When you use HobbyHubble, we collect and store the following categories of data in our secure databases:

We use your information exclusively to provide and improve the HobbyHubble application:

• Personal Dashboard & Inventory: Displaying your active projects, calculating backlog completion metrics, tracking supplies inventory, and recording build time.
• Account Identification: Managing your secure login session and protecting your data from unauthorized access by other users.
• Public Builder Showcase (Opt-In): HobbyHubble provides an optional public profile feature (/#showcase/@username). If you toggle your showcase visibility to Public, your completed builds, display name, bio, and WIP build photos become visible to anyone who visits your public link. If toggled to Private (the default), your builds remain strictly private and accessible only to you when logged in.

We do not sell, rent, or trade your personal information. We utilize trusted cloud infrastructure providers strictly to host and deliver the service:

• Google OAuth 2.0 (Google LLC): Used solely to authenticate your identity. HobbyHubble adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Amazon Web Services (AWS): We use Amazon RDS (PostgreSQL) for encrypted database storage, Amazon S3 for durable media file storage, and Amazon EC2 to run the containerized application.
• HobbyLink Japan (Barcode Lookups): When you look up a kit by barcode, our server queries public product catalogues to retrieve box art and specs. No user identity or personal data is transmitted to third-party retailers.

HobbyHubble utilizes a single strictly necessary session cookie (hobbyhubble_session) to maintain your authentication state. This cookie is encrypted with JSON Web Tokens (JWT), marked HttpOnly to prevent script access, and configured with SameSite=Lax and Secure flags.

We do NOT use advertising cookies, third-party tracking pixels, or cross-site analytics trackers.

You retain full ownership of your data at all times:

• Immediate Modification: You can edit or delete any kit, WIP photo, build session, or supply material directly from your workbench at any time.
• Permanent Photo Deletion: When you delete a photo from an item, the corresponding image file is permanently removed from our Amazon S3 storage bucket.
• Account Deletion: If you wish to delete your entire account and all associated kits, photos, and records, you can submit a deletion request to us, and all your records will be purged from our active databases within 14 business days.

We enforce modern industry security practices to safeguard your information, including automated HTTPS/TLS encryption across all network traffic, automated SSL certificate renewal via Let's Encrypt, multi-tenant database isolation, and encrypted RDS storage.