Privacy Policy

Mitools is a curated directory of tools for creative work, run by Odama. We decide what personal data is collected here and why, which makes us the data controller for it. Questions about anything on this page go to hello@odama.io.

Browsing the directory needs no account and collects no personal data beyond the analytics described below. Everything else here follows from something you chose to do.

• When you create an account: your name, your email address, and a password. We never see the password itself, it is hashed by our authentication provider and stored only in that form, which is also why we can reset it but never tell you what it was.
• While you use the account: the tools you save, when you saved them, when you signed up, and when you last signed in.
• Your choices: that you accepted these terms, when, which version, and whether you asked for product email.
• If you submit a tool for review: the email address you give us with it, so we can tell you what we decided.
• Analytics: which pages are opened and which tools are clicked, through Google Analytics, and only if you allowed it when the cookie notice asked. Until you answer, and if you say no, the tag stores nothing on your device and sends no identifier that could be traced back to a visit. Either way it is never joined to your account.

We use your email address to create and secure your account, to send you important messages about the service, and only if you choose to subscribe, to send product news and marketing communications.

Those are three different things, and only the last one is optional:

• Account and security. The address identifies you when you sign in, and is where a confirmation or password-reset link is sent. There is no way to have an account without it.
• Service messages. Rare, and never promotional: a change to these terms, a security notice, the outcome of a tool you submitted. You cannot unsubscribe from these while you have an account, because they are how the account works.
• Product news. Only if you ticked the box for it, at sign-up, or later on your account page. It is never ticked for you, and never a condition of using the site. Turn it off on your account page, or use the unsubscribe link in any such email, and it stops.

We do not sell your email address, rent it, or pass it to anyone for their own marketing.

• To perform our agreement with you, an account, its saved list, and the service messages that keep it working.
• Our legitimate interests, keeping the site secure and standing up.
• Your consent, analytics cookies, and product email. Both are asked for separately, neither is assumed, and you can withdraw either at any moment without giving a reason and without losing anything else.

We use a small number of providers, each for one job and each bound to process data only on our instructions.

• Supabase, the database that holds your account, your saved list and your preferences, and the authentication service that hashes your password.
• Resend, delivery of the emails we send you.
• Google Analytics, usage measurement, with IP addresses anonymised by Google before they reach us.
• Our hosting provider, which serves the site itself.

Some of these operate outside your country. Where that involves a transfer of personal data, it is made under the safeguards those providers offer for it, such as the European Commission's standard contractual clauses.

Your account and everything attached to it stay for as long as the account exists. Delete the account and we erase the profile, the saved list and the marketing preference; we keep the record that consent was given and withdrawn, because that record is the evidence we acted lawfully, and nothing else.

Submission emails are kept while the submission is under review and for a short period after it is decided. Analytics are retained for fourteen months and then aggregated.

• A copy of what we hold about you.
• A correction, if any of it is wrong, the name is yours to edit on your account page.
• Deletion of your account and its data.
• An end to product email, which the tick on your account page does immediately and without asking us.
• A complaint to your data protection authority, if you think we have got this wrong.

Write to hello@odama.io and we will answer within 30 days.

• Passwords are hashed, never stored or logged in a readable form, and are screened at sign-up against a public corpus of passwords exposed in known breaches. The check is made in your browser without the password leaving it.
• Every row is behind database policies that let an account read and write only its own data, enforced by the database rather than by application code.
• Changing your password requires the current one and signs out every other session.
• The site is served over HTTPS and nothing else.

There are two kinds here, and only one of them is a question.

• Essential. A signed-in session is kept in cookies, which is what an account is. They are set when you sign in and cleared when you sign out. There is no way to offer you an account without them, so they are not asked about.
• Analytics. Google Analytics, and only with your permission. Until you give it the tag runs in a mode that writes no cookie and carries no identifier, so a visit made before you answer, or after you decline, leaves nothing behind on your device.

We set nothing for advertising, there are no third-party ad trackers on this site, and your answer to the notice is remembered in this browser's local storage rather than in a cookie of its own.

Mitools is not aimed at children and we do not knowingly create accounts for anyone under 13. Tell us if one exists and we will remove it.

When this changes in substance we will say so by email before it takes effect, and the date at the top will move. Carrying on using the site afterwards means the new version applies.