Privacy policy
Last updated 5 October 2026
Nubmark is a hobby project for browsing Gunpla kits and keeping track of the ones you build. This page explains what personal data it handles and what your rights are. It is written to be read, not to hide anything.
In short
- We collect only what an account needs: your email, a password, a display name, and whatever ratings and lists you choose to add.
- No advertising and no tracking cookies. The site counts page views with Cloudflare's cookie-free analytics, which doesn't build a profile of you.
- Your ratings, notes and lists are private unless you turn on sharing for a list.
- We never sell your data.
- You can ask to see, correct, export or delete your data at any time.
Who is responsible
Paul Arce runs Nubmark and is the controller of your personal data. Write to privacy@nubmark.com for anything in this policy.
What we collect
- Account details: your email address and a password. The password is stored only as a salted hash by our sign-in provider, so nobody, including us, can read it.
- A display name. We generate a random one when you sign up (like "Cobalt Nipper 4821"). You can change it on the Account page. Don't put your real name in it unless you want it public.
- What you add: ratings (six scores and optional notes), and collection, wishlist, backlog and in-progress entries with their status, an optional completion date and optional notes.
- Sharing settings: whether your wishlist or collection has a public link.
- Technical data: to keep you signed in, your browser stores a session token in its local storage. Our host also sees your IP address and request details in ordinary server logs, which are needed to deliver the site and keep it secure.
We don't collect payment details, your location, your contacts, or anything from your device beyond what is listed above.
What is public and what is private
- Private to you: each rating you give with its notes, and your collection and wishlist entries with their notes. Only you can read them.
- Public, as averages only: the community average for each kit is calculated from everyone's ratings and shows no individual scores.
- Public if you choose: if you share a wishlist or collection, anyone with its link can see your display name, the kits, their status and completion dates. Notes are never included. Turn sharing off at any time and the link stops working.
- Your display name is stored in a public profile record, separate from your email address, which is never shown to other users.
Why we use it, and our legal basis
- To run your account and the features you use, such as sign-in, ratings and lists (necessary to provide the service you asked for).
- To send the emails an account needs: the address confirmation and password reset messages (also necessary to provide the service). We send no marketing email.
- To keep the site secure and prevent abuse, such as rate limiting, blocking offensive display names, and a short automated check when you sign up, sign in or ask for a password reset to tell people from bots (our legitimate interest in running a safe service).
- To watch overall traffic, such as how many requests come from each country, so we can spot unusual spikes. These come from our host's analytics: server-side counts, plus a small Cloudflare Web Analytics script that reports page views and how fast pages load. It uses no cookies and doesn't track individual visitors or follow you across sites (our legitimate interest in running a safe service and understanding how it is used).
Who handles your data for us
These companies process data on our behalf, only to provide their service to us:
- Supabase: our database and sign-in. Your account, ratings and lists are stored in its US East (Virginia) region.
- Cloudflare: hosts the website, our domain names and the DNS, and serves pages from servers around the world. It sees visitors' IP addresses. It also runs Cloudflare Web Analytics for us, which reports page views and page speed.
- Resend: sends our account emails, so it receives your email address and the message.
- Cloudflare Turnstile: the bot check on sign-up, sign-in and password reset. While it runs, Cloudflare receives your IP address and some information about your browser, and returns a result to us. We don't use it for anything else.
We don't sell your data or share it for advertising. We would disclose data only if the law requires it.
Transfers outside the UK and EU
Our providers are based in, or run servers in, the United States. When personal data moves out of the UK or EEA, we rely on the safeguards those providers offer, such as standard contractual clauses.
Cookies and local storage
Nubmark sets no cookies of its own and uses no advertising trackers. Its page-view analytics, Cloudflare Web Analytics, work without cookies. The only thing it stores in your browser is the sign-in session described above, which the site needs in order to work once you sign in. Our host may set a strictly necessary security cookie. The bot check on the sign-up, sign-in and password-reset forms is run by Cloudflare Turnstile, which works for security and not for advertising or tracking you across sites. Because nothing optional is stored, there is no cookie banner.
Links to other sites
Kit pages link to retailers and to Bandai's site. Some retailer links may be affiliate links, and we may earn a commission on qualifying purchases at no extra cost to you. Those sites have their own privacy policies, and we don't give them your account details.
How long we keep it
We keep your account data until you delete your account. Deleting it on the Account page takes effect immediately and removes your account, ratings, notes, lists and share links for good. Backups held by our database provider can keep deleted data for a short time before they are overwritten. Server logs are kept by our host for the period it sets.
Your rights
Under the GDPR and UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and send it to you in a portable format. You can change your display name and password, and delete your account, yourself on the Account page. For anything else, such as a copy of your data, email privacy@nubmark.com from the address on the account. We will reply within one month, usually much sooner.
If you think we have handled your data wrongly, you can complain to your local data protection authority, such as the ICO in the UK. We would like the chance to fix it first.
If you live in California, the same requests apply. We don't sell or share your personal information for advertising.
Children
Nubmark isn't aimed at children under 16, and we don't knowingly collect their data. If you believe a child has an account, email us and we will delete it.
Security
The site is served over HTTPS, passwords are hashed, and the database only lets you read and change your own private rows. No service is perfectly secure, so pick a password you don't use anywhere else.
Changes to this policy
If we change what we collect or who handles it, we will update this page and the date at the top. Nubmark is an unofficial fan project and is not affiliated with Bandai, Sotsu or Sunrise.