Privacy notice

Last updated: 16 July 2026

Storefolio is a small, independently run gallery of ecommerce design. You can browse it without creating an account. This notice explains the limited personal data used when you visit the site, sign in, save a design, or submit a store.

Who controls your data

Storefolio is a private, independent project operated from Poland by Patryk Michalski, who is the controller of the personal data described in this notice. Storefolio is not operated by a registered company. You can contact the controller athello@storefolio.co about privacy, account deletion, or any of the rights listed below.

Analytics

We use Cloudflare Web Analytics, a privacy-first, cookieless tool. It sets no cookies and does not fingerprint you. To produce aggregate metrics (page views, referrers, country, device type), Cloudflare briefly processes technical request data such as your IP address, but this is not stored or used to identify or track you. All we ever see are anonymous, aggregated numbers.

We also use Rybbit, a second cookieless analytics tool, hosted for us by Clean Commit on their own server rather than by a third-party ad network. It records a page view with the page address, the referring site, your browser language, and your screen size, and the server processes technical request data such as your IP address and browser user agent to count visits and estimate the country you are in. It sets no cookies, stores nothing in your browser, and does not follow you across other websites. We see only aggregated reports. Session replay, error reporting, and click or form tracking are switched off.

We use both tools on the basis of our legitimate interest in understanding and maintaining the gallery.

Accounts, sign-in & collections

Creating an account is optional — it only exists so your collections sync across devices. If you sign in with an email link, we store your email address and send the link through our transactional email provider. If you sign in with Google, we also receive the name, avatar, and account identifier Google shares on its consent screen. Supabase stores the account, authentication data, and the designs you save, including the time each item was saved. Cloudflare Turnstile may process technical information about the browser and request to protect email sign-in from automated abuse.

We use this information only to authenticate you, provide your private collection, send essential sign-in messages, and keep the service secure — never for marketing or profiling. This processing is necessary to provide the account service you request, while abuse prevention is based on our legitimate interest in securing Storefolio. Account and collection data is kept while the account is active. Email us at any time to delete the account and all collection data tied to it.

When you submit a store

If you send a suggestion through the Submit form, we receive the URL you enter. Submissions are stored by our host (Netlify) and automatically screened for spam, purely so we can consider the store for the gallery. This is based on our legitimate interest in curating the gallery. Submissions are deleted after review when they are no longer needed.

Cookies & local storage

We set no tracking cookies. Saved locally in your browser are your light/dark theme choice and, if you log in, a session token that keeps you signed in. Neither is used for tracking, and neither leaves your browser except to authenticate you.

Service providers

We use a small number of providers only where needed to run the site:

• Netlify for hosting and store submissions;
• Cloudflare for images, aggregate analytics, and Turnstile security checks;
• Clean Commit for the self-hosted Rybbit analytics;
• Supabase for authentication, accounts, and collections;
• Google only when you choose Google sign-in; and
• Resend for essential authentication emails.

Like any web infrastructure provider, these services may process technical data such as IP addresses, timestamps, device or browser information, and security events in their server logs to deliver and protect the service. Fonts are self-hosted, so no font request leaves the site. Links to featured stores lead to third-party sites with their own privacy practices.

International data transfers

Some providers may process data outside the EU/EEA. Where data-protection law requires it, the provider relies on a recognised transfer mechanism, such as an adequacy decision or the European Commission's standard contractual clauses. We do not independently send or sell user data to data brokers, advertisers, or unrelated third parties.

How long data is kept

Account and collection data is kept until you delete individual saved items or ask us to delete the account. Store submissions are deleted after review when they are no longer needed. Transactional email and security logs are kept only for the limited periods configured by, or required for, the relevant provider. Your theme preference remains in your browser until you change it or clear local storage; the login session remains until it expires, you sign out, or you clear it.

Your rights

We never sell data or share it for advertising. Depending on where you live and which processing applies, you may ask us to access, correct, delete, restrict, or provide a copy of your personal data, and you may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Email us to make a request; we may need to verify that the account or email address belongs to you before acting.

Where the GDPR applies, you may lodge a complaint with a supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. Because the controller operates from Poland, you may also contact the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, atuodo.gov.pl.

Designs & trademarks

Screenshots and brand names shown here are the property of their respective owners and are displayed for reference and inspiration. Storefolio is not affiliated with, endorsed by, or sponsored by any of the featured brands. If you own a brand and would like its screenshot removed, email us and we'll take it down promptly.

Contact

Questions, or a removal request? Emailhello@storefolio.co.

Changes to this notice

If Storefolio's features or providers change, this notice will be updated and the new date will appear at the top of the page.