Privacy policy

UX Collective (uxcollective.io) is run by Mika de Bruijn in the Netherlands, and is the controller of your personal data in the sense of the General Data Protection Regulation (GDPR).

Questions, requests or complaints about your data: info@uxcollective.io.

Visitors without an account. The pages you request, your IP address and browser details end up in our server logs. We use them to keep the site secure and working. We also count page views of a site without identifying you. Analytics are described below.

Your account. When you join we store your name, your email address and a password. The password is stored as a one-way hash, so nobody at UX Collective can read it. If you added a profile photo, we store that too. We use this to give you an account and to send you the emails you asked for. Basis: performing our agreement with you.

Sign in with Google. If you choose “Continue with Google”, Google tells us your name, your email address (and that Google has verified it) and a Google account ID. We ask Google for the permissions openid, email and profile and nothing else. We cannot see your Google password, your contacts, your files or anything else in your Google account. We use this data only to log you in and to create or link your UX Collective account, and we do not use it for advertising or share it with anyone. UX Collective's use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements. Basis: performing our agreement with you.

What you do on the site. Sites you save, your collections (including their names, notes and, if you share one, its public link), your ratings and the sites you suggest. This is the core of the service and is visible to you in your account. Basis: performing our agreement with you.

Emails. We send a welcome email, password reset emails and, unless you switch it off, a weekly update with the Weekly Three, new sites and new articles. You can unsubscribe with one click in every update or under Account → Email updates. Basis: performing our agreement (account emails) and your consent (weekly update).

AI assistants (MCP). Access is invite-only. If it is switched on for your account and you connect an app such as ChatGPT or Claude, that app can search the collection read-only on your behalf. We store the connection (the name of the app, the time and an access token) so you can see it and disconnect it under Account → AI assistants. We do not store your conversation or the questions you ask the assistant; what that AI service does with them is covered by its own privacy policy. Basis: performing our agreement with you.

Cookies. We use a session cookie that keeps you logged in and protects forms against forgery, and, if you tick “Keep me logged in”, a longer login cookie. These are necessary for the site to work. Google Analytics adds its own cookies (see below).

We use Google Analytics 4 to understand how the site is used: which pages are visited, which searches and filters are used and which links are clicked. Google receives your IP address, browser and device details and the pages and actions mentioned, and sets the cookies _ga and _ga_*. We also tell it whether you are logged in as a member, but never your name or email address. We use this to improve the site. Basis: our legitimate interest in improving the website.

You can block these cookies in your browser or with a tracking blocker, or use Google’s opt-out add-on. The site keeps working.

We do not sell your data and we do not show advertising. We use a few service providers who process data on our behalf, only to provide their service:

• Our hosting provider, where the website and its database run.
• SMTP2GO, which delivers our emails (it receives your name, address and the content of the email).
• Google, for Google Analytics and, if you choose it, Google sign-in.

Some of these providers may process data outside the European Economic Area. They do so on the basis of an adequacy decision or the standard contractual clauses of the European Commission. We share data with authorities only when the law requires it.

• Account data, saves, collections, ratings and suggestions: until you delete your account.
• Server logs: a limited time, only for security and troubleshooting.
• Analytics data: for the retention period we have set in Google Analytics.
• Emails we sent are not kept in our systems beyond what our email provider logs for delivery.

You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive a copy you can take elsewhere. Where we rely on your consent you can withdraw it at any time. Send a request to info@uxcollective.io and we will answer within one month.

Deleting your account. You can do it yourself under Account → Profile. That removes your profile, saves, collections, ratings, suggestions and AI assistant connections, and logs you out everywhere. Backups may still hold the data for a short time before they are overwritten.

If you think we handle your data wrongly, please tell us first. You can also complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

The site is served over HTTPS, passwords are stored hashed, and access to the data is limited to what is needed to run the site. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

UX Collective is not meant for people under 16 and we do not knowingly collect their data. If you believe a child has an account, email us and we will remove it.

If we change this policy in a way that matters, we will update the date above and, for accounts, tell you by email or on the site. Our terms of service explain the rules for using UX Collective.