Privacy Policy
Last updated: March 2026
Introduction
MergeBadger ("we", "our", or "the Service") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your choices. By using MergeBadger, you agree to this policy. If you do not agree, please do not use the Service.
Data We Collect
We collect: (1) Account data — email address, name (if you sign in with Google), and password hash (if you use email/password); (2) Content and usage data — projects, designs, uploaded data, and how you use the Service; (3) Technical data — IP address, browser type, device information, and log data necessary to run the Service; (4) Analytics data — anonymized or pseudonymized page views and usage patterns via our analytics provider (see Analytics). We do not sell your personal data.
How We Collect Data
We collect data when you register, sign in, create or edit projects, upload data, or contact us. We also collect technical and analytics data automatically when you use the website. Sign-in may use Google OAuth (optional) or email and password; see Login & Authentication for details.
Login & Authentication
You can create an account using email and password, or sign in with Google OAuth. Email/password: we store your email and a hashed password. Google OAuth: we receive your email and name from Google when you choose "Sign in with Google"; we do not receive or store your Google password. Using Google is optional; you can use only email and password if you prefer. Authentication state may be stored in cookies or similar technology to keep you signed in.
Hosting & Infrastructure
The website and app are hosted on Netlify. Static assets (e.g. images, scripts) are delivered via Netlify's CDN. Netlify may process and store requests (including IP address and request metadata) to serve and secure the site. Netlify acts as our infrastructure provider under their privacy and data processing terms. Our backend and database may be hosted on separate services; your account and project data are processed there to provide the Service.
Analytics
We use Umami, a privacy-focused analytics tool that we self-host. Umami helps us understand how many people visit the site and which pages they view. It is configured to collect minimal data (e.g. page URL, referrer, browser type) and does not use cookies by default. We do not use Umami to track individuals across sessions or to build profiles. Data stays in our own analytics instance and is not shared with third-party ad or tracking networks.
How We Use Your Data
We use your data to: provide and operate the Service; authenticate you and manage your account; store and process your projects and designs; improve the Service and fix issues; send necessary service-related messages (e.g. password reset); understand usage via analytics; and comply with law or protect rights and safety. We do not use your content for advertising or sell it to third parties.
Data Retention
We retain your account and project data for as long as your account is active. If you delete your account or request deletion, we will delete or anonymize your personal data in line with our retention practices, except where we must keep it for legal or legitimate operational reasons. Analytics data may be retained in aggregated or anonymized form.
Your Rights
Depending on your location, you may have the right to: access your personal data; correct inaccurate data; request deletion; request a copy of your data (portability); object to or restrict certain processing; and withdraw consent where processing is consent-based. You can update account details in settings and delete your account. For other requests or to opt out of analytics where possible, contact us. If you are in the EEA/UK, you may also have the right to lodge a complaint with a supervisory authority.
Security
We use reasonable technical and organizational measures to protect your data, including encryption in transit (e.g. HTTPS) and, where applicable, at rest. No system is completely secure; we cannot guarantee absolute security. You are responsible for keeping your password and account secure.
Children
The Service is not directed at children under 16 (or the applicable age in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it.
International Transfers
Your data may be processed in countries other than your own, including by our hosting and infrastructure providers (e.g. Netlify, and where applicable Google). Where we transfer data from the EEA/UK to countries that have not been deemed to provide adequate protection, we rely on appropriate safeguards (e.g. standard contractual clauses) as required by law.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. For material changes, we may notify you by email or a notice in the Service. Continued use after the effective date constitutes acceptance of the updated policy.
Contact
For privacy-related questions, to exercise your rights, or to contact our data protection contact, use the contact link in the footer or the contact details provided in the Service.