Who is responsible
Identik is an independently operated catalog of branding and design work. In this policy, “we” and “us” refer to the operator of Identik, who determines why and how personal information is processed for this service. You can contact the operator at hello@identik.design.
This policy covers visitors, account holders, people who contact us, and individuals identified in catalog entries. You can browse and search without creating an account. An account lets you save projects and shots as bookmarks.
Information we handle
- Account and sign-in information: your email address, optional name, account identifier, creation and update dates, email verification status, sessions, and sign-in or email-change records.
- Google sign-in: if you choose Google, we receive your account identifier, email address and verification status, name, and profile image URL where supplied, together with authentication tokens. The profile image URL is stored with your account even though Identik does not display an avatar or offer profile image uploads. We do not request access to your Gmail messages, contacts, or files.
- Passkeys: credential identifiers, public keys, security counters, and information about the credential type, backup status, and supported connection methods. Your fingerprint, face scan, device PIN, and the private key used by your passkey are not sent to Identik.
- Bookmarks: the projects and shots you save and when you save them, linked to your account. Your bookmarks and account profile are not published as part of the catalog.
- Correspondence: your email address, message, attachments, and any information you provide when asking for help, requesting deletion, or reporting a content or copyright concern.
- Technical and usage information: IP address, request time, requested pages and searches, referring page, browser and device information, and error and performance information. The website and its providers handle this information when your browser makes requests. Abuse prevention can temporarily associate an IP address with an account identifier and request timestamps.
- Public catalog information: studio and project names, credits, source links, images, videos, and descriptive tags obtained from public studio websites and other public portfolio or media sources, and maintained by the operator. A name, credit, or image in this material may identify an individual.
An email address or supported sign-in credential is needed for account features. A display name is optional. If you choose not to create an account, you can still use the public catalog.
Why we use it
- Provide account features: authenticate you, manage your profile and passkeys, send requested sign-in and email-change messages, and retrieve your bookmarks across visits and devices.
- Operate and protect the website: deliver pages and media, limit abusive requests, diagnose errors, and measure traffic and performance.
- Maintain the catalog: organize, display, and correct design references and their attribution.
- Handle requests and obligations: answer correspondence, verify account or rightsholder requests, resolve disputes, and comply with applicable legal requirements.
Where applicable law requires a legal basis, we rely on performance of the service agreement for requested account features; legitimate interests in maintaining a useful catalog, a secure and reliable website, and responding to correspondence; and compliance with legal obligations where relevant. Those interests remain subject to the rights and protections required by applicable law. Any processing that requires consent must be covered by a separate request for it; this policy itself is not consent.
We do not sell account information or bookmarks, send marketing newsletters, or use account information or bookmarks to build advertising profiles. External media providers may use information they receive for their own purposes, as explained below.
Analytics and error monitoring
Cloudflare Web Analytics uses a script that runs as pages load to report page views, referring pages, browser and device categories, and loading and interaction performance. According to Cloudflare's explanation of its analytics beacon, it does not read or write cookies or other browser storage. Cloudflare receives your IP address as part of the network request, then discards it at the receiving data center without storing it in its core analytics databases or logs.
Sentry receives application errors, sampled browser performance traces, and server diagnostics. An error report can include the affected page, browser and operating system, timing information, and recent navigation, click, or network events that help explain the error. We remove the user profile and request bodies, headers, cookies, and query strings from the main event fields and filter recognized emails and credentials. Filtering reduces the information sent, but technical context can still contain personal information. Sentry also receives the network requests used to deliver these reports.
Session Replay is disabled. Diagnostic event details are not a recording of your screen or an entire browsing session.
External media and links
Some images, video previews, and players are loaded directly from external hosts. These can include Vimeo, YouTube, Kinescope, Mux, and hosts used by a featured studio. Media can load or start playing automatically as you browse, so a provider may receive a request before you click a play button.
Such requests disclose your IP address and may include a referring page, browser information, and the media being viewed. A player may read or set its own cookies, recognize an existing account with that provider, and use information for measurement, personalization, or advertising under its own practices. Our choices of media to embed and the provider's subsequent use of information are distinct parts of this processing.
For details, see the privacy policies of Google, including YouTube, Vimeo, and Mux, or the relevant host. Following an external link also takes you to a service with its own terms and privacy practices.
Who receives information
- Vercel — website hosting: serves pages and runs the application, processing requests and the account or technical information needed to respond to them.
- Prisma Postgres — database hosting: stores account profiles, linked sign-in accounts, sessions, passkeys, verification records, bookmarks, and catalog information.
- Cloudflare — media and analytics: R2 stores and delivers catalog images and videos; Web Analytics receives the usage and performance information described above.
- Resend — transactional email: receives recipient addresses and the content of sign-in and account confirmation emails, and handles delivery records. Messages sent to our contact address are also handled by the email services used to send and receive them.
- Sentry — diagnostics: processes errors, performance information, and diagnostic logs as described above.
- Upstash — abuse prevention: when available, Redis holds temporary request counters and identifiers based on an IP address or account.
- Google — optional sign-in: authenticates you and shares the basic profile, account identifier, and tokens used to link your Google account to Identik.
These services receive information for the functions listed. Their own notices describe additional handling of service and security information. Using a provider does not remove our responsibility for the personal information we ask it to process.
During catalog preparation, an external AI service may receive public catalog names, source links, tags, and preview images to suggest descriptive tags. Account records and bookmarks are not included in that request. We do not use this feature to make decisions about visitors or their access to the service.
We may disclose relevant information when required by law or where necessary to investigate abuse, establish or defend legal claims, or protect someone's rights or safety, subject to applicable law.
Processing across borders
Identik uses cloud infrastructure operated by the providers listed above. Our account database is hosted by Prisma, catalog media is stored in Cloudflare R2, and our Sentry diagnostics project uses its United States region. Website delivery, media delivery, and analytics use networks that can process requests in more than one country.
The operator also keeps database backups, which can include account information, separately from the live cloud database. Support and recovery can involve access from the operator's location. Storage and access may therefore involve countries other than the one where you live. A provider's headquarters does not identify every processing location, and information is not restricted to one country. Privacy protections and government access rules can differ between countries.
You can contact us for information about a particular provider or transfer, including any applicable safeguards. Where the law requires a transfer mechanism or other protection, that requirement applies independently of this notice; simply using Identik is not consent to an otherwise restricted transfer.
How long information is kept
- Accounts and bookmarks: remain while your account exists, unless you remove an individual bookmark or passkey or request account deletion. Accounts are not automatically deleted just because you stop visiting.
- Authentication: email sign-in links are valid for up to 24 hours, email-change links for one hour, and sessions generally for 30 days, with expiry renewed during continued use. Links can become invalid earlier after use, and signing out ends the current session. Expiry prevents further use; it does not mean every associated database record is immediately erased. Some expired authentication records can remain stored.
- Abuse prevention: the temporary rate-limit records are set to expire about two minutes after the most recent request added to the counter.
- Correspondence: is kept for handling the request and any related follow-up, dispute, or legal requirement.
- Catalog information: is kept while the entry remains part of the catalog or is needed for a correction, rights request, or related dispute.
Hosting logs, diagnostic events, email delivery records, analytics, and provider backups have separate retention settings. Their retention depends on the provider and the need to recover the service, investigate an incident, or meet a legal obligation. Contact us if you need the current period for a particular type of record.
Database backups kept by the operator can also contain account information. They are managed separately and are not automatically erased when an account is deleted from the live database. We consider these copies when handling a deletion request and explain any information that needs to be retained and why.
Your choices and rights
Account settings let you change your name, request an email change, and add or remove passkeys. You can also remove bookmarks and sign out. For access to your personal information, a copy of your data, correction, or account deletion, email hello@identik.design. The same address accepts privacy requests about an individual named or shown in the catalog, whether or not that individual has an account.
When possible, write from your account email and describe the request or relevant page. We may ask for information reasonably needed to verify your identity or authority. Never send passwords or sign-in links. Please do not send identity documents unless we explain why additional verification is necessary and what information is needed.
When we complete an account deletion request, we remove the account and its linked bookmarks, passkeys, and sign-in records from the live account system, except for information we must retain for a legal obligation or a specific unresolved claim. Clearing your browser, signing out, or disconnecting Identik in your Google settings does not itself delete your Identik account. Account deletion also does not automatically remove independently sourced public catalog information.
Depending on the law that applies, you may also have rights to portability, restriction, objection, withdrawal of consent, and a complaint to a data protection authority. Withdrawal does not affect processing that was lawful before it. We will respond within the period required by applicable law and explain any restriction or refusal. Contacting us does not prevent you from using a statutory complaint or other remedy.
Security
We use HTTPS for the public website, access controls for account and administrative functions, and filtering of sensitive diagnostic fields. These measures reduce risk, but no online service can guarantee absolute security. Contact us if you suspect unauthorized access to your account or another security problem.
Children
Identik is a design reference service for a general audience and is not directed at children. If you believe a child has provided personal information in circumstances requiring a parent's permission or another protection, contact us so we can investigate and take the action required by applicable law.
Changes to this policy
We will update this page and its date when our practices change. Where applicable law requires additional notice or consent for a change, we will provide that notice or request consent before carrying out the affected processing. You can reach us about this policy at hello@identik.design.