MostlyPCB Privacy Policy

1. Information We Collect

Waitlist sign-up. If you join the waitlist, we collect your email address and nothing else. We use it only to tell you when MostlyPCB opens to you. We do not add you to a newsletter.

Describing your board. If you describe a board on our home page, we collect your email address and the description you type. We use them to review your request and, if it fits, to send you an invite. Please do not put anything confidential or export-controlled in this box.

Building your board with us. If you follow an invite link, we collect your email address, what you tell us you are building, and your answers about the board. If you already have a design, we also collect the address of its repository and the version you want us to use. Before we accept a project, you confirm that the design is not export-controlled. We keep a record of that confirmation: who made it, when, which version of the wording you saw, and which project it belongs to.

Private repositories. If your design lives in a private repository, you can give us read access in one of two ways:

• Install our GitHub app. It asks for read-only access to repository contents and nothing else. You can remove it at any time from your GitHub settings, and we stop being able to read the repository.
• Paste a read-only deploy key or token. We lock it as soon as it arrives, so only the system that fetches your design can open it, and we destroy it when your board is finished.

Your account. You sign in with your email address and a one-time code we send you. Our staff can also sign in with Google. We do not store passwords.

Quotes and payment. When you pay, you are taken to Stripe's checkout page. We give Stripe your email address and the quote reference. Your card details go to Stripe and never reach our servers. Stripe's checkout also asks for your billing address and your shipping address. We keep the shipping address so we can ship your board. Before you pay, you accept our Terms of Service, and we record which version you accepted, for which quote, and when.

Rush requests. If you ask us to rush a board, we collect the email address or mobile phone number you give us for updates about that request.

Emails we send you. When you describe a board, we send your description and email address to our own inbox so a person can read it. We send you messages only about your own request or project. These are all of them:

• A short note saying we received the board you described
• An invite link to send us your board, if we can take it on
• A note that we have your board
• Your quote, with the amount and a link to pay
• A receipt when we receive your payment
• A note when your board goes into build
• A note when your board goes into review
• A note if review asks for changes, with a summary when we write one
• A note when your board passes review
• A note when your board is delivered
• A note if we decline your board
• A note that we have your rush request and are looking at it, by email, or by text message if you gave us a phone number

Our sending record keeps a scrambled form of your address, not the address itself.

Engineer reviewers. If you review boards for us, we keep your email address in your reviewer account so we can assign work to you and sign you in.

Information collected automatically. When you send a form or ask for a sign-in code, we use your internet (IP) address to stop abuse. We store only a scrambled form of it, never the address itself. Our hosting provider also handles your IP address to deliver the site, as any web host does. Google Analytics collects standard usage data on some pages, described in section 3.

Our public build log. Our home page shows counts of boards that reached review, were signed off, or were delivered, with the time of each. It never names a customer or a board.

2. How We Use Your Information

• To review your request and decide whether we can take it on
• To design, check, review, build and deliver your board, and to keep you informed while we do
• To check requests for signs of export-controlled content. A possible match pauses the request until a person looks at it
• To take payment and keep accurate records of what you agreed to and paid
• To run, secure and improve the site, and to understand how people use it
• To meet legal obligations and protect our rights

3. Cookies, Analytics and Your Browser

Our own cookies. We set these cookies, and only when you use the feature that needs them:

None of them are used for advertising or tracking. Scripts on the page cannot read them.

Google Analytics. Google Analytics 4 runs only on our public home, compare, terms, privacy and accessibility pages. It never runs on a page for a specific quote, payment, project, review or account, or in the customer portal. It records which pages you visit, the site that sent you, roughly how long you stay, the city your connection appears to come from, and details of your device such as its model, operating system, browser and screen size. Google sets its own cookies to do this, named _ga and _ga_8Y2TK2P2FX. We never send your email address, your board description or your design to Google Analytics.

One Analytics account for our company. The Google Analytics property we use (measurement ID G-8Y2TK2P2FX) is the main one for Vortex Computation, LLC, the company that runs MostlyPCB. It also measures our company website, vortex.llc, so visits to both sites are kept in the same property.

Google Ads. That property is linked to our company's Google Ads account. Its settings allow Google to use audiences and key events from Google Analytics for personalized advertising through linked Ads accounts. On the link to our Ads account, personalized advertising is turned off. On MostlyPCB pages, our tag also tells Google that you have not agreed to advertising cookies, to your data being used for advertising, or to personalized ads, and we never change that. Google signals, which would add information from signed-in Google accounts, is turned off. This describes how our settings are set. Google decides how it applies them.

How long Google keeps it. Google keeps this data for 14 months. Each time you come back, the 14 months start again, so data about a visitor who keeps returning is kept for as long as they keep returning.

Your choices. If you are in the European Economic Area or the United Kingdom, Google Analytics does not set its cookies and sends only basic measurements without them. Anyone can stop Google Analytics with Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout, or block it in your browser settings or with a content blocker. You can control how Google uses your information for ads in Google's ad settings at https://myadcenter.google.com.

Nothing else. Apart from Google Analytics, we run no advertising tags and no other analytics service on MostlyPCB.

Installing the site as an app. Your browser may offer to install MostlyPCB as an app. The small helper file that makes this possible stores nothing, caches nothing and sends no notifications.

4. How We Share Information

We share your personal information with the service providers that help us run MostlyPCB. Except for Google Analytics, whose advertising settings are described in section 3, we share it only as needed for them to do that work:

• Supabase, for our database, sign-in and file storage
• Fly.io, which hosts the site
• Stripe, which takes payments and collects billing and shipping addresses at checkout
• Resend, which can also send our project emails
• SMTP2GO, which sends our sign-in codes and project emails
• Twilio, which sends text messages and calls to our own team about projects, and a text message to you about a rush request if you gave us a phone number
• Google, for analytics, with the advertising settings described in section 3
• GitHub, only if you connect a repository
• Fabrication and assembly partners in the United States, only when we arrange to have your board made, and only the files needed to make it

AI tools. We use AI tools to help design and check boards. They run under business agreements that do not allow your information to be used to train AI models. An engineer reviews everything they produce before it reaches you.

People who see your project. Your project details are seen by our team and by the engineer reviewers who check your board. All of our reviewers are US citizens based in the US, and they work under confidentiality.

We may also share information where the law requires it.

5. Where Your Information Is Kept

Our servers are in the United States. The site runs in Virginia, and our database and file storage are hosted in the US. When we arrange fabrication and assembly, we use fabrication and assembly partners in the United States only. We do not send your design to fabrication outside the United States.

6. Data Retention and Security

We keep personal information only as long as we need it for the purposes in this policy. In particular:

• Board descriptions from our home page are deleted when you ask us to. Automatic deletion is coming.
• Delivered files stay available to download for 90 days after delivery. After that, the download ends. We delete the files when you ask us to. Automatic deletion is coming.
• Deploy keys and tokens you paste are destroyed when your board is finished.
• Export-control confirmations, terms acceptances and payment records are kept as business records, for at least seven years after your project closes.
• Your account and waitlist email are kept until you ask us to delete them. We act on a deletion request within 60 days.

If a legal claim, investigation or export-control review involves your project, we keep the related information until it is resolved, even past the periods above.

We use reasonable administrative and technical safeguards. Delivered files are encrypted while stored. Our logs are set up to leave out your email address and your board description. No method of sending or storing information is completely secure, and we cannot guarantee absolute security.

7. Your Choices and Rights

Your rights. Anyone can ask to see or delete their information by emailing hello@mostlypcb.com. We act on the request within 60 days.

You may ask us for a copy of the personal information you gave us, or ask us to correct or delete it, by contacting us at the address below. There is no self-service form for this. A person reads the email and answers it, and we act on the request within 60 days. If we delete your information, we tell you what we removed. We may keep records we are required to keep, such as payment records and export-control confirmations, and we will tell you which ones.

You can remove our GitHub app at any time from your GitHub settings. You can block Google Analytics, or change how Google uses your information for ads, as described in section 3.

8. Children's Privacy

MostlyPCB is a service for businesses and engineers. It is not directed to children under 13, and we do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last Updated" date above. Your continued use of the site after a change means you accept the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, contact: