Skip to content
RobothecaBeta
Log in

Privacy

Last updated: 11 October 2026.

Robotheca keeps as little about you as it can. You can browse every robot without an account. There are no ads, no analytics and no tracking cookies. This page says what Robotheca stores, why, for how long, and what you can ask.

Who is responsible

Robotheca is run by Klajdi Haka, a private individual in France, who is responsible for your information (the “controller” under the GDPR). For anything on this page, write to contact@robotheca.org. See also the legal notice.

When you browse

Robotheca stores nothing about you. Our server keeps technical logs, with IP addresses, for 7 days, to protect the site against attacks.

Some of a robot's content is shown straight from the creator's repository on GitHub: some 3D models, the build guide and its pictures, the project files, and the photos of robots whose license keeps them on GitHub. Your browser downloads these from GitHub (raw.githubusercontent.com, and media.githubusercontent.com for large files), which then sees your IP address. Your browser keeps the files of the 3D view and of “Try it in the browser”, so they open faster next time; they stay on your device, and clearing this site's data in your browser removes them.

When you sign in

You sign in with GitHub, Google or a link sent to your email address; there are no passwords. We store:

  • Your profile: your name and email address (and whether the provider has verified it). With GitHub, also your GitHub ID, your login and the address of your profile picture. We do not store your Google picture.
  • How you sign in: which accounts are linked (GitHub, Google) and their account IDs, with the tokens they send at sign-in. Access tokens are stored encrypted, and Robotheca does not use them: it reads public repositories with its own key and never gets access to yours.
  • Your sessions: a session cookie keeps you signed in. For each session we keep its IP address and your browser's name, to protect your account and limit abuse.
  • Your imports: the repositories you import or suggest, the robot card you fill in, and their status. A robot you suggest says “Suggested by” you on its page.
  • Your parts: if you use “What can I build with my parts?” while signed in, the parts (model numbers and quantities) and tools you list. Signed out, that list stays in your browser and is never sent to us. Clearing the list deletes it.

The session cookie is the only cookie, and it is needed to sign in, so there is no cookie banner.

If you sign in with Google, Robotheca asks Google only for your basic profile: your name, your email address and whether Google has verified it. Robotheca uses them only to create your account, sign you in and show your name on the robots you suggest. It never sells or shares them, and never uses them for advertising or to train AI models.

When you report content

Anyone can report a robot page with “Report this robot”. We store your report (what, where and why), your name and email address (optional only for reports of child sexual abuse material) and, if you are signed in, your account. The EU Digital Services Act requires us to handle reports and to tell you our decision: that is why we use them (GDPR Art. 6(1)(c), a legal obligation). Only the people who run Robotheca see them; we do not show your name or address to the creator, unless the law requires it. Your connection's IP address is counted in the server's memory to limit abuse, never stored.

A person decides each report, and we keep the decision: what we did, why, and to whom we wrote. If we remove or limit a robot you added, we email you the reasons (the statement of reasons of the Digital Services Act) at the address of your account, and keep that address with the decision. Reports and decisions are deleted two years after the decision, whether or not you still have an account.

When you write to us

If you write to contact@robotheca.org, we keep your message and your address to answer you, in a mailbox at OVHcloud (France). Conversations are deleted at most three years after the last message.

Why we may use it

  • Your profile, sign-in accounts, imports and parts list: to provide the service you ask for (GDPR Art. 6(1)(b)).
  • Server logs, session IP addresses and browser names: our legitimate interest in protecting the site and your account, and limiting abuse (Art. 6(1)(f)).
  • Your messages: our legitimate interest in answering you (Art. 6(1)(f)).

How long we keep it

  • Your profile, sign-in accounts, imports and parts list: until you delete them or your account.
  • A session ends when you sign out or about a week after your last visit, and its record is then deleted. Server logs: 7 days.
  • Encrypted database backups are kept for 30 days, so deleted information is gone from them within 30 days.

Who else is involved

  • Hetzner (Germany) hosts Robotheca's server and database.
  • Scaleway (France) stores the encrypted database backups.
  • OVHcloud (France) hosts the contact@robotheca.org mailbox.
  • Brevo (France) sends the sign-in emails: it receives your email address and the link. Our emails carry no tracking (no open or click tracking).
  • GitHub and Google, when you sign in with them, under their own privacy policies; Robotheca also reads public repositories on GitHub, and your browser loads some files from GitHub (above).
  • Anthropic (USA): Robotheca uses Claude, Anthropic's AI model, to fill in the robot card from a repository's README when it has no robot.yaml, to write Robotheca's notes and to translate build guides into English. Claude receives the repository's public text, not information about you.

GitHub and Google are US companies that adhere to the EU–U.S. Data Privacy Framework. We never sell your information or share it with anyone else.

Your data, your choice

On your account page you can:

  • Download my data: a JSON file with everything above (profile, sign-ins, sessions, imports, the robots you manage or suggested). Sign-in tokens are left out.
  • Delete my account: your profile, sign-ins, sessions and imports are deleted. Robots you published stay on Robotheca, credited to the creator of their repository, and robots you suggested no longer show your name. For your safety, this needs a sign-in within the last day.

The GDPR also lets you ask us to correct your information, limit how we use it or object to it. Write to contact@robotheca.org; we answer within one month. You can complain to the CNIL, the French data protection authority (cnil.fr), or to the authority of your own EU country.

When this page changes, the date at the top changes too.