Privacy policy

What we collect

If you create an account:

• Your email address and password. Passwords are handled entirely by our authentication provider (Supabase), so we never see or store them in plain text.
• The display name, bio and profile picture you choose to add to your profile.
• Paintings you upload: the image, title, description, and tags.
• Likes and comments you make.

If you use the justPaint Art app:

• The same account data as above: the app and the website share one account.
• The camera and your photo library, only when you choose to post, and only the photo you pick. It’s shrunk and stripped of location and camera details before it’s stored.
• The people you block, so their paintings and comments stay hidden from you, and which notifications you’ve opened. Only you can see these.
• On your phone, the app keeps your sign-in (encrypted) and whether you’ve seen the welcome screen.
• The app has no analytics, advertising or tracking code, and doesn’t track you across other apps or websites.

If you post as a guest on the website (no account):

• The name you type in when uploading, plus the painting itself. We don’t collect an email address or anything else identifying for guest posts.
• Photos often carry hidden details like the location they were taken and the phone that took them. We strip all of that from every image before it’s stored or shown.

If you report a post:

• The link to the post, what you told us about it, your email address, and the name you signed with. We use these only to review the report and follow up with you, and keep them for two years as a record of the request and what we did about it. They aren’t shown publicly or to the person who posted.

Automatically, for anyone using the site:

• Standard server request logs collected by our hosting providers (Vercel and Supabase), like IP address, browser or app type, and timestamps. These are used only to operate and secure justpaint.
• A scrambled (one-way hashed) version of your IP address. When you upload, it’s kept for two days to limit how many uploads can come from one place. When you heart a painting, it’s kept for as long as the heart is, so each painting gets one heart per visitor. We never store your actual IP, and it’s never shown publicly. If you’re logged in, we use a scrambled version of your account ID for this instead of your IP.
• On the website only, visit statistics collected by Google Analytics: which pages you view, roughly where you are (city or country level), your device and browser type, and how you found the site. We use this only to understand how many people visit and what they look at.

What we don’t do

• We don’t run ads or use advertising trackers.
• We don’t use Google Analytics data for advertising or ad personalization.
• We don’t sell your data to anyone.
• The app doesn’t use cookies or your phone’s advertising ID.

Cookies and browser storage

Here’s what justpaint stores in your browser. None of it is used for advertising.

• Hearts: your browser remembers which paintings you’ve hearted (a list of painting IDs in local storage). It stays on your device and isn’t sent to us.
• Sign-in: small cookies that keep you signed in, if you have an account (and for site admins).
• Google Analytics: cookies (named _ga) that let Google Analytics recognize return visits so we can count visitors. You can block them in your browser’s cookie settings or with Google’s opt-out add-on.

Do Not Track

Some browsers can send a “Do Not Track” signal. justpaint doesn’t respond to it: Google Analytics runs the same way whether or not the signal is on. To keep Google Analytics from counting your visits, use the opt-out add-on or block cookies as described above.

Who we share data with

We use four service providers to run justpaint, and your data passes through them as part of normal operation:

• Supabase hosts our database, handles authentication, and stores uploaded images.
• Vercel hosts the website itself.
• Resend sends account emails, like the link to confirm your email address. It receives your email address to do that.
• Google provides Google Analytics on the website. Google handles that data under its own privacy policy.

If you download the app, Apple’s App Store or Google Play handles the download under their own privacy policies.

Public content

Paintings, titles, descriptions, tags, comments, and profile display names, bios and pictures are public by design. That’s the point of the site. Please don’t upload or post anything you don’t want visible to anyone who visits justpaint.

Your choices

• You can delete your own paintings, and your whole account with everything in it, yourself on the website or in the app. See Delete your account for the steps and what gets deleted.
• To have a guest painting taken down, or if you can’t sign in, email thewcookie@gmail.com.
• In the app, you can block people whose work you don’t want to see.

Children’s privacy

justpaint isn’t directed at children under 13, and we don’t knowingly collect data from children under 13.

Changes to this policy

If this policy changes in a meaningful way, we’ll update the date at the top of this page.

Contact

Questions about this policy? See support or email thewcookie@gmail.com.