Privacy policy

1. Who we are

canitbebuilt (canitbebuilt) issues hardware feasibility assessments. This policy explains what information we process when you use the site.

2. Information we process

• Idea text, optional sketch uploads, and assessment outputs you submit or receive.
• Email address when you verify for a full assessment, join a waitlist, or sign in with Google.
• Account and session data when you sign in (via Auth.js / Google OAuth), including whether reports are public or private.
• Technical signals used for security, rate limiting, and abuse prevention (for example IP address and request metadata).
• API keys and connector assessment inputs when you use the Muse connector. Section 8 describes that flow.

3. Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile in invisible mode to help distinguish humans from bots on form submissions. Turnstile may process browser and network signals for that purpose.

Use of Turnstile is governed by Cloudflare's Turnstile Privacy Addendum, which supplements Cloudflare's privacy policy. By using this site, you acknowledge that Cloudflare may process data as described in that addendum.

4. How we use information

• To run inspections and issue assessments.
• To verify email access for full reports when you are not signed in.
• To show public assessments on the Factory Floor and related surfaces, unless you keep a report private while signed in.
• To operate accounts, prevent abuse, and keep the service running.

5. Sharing

We use service providers that process data on our behalf, including hosting, email delivery, object storage for sketches, authentication, and Cloudflare Turnstile. Public assessments may be visible to anyone with the link or browsing the gallery.

6. Retention

We keep assessment and account data as needed to provide the service, operate the gallery, and meet security and operational needs. You may request deletion of account-linked data by contacting us.

7. Contact

Questions about this policy: reach the operator via the support page.

8. Muse connector and API keys

• Signed-in users can create API keys from My assessments. The full key is shown once. We store a SHA-256 hash, a short prefix, the name you give the key, your account id, the key scopes, and the created, last-used, and revoked times. We do not store the raw key after that response.
• Connector requests send a product idea and may include an audience, a target price, a market, extra notes, and an HTTPS sketch URL. We use those inputs only to run the same assessment engine as the website.
• If a sketch URL is supplied, the server downloads the image, rejects addresses that are not public HTTPS hosts, and stores the file in the same object storage used for site sketches. The connector does not use the browser Turnstile check.
• Connector assessments are stored as private reports for the key owner. They are not added to the public Factory Floor unless you later change visibility from My assessments.
• Normal connector logs record a request id, a redacted key id, the operation, latency, HTTP status, and the assessment id. They do not record the idea text, the sketch, the model output, the raw key, or your email address.
• Assessments and key records follow the same retention as other reports: they are kept so the service can return them, and they are not given a separate automatic expiry. A revoked key stays revoked. You can revoke a key while signed in, and you can ask us to delete account-linked data.
• Connector assessments are sent to the same model provider the site already uses for inspections, and the records live in the same data store as other assessments. Sketch files use the same object storage. A separate operator review key may be configured on the server for connector review. It is not part of a user account.