Privacy
What is kept, why, for how long, and what deleting your account really does.
Who holds this data
snowdrop, who runs the SnapATK project, is the data controller. Write to contact@snapatk.org about anything on this page.
What we collect
- Your email address, so you can confirm the account and recover it.
- Your display name, which is public.
- A hash of your password. Not the password.
- What you submit: cards, edits, replies. All public.
- How you voted. Not public — see below.
- Short-lived records derived from your IP address, used only to stop one script filling the disk. Stored as a one-way hash, not as an address.
What we do not collect
There is no analytics, no third-party tracker, no advertising network and no cookie banner, because the only cookie is the one that keeps you signed in. Nothing is sold or shared for marketing. The pages you look at are not recorded against your account.
Everything public here is also available as JSON, as a feed and as a data dump (see Data & feeds) under the same CC BY-SA 4.0 licence. That is your cards, replies, collections and display name — never your email address, your votes or anything else on this page.
Why, and on what basis
| What | Why | Basis |
|---|---|---|
| Account details | To give you the account you asked for | Contract |
| Cards, edits, replies, votes | They are the service | Contract |
| Rate-limit records | To keep the site standing up | Legitimate interest |
| Notifications, on the site and by email | To tell you something happened | Contract for the site; consent, per kind, withdrawable, for the email |
| Which cards you watch | So we know whom to tell | Contract |
Who else sees it
The mail relay that delivers confirmation, password-reset and data-report messages sees your address and the message. Nobody else. We do not pass anything to anyone for any other reason.
Who voted for what is readable only by an administrator, and only to investigate vote manipulation. Moderators cannot see it — not merely because the screen does not show it, but because the database refuses their queries.
How long
| What | Kept |
|---|---|
| An account that never confirmed its address | 48 hours, then deleted |
| Sessions and verification or reset links | Usable until expiry, use or revocation; removed by the hourly sweep or account deletion |
| Rate-limit records | 30 days |
| Personal data reports | Until downloaded, or 14 days after the request; also removed on account deletion |
| Report anti-bot checks | One attempt or 10 minutes |
| Last report request time | Until account deletion, to enforce the 7-day limit |
| Notifications and mail delivery logs | 90 days |
| Artwork from a rejected card | Off the site at once; off the disk within 30 days |
| Your account and contributions | Until you delete the account |
| An anonymised account row | Indefinitely — it holds no personal data by then |
Your rights
For a copy of your data, sign in and open Your data from your account. Complete the short anti-bot check to request a report, once every 7 days. We prepare a themed HTML report and email a download link to your verified address. Sign in to the same account to download it. The report is removed from the site when you download it, or automatically expires 14 days after your request if you do not.
You can also ask to correct your data, have it erased, take it elsewhere, or object to how it is used. You can delete your account from your account page. For other requests or help accessing your data, write to contact@snapatk.org and expect an answer within a month.
What deleting your account actually does
- Your email address, display name and password hash are removed.
- Your cards, replies and votes stay, attributed to a deleted account. Erasing them would delete other people's discussion and votes along with them.
- Artwork you uploaded stays, under the CC BY-SA 4.0 licence you granted. That licence is irrevocable, which the terms say before you upload rather than afterwards.
What is erased is the personal data. What remains is a public contribution you licensed to everyone, with your name taken off it.
Children
This service is not for anyone under 13. An account found to belong to someone younger is deleted.