Privacy Notice

This notice explains what personal information we hold, why, and what rights you have.

What we process

• Email address — used to sign in, confirm your account and reset your password. Never publicly displayed.
• Username and profile — your username, statement and any profile details you add. Public.
• Uploaded artwork — images and their title, description, medium and year. Public unless hidden by an administrator.
• Upload country — an approximate country for each upload, worked out from the network address the upload came from, or chosen by you on the upload page. It is the country the artwork was uploaded from, not your nationality or where you live. Public (country only, shown as a flag and country name).
• Upload IP address — the network address the upload came from, recorded with the date and time. Kept only for security, abuse prevention, moderation and legal compliance. Never public: visible only to administrators, and erased automatically after a set retention period (currently 90 days) unless the record is held for an ongoing abuse, security or legal matter.
• Ratings and favourites — kept private to you; only aggregate totals per artwork are public.
• Reports — the artwork, reason and details you submit. Private, visible to you and administrators.
• Contact form submissions — your name, email, subject and message. Private, visible to administrators.
• Authentication and security records — account timestamps and sign-in metadata kept by our authentication provider.
• Administrative records — a log of events such as registrations, uploads (with file size), reports, contact submissions and account deletions, plus a record of the policy versions you accepted at registration. Private to administrators.

We do not run advertising, marketing emails, behavioural profiling or tracking analytics, and we do not ask for your date of birth or any other information we do not need.

Why, and our lawful bases (UK GDPR)

• Contract — creating and running your account, hosting and displaying your artwork, ratings and favourites.
• Legitimate interests — keeping the gallery safe and lawful: moderation, reports, administrative logs, security and abuse prevention, and responding to contact messages.
• Legal obligation — where we must keep or disclose information by law.

Service providers

Our database, authentication, file storage and hosting are provided by Supabase and our hosting platform (Lovable), who process this information on our behalf under contract. Confirmation and password-reset emails are sent through our email provider. Data may be hosted outside the UK with appropriate safeguards in place.

Retention and deletion

We keep your account information for as long as your account exists. Deleting your account from the Studio permanently removes your profile, artwork, stored image files, ratings, favourites, reports and your policy acceptance record. Administrative log entries are kept as a security record. Backups are overwritten in the ordinary course.

Security

Access is protected by authenticated accounts, database row-level security rules and access controls; artwork files are served through signed, time-limited links. Private information such as contact messages and administrative logs is restricted to administrators.

Your rights

Under UK data protection law you can ask for access to your information, correction, deletion, restriction, objection, and portability, and you can withdraw consent where processing relies on it.

Children

Truth Focal is not for children under 13. If we learn an account belongs to someone younger, we will remove it.

Changes

Updates appear here with a new version number and date.