Made Of

Everything is made of something.
Privacy

What we collect, and what we don’t.

You can use most of Made Of without an account. If you sign in, we keep only what’s needed to run the site. No ads, no tracking across other sites, no selling data.

What we aim for

  • No child data. Accounts are 13+ (16+ in the EU and UK). We don’t enable session replay, and we never set identifying properties for anyone who might be a child.
  • Minimum necessary. We only collect what’s needed to run the site.
  • No ads, no retargeting. Made Of is free because of family and educator plans and sponsors, not advertising.
  • Analytics without identity. If we identify you to analytics at all, it’s by an opaque user id — never email or name.

What we store when you have an account

  • Email address, so we can send you sign-in links.
  • Sign-in sessions, which are rotating tokens stored in a cookie and in our database. We also keep the IP address and browser user-agent for the session, to help you spot unauthorised sign-ins.
  • Your plan (free or paid), and — when paid plans open — a Stripe customer id so billing works.
  • Your saved progress: daily streaks, pinned items and crafting state. Tied to your account id, not your email.

Services we rely on

  • Railway hosts the app and database (US region).
  • Cloudflare sits in front for caching and bot protection.
  • Resend sends your sign-in email. They see your email address and the message, and keep delivery logs.
  • Stripe will handle payments when paid plans open. We never see your card details.
  • PostHog handles product analytics. We identify you to PostHog by your Made Of user id only, never your email.

Deleting your account

Go to your account page and press “Delete account”. We remove your email, your sessions, your saved progress and (when billing is live) your Stripe link. Deletion is immediate.

Anonymous counts (for example, how many people solved today’s puzzle) are kept, because they can’t be tied back to you.

Your rights

You can ask us what we hold about you, correct it, or delete it — the account page covers the common case. For anything else (including GDPR/UK data requests), email us and we’ll reply within 30 days.

Last updated: 2026-11-01.