UNDER ONE SUN

Privacy notice

Draft for legal review. This text describes how the prototype is built. It has not been reviewed by a lawyer, and having this page does not by itself make the project compliant with the GDPR or any other law. Items in [brackets] must be completed before launch.

Who is responsible

[Legal name of the organisation], [address], [contact email]. [Data protection contact, if appointed.]

What we collect, and why

When you create an account

  • Your email address: to confirm it's yours, to let you log in, and to send account emails (confirmation and password reset). We send no newsletters or marketing. It is never shown publicly.
  • A name to show, which you can change at any time; your password, stored only as a salted scrypt hash we can't read; your confirmation that you are 18 or older (we don't verify age or ask for ID); and when you created the account and last logged in.
  • A sign-in cookie that keeps you logged in for up to 30 days. It is essential for the account and not used for tracking.
  • Accounts whose email address is never confirmed are deleted automatically after [7] days.
  • Emails are sent through [email provider, e.g. Resend or Postmark], which processes your address on our behalf.
  • You can delete your account at any time from your account page. That deletes your account, your email address and your artwork's image; the artwork's place in the collective stays empty.

When you share an artwork

Each account shares one artwork. It is linked to your account privately; the link is never shown publicly.

  • The image, its title, and the feelings you label it with: to show it in the gallery, with your permission.
  • Optional: your name to show, a country, and your own words about the artwork. The name and words are shown only if you tick the box for each; words you don't choose to show are not sent to us at all.
  • We remove hidden location, camera and editing data from image files before storing them.
  • Artworks shared before accounts existed were anonymous and came with a private removal key instead. We store only a scrambled (hashed) version of it.
  • Your answer to the optional research question is stored as a preference. No research programme exists. We would ask you again, separately and in detail, before any research use.

When you contribute to a theme, such as Love

  • The same details as above. What you chose to show becomes public once a moderator accepts your artwork.
  • Your browser also makes a small preview of your image, used as your tile in the collective artwork. Your original is kept as uploaded (without hidden metadata) and shown in the gallery.
  • With an account, the full collective opens wherever you're logged in once your artwork is accepted. For older anonymous contributions, a functional cookie remembered which contributions were made on that device (artwork IDs and a signature only, never used for tracking), and a personal link did the same on other devices; both keep working.
  • Accepted contributions keep a permanent place in the collective. If you remove yours, the image and preview are deleted and the place stays empty.

No AI use

We don't use AI to generate, alter or replace artworks or the collective artwork. Submitted artwork is not used to train AI models or to generate AI images. Any such use would require your separate, explicit permission.

Earlier canvas requests and applications

The former application and canvas-request pages ("The First 30", later "Take part") have been retired; there is no application process any more and nothing new is collected. Requests sent earlier contain a name or chosen name, email address, optionally a country and a message, whether materials were needed, and for later requests a self-confirmation of being 18 or older. They are no longer used or shown anywhere on the site or in the moderation tools, and are kept unchanged only until their deletion has been decided; we will update this notice when that happens. To have yours deleted sooner, write to [contact email].

When you report an artwork or request removal

The report reason and details, and for manual removal requests the contact you provide, so we can respond.

The Feeling Pattern experiment

No EEG or other biometric data is collected by this website. The current Feeling Pattern page runs a simulation in your browser and sends nothing to us. If a real device integration is added, it will require a separate, explicit opt-in and an updated notice before any data is processed.

What we never do

  • We don't sell or share personal data.
  • We don't show contact details publicly.
  • We don't use advertising trackers or third-party analytics.

Technical data

Our server processes your IP address briefly to prevent abuse (rate limiting). It is not stored with your artwork. Fonts are loaded from Google Fonts [review: consider self-hosting to avoid transferring IP addresses to Google]. Your browser may store a draft of your submission and which artworks you connected with, on your device only.

Legal basis and retention

[To be completed: consent (Art. 6(1)(a) GDPR) for publication; legitimate interest for moderation and abuse prevention. Contract (Art. 6(1)(b)) for providing the account you asked for. Retention: accounts until you delete them, unconfirmed accounts [7] days; artworks until removed; earlier canvas requests until deletion is decided [date]; reports [X months].]

Your rights

You can access, correct, or delete your data, withdraw consent at any time, and complain to your data protection authority [e.g. Autoriteit Persoonsgegevens in the Netherlands]. To remove an artwork, use your account page (or the removal page for older, anonymous artworks). To delete your account and everything linked to it, use the button on your account page. For anything else, write to [contact email].

Hosting and processors

[Hosting provider and location. If Supabase is used: Supabase Inc., region [EU], with a data processing agreement.]

Last updated: [date]