Privacy Policy of HugAI.dev

Last updated: November 12, 2026

1. Data Controller

HugAI.dev (hereinafter, “HugAI”, “the Platform” or “we”) is a project promoted and managed by Sebastián Larrauri, with legal domicile at Mendoza 764, Córdoba, Argentine Republic.

For inquiries related to this Privacy Policy or the processing of personal data, you can contact us at: legal@hugai.dev.

This Policy describes what information we collect, what we use it for, who we share it with, how long we keep it, and what rights you have over your personal data.

2. Scope

This Policy applies to the HugAI.dev website, in all its language versions, and to its tools, functionalities, services, and community participation spaces.

HugAI allows you to explore and use published tools without creating an account. Some participation functionalities, such as voting, commenting, reporting content, proposing initiatives, or contributing, require you to sign in or to verify an email address with a code.

External services linked from the Platform (for example, code repositories or the documentation of each tool) have their own privacy policies, over which HugAI has no control.

3. Information We Collect

Depending on the functionalities you use, we may collect the following categories of information:

3.1. Account Data

HugAI does not use passwords. You can sign in in three ways:

• With your email address: we send you a one-time verification code and a sign-in link. We store your email address and the date it was verified.
• With GitHub or Google: when you authorize access, that provider shares your email address with us and, when available, your name and the address of your profile picture. We do not receive or store your GitHub or Google password.

We also store the profile information you choose to complete:

• Username (required to comment).
• Name (optional). If you signed in with GitHub or Google, we initially fill it in with the name that provider reports, and you can change it.
• Profile picture, when it comes from GitHub or Google.

Our authentication provider also records the date and IP address of sign-ins and other account events, for security purposes.

3.2. Guest Participation

You can vote, propose, or report comments without creating a full account. To do so we request:

• Email address.
• Name or alias, if you choose to provide it.

We send you a six-digit code by email. The action (for example, your vote) is recorded only after you enter the code; until then we store nothing about it. Verifying the code creates a basic account without a username, associated with that email address, so that your votes and proposals are yours and count only once. You can add a username later to comment, or sign in again with the same email.

We do not accept disposable or temporary email addresses. We will not use this mechanism to attribute to you activities associated with an email address that you have not verified.

3.3. Security Check

Before we send a sign-in or verification code, the site runs a security check with Cloudflare Turnstile to tell people apart from automated programs. Turnstile analyzes technical signals of your browser and device (such as the IP address, browser characteristics, and how the page is interacting) and returns a single-use token that we verify. It does not ask you to identify images and it is not used for advertising. That processing is carried out by Cloudflare under its own privacy policy.

3.4. Activity Within the Platform

We record the information needed for the participation features to work:

• Initiatives you proposed and their status changes.
• Your votes (upvote or downvote) and when you cast or changed them.
• Your comments and replies, their category, and their edits.
• Content reports you submit, with the reason you give.
• Time contributions you make, when that functionality is enabled (see 3.7).

Our database does not record which tools or pages you view; aggregated usage measurement is described in 3.6. The Share button only copies the link or opens your device's share function: we do not record when or where you share.

3.5. Technical Information

When you access the site, our hosting provider records technical data for each request, such as:

• IP address.
• Browser type and version.
• Date and time of access.
• Requested pages and resources.
• Technical and security logs.

This data is used to operate, protect, and diagnose the Platform.

3.6. Usage Measurement (Google Analytics)

We use Google Analytics 4 to understand, in aggregate, how the site is used: which pages are visited, from which country or city (approximate), with which type of device and browser, where the visit comes from (for example, a search engine or a link), and how long it lasts. Google Analytics assigns your browser a random identifier stored in cookies (see section 7).

We use it only to improve the Platform. We do not use advertising features, we do not send Google your email address or your account identifier, and we do not combine this data with your activity in the community. Google Analytics 4 does not log or store IP addresses.

HugAI does not show advertising or use advertising pixels.

3.7. Contributions and Payments

When contributions are enabled, payments will be processed through PayPal. HugAI does not receive or store your card or bank account details. For each contribution we store:

• The option chosen, the time contributed, the amount, and the currency.
• The initiative or the General fund it goes to.
• The order and capture identifiers reported by PayPal.
• Your email address and name, when PayPal reports them, to associate the contribution with your account and handle inquiries or refunds.

3.8. Communications

If you contact us, we may retain your email address and the content of your communication to reply to you and keep a record of the inquiry.

4. Purposes of Processing

We use personal data to:

• Create and manage accounts, and let you sign in.
• Provide access to HugAI functionalities.
• Record and manage votes, comments, proposals, reports, and contributions.
• Display participation publicly when the functionality requires it (see section 5).
• Calculate aggregated indicators, such as net votes, contributed time, and the “Trending” order of lists.
• Let you vote, propose, or report comments without a full account, once you have verified your email address.
• Measure, in aggregate, how the site is used in order to improve it.
• Moderate content and handle reports.
• Prevent abuse, spam, fraud, automated sign-ups, and manipulation of votes or metrics.
• Protect the security and availability of the services.
• Respond to inquiries and requests.
• Comply with legal obligations, including accounting and tax obligations related to contributions.

We do not commercialize personal data or sell it to third parties.

4.1. Automated Decisions

Some Platform rules are applied automatically:

• The “Trending” order is calculated from recent activity (votes, comments, and contributed time over the last fourteen days). It is only a sort order for lists.
• A comment that receives three (3) open reports is hidden automatically until a maintainer reviews it and decides whether to keep, hide, or delete it.
• Participation rules (for example, that commenting requires a username and a vote) are checked automatically.
• The security check (section 3.3) and the rejection of disposable email addresses are automatic. If you cannot pass them, you can write to us.

These rules do not produce legal effects on you. You can request a review of a moderation decision by writing to legal@hugai.dev.

5. Visibility of Information

HugAI is a community platform. The following information is public:

• Your profile: username, name, profile picture (when it comes from GitHub or Google), and whether you have a maintainer role.
• The initiatives you proposed, with your name as the proposer.
• Your comments and replies, with your name and the date. If you delete a comment, it is shown as “[deleted]” and its text is erased.
• Contributor credits on a tool, when applicable.
• The aggregated indicators of each initiative: net votes, time contributed by the community, and number of comments.

The following information is private, and only you and HugAI administrators can see it:

• Your email address.
• Your individual votes: only the totals are shown publicly.
• The reports you submitted and their reason.
• Your individual contributions, unless you choose to show them publicly.

Before publishing information, avoid including personal data, trade secrets, credentials, confidential information, or third-party data.

6. Legal Basis and Consent

Data processing is carried out in accordance with Law 25.326, its regulations, and other applicable Argentine legislation.

Where applicable, we will request your free, express, and informed consent. In other cases, processing may be necessary to provide the functionalities you requested, comply with legal obligations, or protect the security and legitimate interests linked to the operation of the Platform, within the limits permitted by law.

You may withdraw your consent when applicable, without affecting the lawfulness of the processing carried out previously.

7. Cookies and Similar Technologies

HugAI uses the following cookies:

Necessary

Measurement (Google Analytics)

The security check (section 3.3) runs in a frame served by Cloudflare (challenges.cloudflare.com), which may use its own technical storage under Cloudflare's policy. We do not use advertising cookies. The site's fonts are served from our own servers.

When you first visit the site we show a notice informing you that we use cookies, with a link to this Policy. The notice is informational: closing it only stores the hugai_cookie_notice cookie.

You can manage or block cookies through your browser settings. If you block the session cookies you will not be able to sign in; if you block the language cookie, the site will choose the language based on your browser settings; if you block the Google Analytics cookies, the site works normally. You can also install Google's opt-out browser add-on for Google Analytics (tools.google.com/dlpage/gaoptout).

8. Providers and Third Parties

To operate HugAI we use the following providers, which access personal data only to the extent necessary to provide their services:

The Platform also includes links to external services, such as code repositories or the documentation of each tool. The use of those services is subject to their own terms and policies.

We do not share personal data with third parties for their own commercial purposes, unless there is a valid legal basis or your consent when required.

9. International Transfers

Our providers process and store information outside the Argentine Republic. In particular, HugAI's database is hosted on Supabase servers located in the United States, and Google (Google Analytics) and Cloudflare (Turnstile) may process data in the United States and other countries.

We endeavor to ensure that these international transfers are carried out in accordance with the requirements and safeguards established by Law 25.326 and its regulations.

10. Data Retention

We retain personal data for the time necessary to fulfill the purposes described in this Policy. In particular:

• Accounts that were never verified: deleted automatically after thirty (30) days.
• Unfinished guest actions: if you do not enter the code, the action is never recorded.
• Votes: if you withdraw a vote, it is deleted.
• Comments deleted by their author: the text is erased and only the record is kept, shown as “[deleted]”, so the conversation is not broken.
• Reports and moderation decisions: kept as a record of community moderation.
• Contributions: kept for the period required by applicable accounting and tax rules.
• Authentication and technical logs: according to our providers' retention periods.
• Google Analytics data: according to the retention configured in Google Analytics, no longer than fourteen (14) months; aggregated reports may be kept longer.

When the data is no longer necessary, it will be deleted, anonymized, or blocked, as appropriate.

Certain public records of initiatives, comments, contributions, or community activity may be retained as part of the Platform's history, even when an account is closed, provided there is a legitimate justification and the rights of the data subjects are respected. In those cases, we may unlink them from your name.

11. Security

We adopt reasonable technical and organizational measures to protect information against unauthorized access, loss, alteration, disclosure, or destruction, including: encrypted connections (HTTPS), passwordless sign-in, a security check against automated programs, database-level access rules that limit what each user can read or modify, and logging of administrative actions.

However, no computer system or data transmission over the Internet can guarantee absolute security. We cannot ensure that the Platform is free from vulnerabilities or interruptions.

12. Rights of Data Subjects

In accordance with Law 25.326, you may exercise the following rights:

• Access: know what personal data we hold about you and how we process it. Part of this information is available in your account, under “Your activity”.
• Rectification: request the correction of inaccurate or incomplete information. You can change your username and name yourself from your account.
• Updating: request the updating of your data.
• Deletion: request the deletion of your data or your account, when legally applicable.
• Withdrawal of consent: when processing is based on your consent.

To exercise these rights, write to legal@hugai.dev from the email address associated with your account, stating your request. If you write from another address, we may ask for additional information to verify your identity.

The right of access must be addressed within ten (10) calendar days of receiving the request. Requests for rectification, updating, or deletion must be addressed within five (5) business days, in accordance with the timeframes established by applicable legislation.

Deletion may be limited when we must retain certain records due to legal obligations, security, fraud prevention, or legitimate preservation of the community's public history. In such cases, we will explain the reason to you.

The Agency for Access to Public Information (Agencia de Acceso a la Información Pública), in its capacity as the supervisory authority of Law 25.326, receives complaints and claims related to non-compliance with personal data protection regulations.

13. Minors' Data

HugAI is not directed at minors under eighteen (18) years of age. We do not deliberately request personal information from minors to create accounts or participate in the community.

If we detect that data from a minor has been collected without the corresponding legal conditions, we may take measures to delete it or restrict its processing.

14. Changes to This Policy

We may update this Policy to reflect legal, technical, or operational changes, for example when new functionalities such as contributions are enabled.

The current version will be available on HugAI.dev, indicating the date of its last update. When changes are significant, we will endeavor to inform users through reasonable means.

This Policy is published in Spanish and English. In the event of any discrepancy between the two versions, the Spanish version prevails.

15. Contact

For inquiries, requests, or claims regarding privacy and personal data:

Data Controller: HugAI.dev – Sebastián Larrauri
Email: legal@hugai.dev
Legal domicile: Mendoza 764, Córdoba, Argentina.