Privacy Policy

1. Age Requirement

ArtLair is intended for users who are 18 years of age or older, consistent with our Terms of Service. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a user under 18, we will delete that account and associated data.

2. Information We Collect

We collect the following categories of information:

• Account information: username, email address, and passwords.
• Uploaded content: images and associated metadata you submit (title, description, tags, category, content rating, AI-disclosure flag).
• Discord account information (optional): if you choose to link or sign in with Discord, we receive your Discord user ID, username, and the email address associated with your Discord account.
• Technical and log data: IP address, used for login rate-limiting and abuse/spam prevention, and to process Cloudflare Turnstile captcha verification (see Section 5).
• Account access history: each time you register or log in (including via Discord or "Remember me" auto-login), we record the date/time, the IP address, and browser/device (user agent) used to access your account.
• Communications: information you submit through the contact form (name, email, subject, message) or in support tickets.
• Account security codes: temporary verification codes or tokens (e.g. for password changes, email changes, or data export requests) sent to your email, stored only in hashed form and automatically expired after a short period.
• Cookies: session cookies required to keep you logged in (see Section 4).

3. How We Use Your Information

We use collected information to: operate and improve the platform, authenticate your account, send account-related emails, provide customer support, respond to reports and content moderation issues, enforce our Terms of Service, prevent abuse and spam, and maintain platform security.

4. Cookies

We use session cookies to maintain your login state. These cookies are essential for the platform to function and cannot be disabled while using the service. We do not use third-party advertising or tracking cookies.

5. Third-Party Services

We share limited data with the following third parties, solely to operate the platform:

• Cloudflare Turnstile: used to verify you're not a bot on registration and certain forms. Your IP address is sent to Cloudflare as part of this verification.
• Discord: if you link or sign in with Discord, we exchange an authorization code with Discord's servers to retrieve your Discord ID, username, and email.
• Our email provider (SMTP): used to deliver account, verification, and notification emails.

We do not sell your personal information. We do not share it with other third parties except as required by law, to respond to legal process, or to protect the rights, property, or safety of our users or the platform.

6. Data Storage & Security

Your data is stored on secure servers. We take reasonable technical and organizational measures to protect your data, but no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain account and content data for as long as your account is active. Rate-limiting IP logs used only to throttle repeated login attempts are retained for a short period (typically no more than 30 days) and then purged automatically. Your account access history (the login/registration events described in Section 2, including IP address and timestamp) is retained for as long as your account is active, is visible to you and to platform administrators, and is included if you request a copy of your data (see Section 8). If you delete your account, we delete your personal data, including access history, within a reasonable period, except where we are required to retain certain records for legal, security, or content-moderation purposes (for example, records related to a content report or Terms of Service violation).

8. Your Rights

Depending on where you live, you may have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Request a copy of your data in a portable format
• Object to or restrict certain processing of your data

You can request a copy of your account information — including your uploaded content, comments, and account access history (login/registration timestamps and IP addresses) — delivered to you as a PDF by email, at any time from your Account Settings page under "Your Data." For your security, we'll first email you a one-time verification code to confirm the request before sending anything. For anything else — corrections, deletion, or other requests — contact us. If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and correct your personal information; we do not sell personal information.

9. Email Communications

We send emails regarding account verification, password resets, and security-related account activity. These are necessary for the service to function and cannot be opted out of. We do not send marketing emails.

10. Content Reports & Legal Compliance

Reported content is reviewed by our staff. Where content is found to be illegal, including content depicting the sexual exploitation of minors, we remove it and report it to the relevant authorities (including, where applicable, the National Center for Missing & Exploited Children) as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on the platform. The "Last updated" date above reflects the most recent revision.

12. Contact

For privacy-related questions or to exercise your data rights, please contact us.