Privacy Policy

Effective date: 29 October 2026

This Privacy Policy explains how MakeFav.com (“MakeFav”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you use our website, favicon generator, pixel editor, favicon checker, REST API, newsletter and blog (together, the “Service”). We have tried to write it in plain language. If anything is unclear, please contact us.

In short: we collect only what we need to run the Service, we do not use advertising trackers, we measure traffic only with cookie-free, anonymous Plausible Analytics, we do not sell or share your personal information for advertising, and we never publish the images you upload.

1. Who is responsible for your data

The controller of your personal data is:

• Webmint s.r.o.
• Jana Želivského 2, 130 00 Praha 3, Czech Republic
• Company ID (IČO): 27888819
• VAT ID (DIČ): CZ27888819
• Registered in the Commercial Register at the Municipal Court in Prague, file no. C 124216
• Email: [email protected]
• Contact form: makefav.com/contact

We have not appointed a Data Protection Officer because we are not required to do so. For any privacy question or request, please write to [email protected].

2. Summary of how the Service works

• You can upload an image, generate favicons and preview the results without an account.
• Downloading the generated favicon package (ZIP) and using the API requires a free account with a confirmed email address.
• The free plan is provided in exchange for your subscription to the MakeFav newsletter (sent at most once per week). See section 5 for a full, transparent explanation.

3. What personal data we collect

3.1 Account data

When you create an account, we process your email address, your name (if provided), a password hash, your preferred interface language and the date and time you consented to the newsletter.

• Email and password: we never store your password in readable form. It is stored only as a one-way cryptographic hash (bcrypt or Argon2).
• Continue with Google: if you choose Google Sign-In (OAuth 2.0 / OpenID Connect), Google sends us your name, email address, Google account ID and a flag showing whether your email address is verified. We do not receive your Google password and we do not get access to your Gmail, Drive or other Google data.

3.2 Uploaded images and generated favicon packages

To generate favicons we process the image you upload (PNG, JPG, WebP, AVIF, GIF, BMP, SVG or ICO) and create a package of files (favicon.ico, PNG favicons, Apple touch icons, Android/PWA icons, Windows tiles, manifest.json and HTML code). These files are stored on our servers in the European Union so that you can preview and download them.

• Packages created without an account are deleted automatically after approximately 2 days.
• Packages linked to your account are kept for up to 90 days, or until you delete them, whichever happens first.
• Your images and favicons are never published. There is no public gallery and we do not allow hot-linking of your files from our servers.

Images normally do not contain personal data, but if yours does (for example, a photo of a person), it is treated with the same care.

3.3 Pixel editor

The pixel editor saves an autosave draft in your browser’s local storage (mf_editor_state). This draft stays on your device and is not sent to us unless you choose to generate or download favicons from it. When you move an image between the generator and the editor, it is passed through your browser’s session storage.

3.4 Favicon checker

When you use the favicon checker, our server fetches the public URL you enter and reads the icon declarations in its <head>. We process the URL you submitted and your IP address (for rate limiting and abuse prevention). Please only enter URLs of publicly accessible websites.

3.5 API keys and usage

If you create personal API keys, we store them in hashed form only, together with usage counts needed for rate limiting and abuse prevention. The full key is shown to you only once, when it is created.

3.6 Newsletter

For newsletter subscribers we process your email address, your language, the timestamp and method of your consent (registration checkbox, Google sign-up statement, or double opt-in confirmation) and, where applicable, the time you unsubscribed.

3.7 Contact form messages

When you contact us, we process your name, email address, the content of your message and your IP address, so that we can reply and protect the form against abuse.

3.8 Security, audit and server logs

We record your IP address and related technical information in security and audit logs (for example login events, failed login attempts, password changes and rate-limiting events). Our web servers also keep standard access logs (IP address, date and time, requested URL, HTTP status, referrer and browser user agent). We use these logs to keep the Service secure, investigate abuse and fix errors.

3.9 Support access by administrators

Our administrators can access account information to provide support. For troubleshooting, an administrator may view the Service as you see it when logged into your account. Every such access is recorded in our audit log, and we do it only when needed to help you or to protect the Service.

4. Why we use your data and our legal bases

Under Article 6 of the EU General Data Protection Regulation (GDPR) we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You have the right to object to such processing (see section 10).

5. The free plan and the newsletter

We want to be completely open about how the free plan works:

• MakeFav does not charge money and does not show advertising. Instead, the free plan (downloads and API access) is provided in exchange for your subscription to the MakeFav newsletter. The newsletter subscription is the “consideration” for the free plan.
• The newsletter is sent at most once per week and contains news about MakeFav, favicon and web design tips and articles from our blog.
• You give your consent separately and explicitly: by ticking an unticked checkbox at registration, or, when using “Continue with Google”, through an explicit statement shown before you confirm.
• You can unsubscribe at any time, free of charge: via the link in every newsletter, through one-click unsubscribe in your email app, or in your account settings.
• If you unsubscribe, downloads and API access are paused until you subscribe again. Your account, your saved packages (within their retention period) and your ability to generate and preview favicons stay available. You can re-subscribe at any time in your account settings.
• Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

You can also subscribe to the newsletter only, without an account, using the form in the website footer. That subscription uses double opt-in: it becomes active only after you click the confirmation link we send to your email address.

6. Who we share data with (processors and recipients)

We do not sell your personal data. We share it only with service providers who help us run the Service, under data processing agreements, and only to the extent necessary.

Anthropic PBC (Claude AI): our editors use the Claude AI API to help write and translate blog articles and newsletters. No user personal data and no uploaded images are ever sent to it. It is therefore not a recipient of your personal data.

Google’s processing of reCAPTCHA data is also subject to the Google Privacy Policy and Google Terms of Service.

We may also disclose personal data where required by law, for example to courts or public authorities, or where necessary to establish, exercise or defend legal claims.

We use no advertising trackers and only anonymous, cookie-free statistics (Plausible Analytics) that do not identify you, and we do not sell or share personal information for cross-context behavioral advertising.

7. International data transfers

Our servers are located in the European Union. Some of our service providers (Cloudflare, Mailgun and Google) are US companies and may process data in the United States. Where personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework (for certified companies) and/or the European Commission’s Standard Contractual Clauses, together with additional safeguards where appropriate. You can request more information about these safeguards by emailing us.

8. How long we keep your data

Backups may retain data for a short additional period before they are overwritten.

9. Cookies and local storage

We use only strictly necessary cookies (for example your login session) and security cookies set by Google reCAPTCHA, plus a few browser storage entries that keep the Service working. We do not use advertising or analytics cookies. Our visitor statistics (Plausible Analytics) work without cookies and without collecting personal data. For details, see our Cookie Policy.

10. Your rights under the GDPR

If the GDPR applies to you, you have the right to:

• Access your personal data and receive a copy of it;
• Rectification of inaccurate or incomplete data;
• Erasure (“right to be forgotten”);
• Restriction of processing;
• Data portability – receive your data in a structured, machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent at any time (for example, unsubscribe from the newsletter), without affecting the lawfulness of earlier processing;
• Lodge a complaint with a supervisory authority.

Self-service tools

In your account under Security & privacy you can download a copy of your data as a JSON file and permanently delete your account. You can change your name, language and newsletter preferences in your account settings at any time.

Requests and complaints

To exercise any other right, email [email protected]. We will respond within one month; this may be extended by two further months for complex requests, in which case we will let you know. We may need to verify your identity before acting on a request.

You can also file a complaint with the Czech supervisory authority:

• Úřad pro ochranu osobních údajů (Office for Personal Data Protection)
• Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
• www.uoou.cz

You may also contact the supervisory authority in the EU country where you live or work.

11. Information for US residents

This section applies to residents of US states with consumer privacy laws, including California (California Consumer Privacy Act as amended by the California Privacy Rights Act, “CCPA/CPRA”), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA) and other states with similar laws. Terms such as “personal information”, “sell” and “share” have the meanings given in those laws.

11.1 Categories of personal information we collect

In the last 12 months we have collected the following categories of personal information:

11.2 Purposes

We use personal information for the purposes described in section 5 and section 4: providing the Service and your account, sending transactional emails and the newsletter you subscribed to, keeping the Service secure and preventing fraud and abuse, answering your messages, and complying with the law.

11.3 No sale, no sharing, no targeted advertising

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not process it for targeted advertising or for profiling in furtherance of decisions that produce legal or similarly significant effects. We have not done so in the last 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.

11.4 Sensitive personal information

The only sensitive personal information we process is your account login credentials, and we use them only to authenticate you and secure your account. We do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit under the CCPA/CPRA.

11.5 Retention

We keep each category of personal information for the periods described in section 8.

11.6 Your rights

Depending on your state of residence, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected about you, the sources, purposes and recipients;
• Delete personal information we have collected from you;
• Correct inaccurate personal information;
• Data portability – obtain a copy of your data in a portable format;
• Opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do not engage in these activities);
• Limit the use and disclosure of sensitive personal information (we only use it for permitted purposes);
• Non-discrimination – we will not discriminate against you for exercising your privacy rights.

Note on the newsletter: the free plan is offered in exchange for the newsletter subscription, as explained in section 5. This is a disclosed term of the free plan, not a penalty for exercising privacy rights. Requesting access, correction or deletion of your data never pauses your access.

11.7 How to submit a request

You can use the self-service data export and account deletion in Security & privacy, or send a request to [email protected] or via our contact page. We will confirm receipt within 10 business days where required and respond within 45 days. If we need more time (up to an additional 45 days, where permitted by law), we will tell you why.

Verification: to protect your data, we verify requests by asking you to send the request from, or confirm it via, the email address associated with your account, or by asking you to log in. We will only use the information provided for verification for that purpose.

Authorized agents: you may use an authorized agent to submit a request on your behalf. We may ask the agent for proof of your signed permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

11.8 Global Privacy Control

We honor Global Privacy Control (GPC) signals as a valid opt-out request for the browser or device that sends them. Because we do not sell or share personal information, no further action is required.

11.9 Appeals

If we decline to take action on your request, you may appeal by emailing [email protected] with the subject line “Privacy appeal” within a reasonable time after receiving our decision. We will respond to your appeal in writing within the period required by your state’s law (generally 45 or 60 days), including an explanation of our decision. If your appeal is denied, you may contact your state Attorney General.

12. Children

The Service is not directed to children under 16, and you must be at least 16 years old to create an account. We do not knowingly collect personal data from children under 16, including from children under 13 within the meaning of the US Children’s Online Privacy Protection Act (COPPA). If you believe a child has provided us with personal data, please contact us and we will delete it.

13. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including:

• encrypted connections (HTTPS/TLS) for all traffic;
• passwords stored only as strong one-way hashes (bcrypt or Argon2) and API keys stored only in hashed form;
• servers located in the European Union, with access restricted to authorised personnel;
• rate limiting, bot protection and security monitoring;
• audit logging of logins and administrator access to accounts;
• automatic deletion of favicon packages after their retention period;
• no public gallery and no hot-linking of uploaded or generated files.

No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the authorities of a personal data breach where required by law.

14. Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Automated security tools (such as rate limiting and reCAPTCHA) may temporarily block suspicious requests; if this happens to you, please contact us.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the updated version on this page with a new effective date. If the changes are material, we will inform registered users by email or by a notice on the website before they take effect.

16. Contact

If you have any questions about this Privacy Policy or how we handle your data, email [email protected] or use our contact page.

See also our Terms and Conditions and Cookie Policy.