if you sign in with GitHub or Google, the name, email and picture they share with us.
• Age confirmation: you enter your date of birth so we can confirm you’re 18 or older. We keep only the fact that you confirmed, and when; we don’t store your birthday.
• Your profile: name, picture, major, discipline, graduation year, bio, website and GitHub link, and your settings.
• What you post: projects, photos, videos, CAD and other files, code, build-log updates, comments, likes, endorsements, squads, bounties, applications, delivered work, and messages.
• Verification: if you verify a school or work email, we send it a code and keep its domain (for example, school.edu) on your badge. For a faculty badge we also keep the school email, the faculty-page link and the title you give us, for our review.
• Endorsement requests: if you ask someone to endorse your project, we store the name and email you enter so we can send them the request. We email them once, about that request only.
• Technical data: our hosting and security providers process your IP address, browser type and similar request data to serve the site and block bots and abuse.

• To run Banana: your account, your portfolio, endorsements, squads, bounties and messages.
• To show badges and weigh endorsements from verified professors and companies.
• To send you email you can control: sign-in and password links, verification codes, activity notifications and a weekly summary.
• To keep Banana safe: stopping spam, fake accounts and misuse, and enforcing our Terms.

We don’t sell your personal information, share it for advertising, or use it to train AI models.

• Signed-in members can see your profile, projects and endorsements, unless you set your portfolio to private in Settings.
• Your email address stays hidden from other members unless you turn on “Show my email on my profile” in Settings. If you send an endorsement request, the person you ask sees your email so they can reply.
• Your resume page can be opened by anyone with the link if you allow it in Settings.
• Messages, squad chat, bounty applications and private bounty files are visible only to the people involved (and, for disputes, our admins).

These companies process data for us, only to provide their service:

• Supabase: database, sign-in and file storage.
• Vercel: hosting the website.
• Resend: sending email.
• Cloudflare: our domain, the Turnstile bot check on sign-in, and forwarding mail sent to hello@bananabuild.com.
• GitHub and Google: only if you choose to sign in with them.

We may also share information if the law requires it, or to protect people from harm or fraud.

We use your browser’s storage to keep you signed in and remember small preferences (for example, that you’ve seen the walkthrough). Cloudflare Turnstile may set what it needs to tell people from bots. We don’t use advertising or cross-site tracking cookies.

• Edit your profile and posts, make your portfolio private, and turn emails on or off, all in Settings.
• Every email has a one-click unsubscribe link. Sign-in, password and verification emails are always sent because the site needs them.
• Delete your account in Settings → Security. That permanently deletes your profile, projects, files, messages and endorsements. Copies in our providers’ backups are cleared as those backups expire.
• To get a copy of your data or ask anything else, email hello@bananabuild.com.

Banana is only for people 18 and older. If we learn that someone under 18 has an account, we delete it.

We use access rules on every table, encrypted connections, and keep server keys out of the browser. No system is perfectly secure; if something goes wrong that affects your data, we’ll tell you.

If we change this policy, we’ll update the date at the top. For important changes, we’ll tell signed-in members on the site or by email before they take effect.