We're in closed beta. Sign up for early access — founding pricing locks in at signup, for as long as your subscription stays active.
Last updated: October 28, 2026
We collect several types of information to provide and improve the UnityFreak platform:
Account Data. When you create an account, we collect your display name, username, email address, and password (stored in hashed form). You may optionally provide additional profile information such as a bio, avatar, location, and social media links.
Usage Data. We automatically collect information about how you interact with the Platform, including pages visited, features used, course progress, search queries, and timestamps of activity. This data helps us understand usage patterns and improve the Platform.
Payment Data. When you make a purchase or subscribe to a plan, payment information is collected and processed by Stripe. We do not store your full credit card number on our servers. We retain transaction records including purchase amounts, dates, and the items or services purchased.
Content Data. We store content you create on the Platform, including course materials, forum posts, comments, project descriptions, articles, chat messages, uploaded assets, and streaming metadata.
Device & Technical Data. We collect your IP address, browser type and version, operating system, device type, and referring URLs when you access the Platform.
Date of Birth. We collect your date of birth at registration to confirm that you meet our minimum age of 16 and to apply the additional protections for accounts held by people under 18.
Sign-in and Connected Accounts. If you sign in with Google or GitHub, we receive the profile details that provider shares with us, such as your name, email address, avatar and account identifier. If you connect a GitHub or GitLab account to import or link repositories, we store that connection.
SSH Keys and Push Notifications. If you add an SSH key to use Git over SSH, we store the public key, its fingerprint and when it was last used. If you turn on browser push notifications, we store the subscription details your browser gives us (a push endpoint, encryption keys and the browser's user-agent).
Call and Meeting Recordings. Where a call is recorded, or you upload meeting audio, we store the audio and a text transcript. The audio is sent to Google's Gemini service to produce the transcript (see section 13).
Live Captions. If a host turns on live captions in an audio room or live stream, the audio of the people speaking is streamed to Deepgram, Inc., which returns the text. We keep the caption text, its timing and a confidence score, not the audio, and we do not store who said what. Where a host supplies a recording link when ending a live stream, that recording may also be sent to Deepgram for transcription (see section 13). Call and meeting recordings are not sent to Deepgram.
Moderation Data. When you upload an image, we record the labels and scores returned by the automated image check, cryptographic and perceptual hashes of the image, the IP address it was uploaded from, and the decisions of any reviewer (see section 2).
Where the Information Comes From. We collect most information directly from you or from your use of the Platform. Some comes from the sign-in or connected-account provider you choose, and some from payment and identity-verification providers (for example, the result of an identity check).
Whether You Must Provide It. Your email address, password, username and date of birth are needed to create and secure an account and to apply our minimum-age rule; without them we cannot create the account. Payment and identity details are needed for paid features and for selling; without them we cannot complete a purchase or enable selling. Everything else, such as profile details and optional consents, is up to you.
We use the information we collect to:
Automated Decision-Making. We use algorithms to recommend courses, match freelancers with job listings, rank content in your feed, and detect potentially fraudulent activity. These systems process your usage data, skills, and preferences to provide personalised experiences. No fully automated decisions with significant legal effects are made without human review, except the automated blocking, by Cloudflare's CSAM Scanning Tool, of images that match known illegal imagery (see Automated Content Moderation below). You have the right to request human review of any automated decision that affects you by contacting [email protected].
Automated Content Moderation. To keep the Platform safe and to meet our legal obligations, images you upload are checked automatically before they are made available. This includes frames we sample from uploaded video and pages of uploaded documents. Each image is sent to Amazon Rekognition, a service provided by Amazon Web Services, Inc. in the United States, which returns moderation labels (for example, whether an image appears to contain nudity or violence), and uploads are scanned for malware. Images that are flagged as potentially harmful are held back and reviewed by a person before a decision is made. UnityFreak does not currently hold a licensed list of known illegal imagery, so uploads are not compared with one at upload time. Separately, Cloudflare's CSAM Scanning Tool hashes images served through its cache and checks them against known illegal imagery. Illegal imagery that we confirm is removed and preserved as evidence, the uploader may be suspended, and our team files a report with the US National Center for Missing & Exploited Children (NCMEC) CyberTipline and, where applicable, with UK law enforcement, as described in section 3. We keep the moderation labels, image hashes and a record of each decision. If you think your content was wrongly held or blocked, you can ask for human review by contacting [email protected].
Automated Checks on Messages. Direct messages are checked for attempts to share personal contact details, such as phone numbers, email addresses and social media handles. Where one is detected, the message is not delivered, the attempt is recorded on the sender's account, and repeated attempts may lead to a review of that account. Messages in conversations involving an under-18 account are also checked by an automated filter for severely abusive language, and a message that matches may be blocked. These checks run on the text of the message at the time it is sent. If you think a message was wrongly blocked, you can ask for human review at the address above.
We do not sell your personal information. We may share information in the following circumstances:
Stripe. Payment information is shared with Stripe to process transactions. Stripe's use of your information is governed by their own privacy policy.
Service Providers. We use service providers to host the Platform, deliver email, provide AI-assisted features, transcribe audio and captions, check uploaded images and monitor errors. They process information on our behalf and are listed in section 13.
Analytics Providers. We use analytics services to help us understand Platform usage. These providers may collect information about your use of the Platform through cookies and similar technologies.
Legal Requirements. We may disclose your information if required to do so by law, in response to a valid legal request (such as a court order or subpoena), or to protect the rights, property, or safety of UnityFreak, our users, or the public. This includes reporting suspected child sexual abuse material to the US National Center for Missing & Exploited Children (NCMEC) CyberTipline and, where applicable, to law enforcement or other bodies as the law requires.
Business Transfers. If UnityFreak is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.
We retain your personal information for as long as your account is active or as needed to provide you with services. If you delete your account, we anonymise your profile (display name, username, email address, bio and avatar) and revoke your sessions, API keys and linked sign-ins when your request is processed. We process deletion requests promptly and respond within one month, as UK GDPR requires. We keep information only where we are required to retain it for legal, accounting, or regulatory purposes. Content you created, such as posts, comments, messages and repositories, is not automatically erased; you can ask us to delete specific content, subject to the exceptions in section 6.
Certain content you have shared publicly (such as forum posts or comments) may remain on the Platform in anonymised form after account deletion, as removing it may affect the experience of other users.
Deletion may be delayed, or may not be possible, where your data is subject to a legal hold placed by an organisation you belong to or by us. We complete the deletion once the hold is released.
Where content is blocked or matched by the moderation checks described in section 2, we keep a restricted-access copy and the related records as evidence for up to 90 days from the decision, and for longer where a report has been filed or a legal hold or a legal obligation requires. A deletion request does not remove evidence that we are required to keep.
Other retention periods: read notifications are deleted after 90 days; sign-in sessions expire after at most 7 days of inactivity (see the Cookie Policy); and encrypted backups are kept on a rolling schedule of up to about 12 months, so deleted data can remain in a backup until it ages out.
Depending on your location, you may have the following rights regarding your personal information:
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. You also have the right to complain to the Information Commissioner's Office (see section 12) or to the data protection authority in your own country.
UnityFreak requires users to be at least 16 years old. We do not knowingly collect personal information from anyone under 16. Users aged 16–17 are considered minors and receive enhanced privacy protections in accordance with the UK ICO Age Appropriate Design Code (Children's Code):
If you believe someone under 16 has created an account, please contact us at [email protected]. See also our Young Users Privacy Notice.
Your information may be transferred to and processed in countries other than the country in which you reside, and those countries may have data protection laws that differ from those in your country. Some of our service providers, including Amazon Web Services, Deepgram, Google (Gemini API), our analytics provider and our error-monitoring provider, process data in the United States. We take steps to ensure appropriate safeguards are in place for these transfers; details are available on request to [email protected].
In particular, images you upload are sent for automated moderation to Amazon Web Services, Inc., which processes them in the United States (see section 13). The same steps apply to this transfer.
We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (HTTPS and SSH), encryption of specific sensitive secrets and backups at rest, access controls, and internal security reviews. We have not yet completed an independent security audit; see our Security & Trust Center for the current, evidence-labelled position. No method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.
Password check. When you create or change a password, we check it against the Pwned Passwords service run by Have I Been Pwned, using its k-anonymity range API. Only the first five characters of a hash of the password are sent, with no username, email address or other identifier, so neither the password nor who you are leaves our servers. If that service is unavailable, the check is skipped.
Dependency scanning. If you turn on dependency alerts for a repository, we look up the package names and versions in its lockfiles in OSV.dev, a public vulnerability database operated by Google. File contents, file paths and account details are not sent.
Under the UK GDPR and the EU GDPR, we process your personal data based on the following legal bases:
In the event of a personal data breach, UnityFreak will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33, unless the breach is unlikely to result in a risk to your rights and freedoms.
If a breach is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay, as required by GDPR Article 34. Our notification will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach.
For all data protection inquiries, requests to exercise your rights under GDPR, or concerns about how your personal data is processed, please contact our data protection contact at [email protected].
We will respond to all data protection requests within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
The third-party service providers we use to operate the Platform are listed below. This is the same list published on our Subprocessors page (list version 2026-10-30.1). The list is under legal review and vendor agreements are still being confirmed, so it is our current best statement rather than a final contractual schedule.
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe | Payment processing and subscription billing. | Billing email and plan details. Card numbers are entered into Stripe and are not handled by our own servers. Stripe Identity for buyers, Stripe Connect verification for sellers: identity-document images and verification results are collected by Stripe. |
| OVHcloud | Infrastructure hosting: the servers and storage volumes that run the platform. | Platform data at rest and in transit, as our infrastructure provider. |
| Cloudflare | Content delivery, DDoS protection and TLS termination; object storage for LFS objects, uploads, exports and encrypted backups; email routing; and its CSAM Scanning Tool, which hashes images entering its cache and blocks URLs that match known illegal imagery. | Web traffic in transit, Git LFS objects, uploaded files, exported data bundles and backups. Images served through its cache are hashed by the CSAM Scanning Tool. |
| PostHog | Product analytics, gated behind cookie consent. | Product usage events, only after analytics consent is given. |
| LiveKit | Real-time audio/video infrastructure for in-app calls, audio rooms and live streams, including the recording (egress) of calls that participants record and the live audio feed used for captions. | Real-time media streams and participant identity for calls, audio rooms and live streams, and the recordings participants make of calls. |
| Brevo | Transactional and (where you have opted in) marketing email, newsletters and digests; and receipt of email replies you send to task threads. | Recipient address and message content; the content of emails you reply with. |
| Google (Gemini API) | AI-assisted features: the PM assistant, AI-enhanced search, the content and portfolio assistants, and transcription of recorded calls and uploaded meeting audio (and code review when the community module opens). | Content you submit to an AI-assisted feature when you use it, and the audio of recorded calls and uploaded meeting audio, which is sent for transcription. |
| Deepgram, Inc. | Speech-to-text for live captions in audio rooms and live streams when the host turns captions on, and for transcription of a live-stream recording when the host supplies its recording link on ending the stream. | The audio of the people speaking while captions are on, streamed live, and the text returned; for a live-stream recording, the recording itself. We keep the caption text, its timing and a confidence score, not the audio, and we do not store who said what. We use Deepgram’s standard API endpoint and do not choose a processing region. |
| Amazon Rekognition (Amazon Web Services, Inc.) | Automated moderation of user-uploaded images, including frames sampled from video and rendered document pages, to detect illegal and harmful content. | The image content sent for analysis and the moderation labels returned. Processing takes place in the United States (the us-east-1 region by default). We have set an AI-services opt-out policy on our AWS account, so AWS does not store or use this content to improve its services. We keep the labels, image hashes and review records ourselves. |
| Sentry | Error and performance monitoring for the web app and API. | Technical error reports and performance traces. |
Integrations your organisation connects itself, such as chat, incident, support, design and cloud-storage tools, receive data only because your administrators connected them and for the purpose you configured. They are your service providers, not subprocessors we select, and each can be disconnected from your integration settings.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
We do not sell or share your personal information as defined under the CCPA. We run no advertising and load no advertising scripts, so we do not share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.
Categories and sources. In the last 12 months we have collected these categories of personal information: identifiers (name, username, email address, IP address); age and date of birth; commercial information (purchases and subscriptions); internet and device activity (pages visited, features used); audio and visual information (profile images, uploaded images and, where used, call recordings); professional and education information (skills, portfolio, course progress, job applications); and inferences used for recommendations. We collect it from you, from your device, from sign-in and payment providers you use, and from other users who interact with you. We use it for the purposes in section 2, and we disclose it to the service providers in section 13 for business purposes. This section, together with sections 1 and 2, is our notice at collection.
To exercise your CCPA rights, contact us at [email protected]. You may use an authorised agent: they should email us from the address on your account or provide your written permission, and we may ask you to confirm your identity directly. We will verify your identity before processing your request.
UnityFreak is operated by Nemesis Gaming. For the purposes of applicable data protection laws including the UK GDPR and EU GDPR, the data controller is:
If you are aged 16 or 17, we have a simplified privacy notice written specifically for you. It explains in plain language how we collect, use, and protect your data.
We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or via email. The "Last updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at [email protected].
If your organisation requires a Data Processing Agreement (DPA) for your team subscription, please contact [email protected].