Privacy Policy

Last updated: 2026-11-01

In plain language: we collect only what we need to run the gallery. We do not sell your data. We use a handful of named service providers. You can export and delete your data at any time.

1. Data we collect

When you sign up:

• Email address (required for all auth methods).
• Password hash (only for the email + password path; we never see your raw password).
• GitHub or Google OAuth profile (user id, username, email, avatar URL) when you choose that path.
• Username and avatar you set in profile settings.
• Timestamp of your acceptance of these Terms.

When you use the Service:

• Content you create (prompts, skills, project files, comments, chat messages, thread replies, follows, likes).
• Access logs required for abuse prevention (IP address, user agent, request path, timestamp). Access logs are retained for 30 days then deleted.
• Captcha challenge records (question + hashed answer, auto-expired after 5 minutes).

2. How we use the data

• Operate the gallery: show your profile, serve your content, let you interact with others.
• Keep the Service safe: rate limits, abuse detection, moderation.
• Communicate with you: email confirmation, password resets, administrative announcements, replies to your reports.
• Produce aggregated usage statistics for operational decisions (never shared externally in a form that identifies you).

We never sell your data. We never share your data with advertisers. We do not run third-party analytics or trackers by default.

3. Service providers

The Service runs on third-party platforms. Each provider sees only the data strictly required for their function:

• Supabase (database, authentication, realtime, storage): all content and auth records.
• Vercel (web hosting and edge): request routing and runtime.
• EmailJS (transactional email delivery): recipient email address and the template variables we interpolate (your username, the action URL for the specific email, and the expiry countdown). We route Supabase's auth emails through EmailJS because Supabase's default SMTP is rate-limited to two emails per hour on the free tier. EmailJS stores the message in its send log; see the EmailJS Privacy Policy for retention.
• Upstash (optional, Redis for rate limiting): only the rate-limit counter keys. These contain a short hash of your IP or user ID and the request action; they never contain content, email addresses or passwords. Keys expire within minutes of being set.
• Cloudflare Turnstile (captcha): browser signals used to detect bots.
• GitHub (OAuth, "Fork to GitHub" feature): OAuth profile; when you fork, the content you choose to publish.
• Google (OAuth): OAuth profile only.
• Octokit (GitHub import feature): public repo content you ask us to import.

Each provider has its own privacy policy. By using the Service you consent to the processing those providers perform on our behalf.

4. Cookies and local storage

We set only functional ("strictly necessary") cookies. We do not use advertising cookies, tracking pixels, or third-party analytics.

Cookies:

• sb-access-token and sb-refresh-token - Supabase authentication. HttpOnly, Secure, SameSite=Lax. Refresh token lives for up to 7 days of inactivity; access token refreshes transparently while you are active. Set and read only by @supabase/ssr.
• Theme preference - remembers light / dark / system selection.
• Dismissed-announcement cookie - one per announcement, 24-hour TTL.

Local storage (not cookies, but same spirit):

• theme - the colour scheme you picked.
• seen:ann:<id> - dismissed dialog announcements.
• dt_cookie_notice_v1 - timestamp of your dismissal of our cookie notice banner, so we do not show it again.

Because every item above is required to run the Service, we are not required to collect consent under GDPR ePrivacy recital 66. The cookie notice banner you may have seen on first visit is informational only.

5. Retention and deletion

• Your content and profile remain until you delete them or close your account.
• Account closure removes your auth row and cascades deletion of your content. Backups may retain copies for up to 30 days.
• Access logs are deleted after 30 days.
• Captcha challenge records are deleted after use or after 5 minutes, whichever comes first.
• admin_audit_log records are retained to satisfy accountability obligations.

6. Your rights

Depending on where you live, you may have the following rights:

• Access. Ask for a copy of the personal data we hold about you.
• Correction. Edit your profile at any time; contact /report for data we cannot show you in-product.
• Deletion. Delete your account from Profile → Settings → Danger zone, or data-only clear with "Delete my data".
• Export (data portability, GDPR Art. 20). Self-service: Profile → Settings → Privacy & sessions → Download my data. You get a single JSON file containing your profile, every project you own (including drafts and tombstones), files, prompts, vibes, skills, comments, likes, follows, thread subscriptions and chat messages you authored. Limited to 3 exports per hour.
• Active sessions. Profile → Settings → Privacy & sessions → Sign out other devices revokes every other signed-in session for your account, keeping the current browser signed in. If you cannot sign in to use this control, email us via /report kind "id_theft".
• Objection and restriction. Ask us to stop processing non-essential data; email is the only essential channel.

We respond to verified requests within 30 days.

7. Children

The Service is not directed at children under 13. If you believe we have inadvertently collected data from a child under 13, contact /report kind "id_theft" and we will delete it.

8. Transfers

Our service providers may host data outside your country. By using the Service you consent to this transfer. We rely on provider-level safeguards (Standard Contractual Clauses, encryption in transit and at rest).

9. Security

We use industry-standard practices: HTTPS everywhere, HttpOnly cookies, hashed passwords (Supabase bcrypt), parameterised queries, row-level security on all tables, rate limits, and captcha. No system is perfectly secure; we promise reasonable care, not perfection.

Report suspected vulnerabilities via /report kind "bug" with "security" in the subject. We investigate within 72 hours.

10. Changes

If we materially change this Policy we will post a notice on the site and update the "Last updated" date. Continued use after the change constitutes acceptance.

11. Contact

Use /report with the relevant kind. For privacy-specific questions use kind "other" with "PRIVACY" in the subject.