Privacy policy

Common Parts Access

1. Introduction

Common Parts Access (accessible at access.commonparts.org) is an open platform for publishing and accessing digital spare parts. It is an official interface of the Common Parts Infrastructure.

This Privacy Policy explains what personal data is collected when you use Common Parts Access, how it is used, and what rights you have regarding your data.

Common Parts acts as the data controller for all personal data processed through Common Parts Access. You may contact us at any time at contact@commonparts.org.

2. Data Controller

Common Parts

contact@commonparts.org

access.commonparts.org

As Common Parts is currently operating as an unincorporated project, the natural person responsible for data processing may be identified upon request via the contact address above.

3. Data We Collect

3.1 Account data

When you create an account on Common Parts Access, we collect:

  • Email address
  • Username and display name (as provided by you)
  • Password (stored in hashed form - we never store your password in plain text)
  • Profile information you choose to add (bio, avatar)

3.2 Content data

When you publish spare parts or other content to the platform, we collect:

  • 3D model files and associated metadata (title, description, material, print settings)
  • Tags, categories, and other classification data you provide

3.3 Usage data

When you use Common Parts Access, we automatically record:

  • Collections and likes you create
  • Date and time of actions performed on the platform

Part views, file downloads and clicks on the link to a part's source are counted anonymously. Each one is recorded with the part and the time only (for a click on a source link, also whether it was made on the part page or on a part card) - never with your account, your IP address (in any form, hashed or not), or your browser details.

3.4 Technical data

For technical operation of the service, we process:

  • Session data stored in cookies (see Section 5)
  • Request logs of our hosting provider: Railway records, for each request to Common Parts Access, your IP address, your browser's user agent, the page requested and the time. These logs are used only to operate and secure the service, and are kept for 7 days (see Railway's log retention and privacy policy).
  • Request logs of our database and authentication provider: Supabase records the IP address and the user agent of the requests your browser sends to it directly, such as signing in or sending feedback, for the same purposes and for the period set by Supabase.
  • Sign-in sessions: when you sign in, our authentication provider (Supabase) stores the IP address and the user agent of your device with the session, to secure your account. They are deleted when you sign out of that session or delete your account.

3.5 Feedback

When you send feedback with the feedback button, we store its type, title and description, the address of the page you were on, the time, and, if you are signed in, a link to your account. To handle it:

  • its type, title, description, page address and time are sent to Mistral AI, which classifies it;
  • it is published, with its type, title, description, page address and time, as a public issue in the platform's GitHub repository. The issue states whether the sender was signed in, never who they are.

Do not include personal information in your feedback. We process feedback on the basis of our legitimate interest in improving the service (Art. 6(1)(f) GDPR). Feedback records are kept to follow up the issues they raise; if you delete your account, they are kept without the link to your account.

3.6 Authors of referenced parts

Some parts on Common Parts Access are referenced: their files stay on the platform where their author published them (the source), and Common Parts Access links to it. For each referenced part, we store, from its public page at the source:

  • The name or pseudonym under which the author published it
  • The link to the author's public profile at the source
  • The link to the original publication, its publication date and its licence

This information is shown on the part page to credit the author, as the licences of the parts and the rules of the platform require. We process it on the basis of our legitimate interest in crediting authors and respecting their licences (Art. 6(1)(f) GDPR). If you are the author of a referenced part, you can ask for this information to be corrected, or for the part to be removed, at contact@commonparts.org.

4. Legal Basis and Purpose

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

  • Performance of a contract (Art. 6(1)(b) GDPR): account creation, authentication, and delivery of the services you request.
  • Legitimate interests (Art. 6(1)(f) GDPR): maintaining security and integrity of the platform, preventing abuse.
  • Consent (Art. 6(1)(a) GDPR): where we ask for your explicit agreement, such as for optional profile information.

5. Cookies

Common Parts Access uses cookies strictly for authentication, session management and abuse protection on print reports. No advertising, tracking, or analytics cookies are used.

  • Cookie name: Supabase authentication token cookie (sb-*-auth-token pattern)
  • Purpose: Stores your authenticated session to keep you logged in.
  • Type: Strictly necessary. This cookie is essential for the service to function and does not require your consent.
  • Provider: Supabase, Inc. (our authentication infrastructure provider).
  • Duration: Session and short-term persistence (expires upon logout or session timeout).
  • Cookie name: cpa_reporter
  • Purpose: Holds a random identifier, set only when you submit a print report without an account, so a repeated report replaces your earlier one and reports can be rate-limited. Only a one-way hash of it is stored with your report; no IP address is stored.
  • Type: Strictly necessary for the print report feature you request.
  • Provider: Common Parts Access (first party).
  • Duration: 12 months.

You may delete cookies at any time through your browser settings. Doing so will log you out of your account.

6. Third-Party Processors

We use the following sub-processors to operate Common Parts Access.

  • Supabase, Inc. - Database, authentication, and file storage infrastructure, including its request logs and sign-in sessions (see Section 3.4). Supabase is SOC 2 Type II compliant.
  • Railway - Application hosting. Receives every request to Common Parts Access and keeps request logs (see Section 3.4).
  • Mistral AI - Classification of feedback. Receives the type, title, description, page address and time of each feedback (see Section 3.5).
  • GitHub - Hosting of the platform's public repository, where feedback is published as issues with its type, title, description, page address and time (see Section 3.5).

We do not sell, rent, or share your personal data with any third party for marketing or advertising purposes.

7. Data Retention

We retain your personal data for as long as your account remains active. If you delete your account, your personal data will be deleted immediately, except where retention is required by law or necessary to resolve disputes.

Content you have published to the platform (spare parts and their files and metadata) will be anonymized and remain available after account deletion, unless you request full removal.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access: obtain a copy of the personal data we hold about you.
  • Right to rectification: correct inaccurate or incomplete data.
  • Right to erasure: request deletion of your personal data (subject to legal retention obligations).
  • Right to restriction: request that we limit processing of your data.
  • Right to data portability: receive your data in a structured, machine-readable format.
  • Right to object: object to processing based on legitimate interests.
  • Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at contact@commonparts.org. We will respond within 30 days. If you believe your rights have not been respected, you have the right to lodge a complaint with your national data protection authority.

9. Security

Common Parts Access implements industry-standard security measures, including encrypted data transmission (TLS), hashed password storage, and session-based authentication managed by Supabase. No system is fully secure; we encourage you to use a strong, unique password for your account.

10. Contact

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data:

Common Parts

contact@commonparts.org

access.commonparts.org