Privacy Policy

Last updated: 11 October 2026

This policy explains what personal data Nagy Gergely Máté (“we”, “us”) collects when you use ShareToPaint at sharetopaint.com (the “Service”), why, and for how long. We are the data controller. We try to collect as little as we can: you can paint without giving us your name or email address.

1. The data we keep

An anonymous identity. Every browser gets a random token (see cookies below). We store a one-way hash of it, together with when it was created and when it was last used. It is not linked to your name.
Your account, if you create one. Your email address, and when you created and confirmed the account. There is no password: you sign in with a one-time link we email you. When you sign in on a device, we keep a record of that session (a hash of its token, and when it started and was last used) so it stays signed in.
Emails we send you. To confirm your address and to sign you in we send one-time links. We store only a hash of each link, with the address it went to and when it expires.
Network information, as a one-way hash. We turn your IP address into a salted, irreversible hash. We keep the hash of the address you first used and of the network you were last seen on, and use them for rate limits, to check invites, and to stop abuse (for example, blocking a network that is being used to attack the canvas). We do not store your raw IP address.
Your artwork. Every pixel on the canvas records who painted it and when. The pixels, and any link you add to pixels you own, are public on the shared canvas.
Ink, owned pixels and purchases. How much ink you have and have spent, which areas you own, your link and when it expires, and a record of each purchase.
Invites. When someone arrives through an invite link, we record who invited whom, when, the visitor’s hashed network, whether the invite counted and how much ink it earned.
Payments. Payments are handled by Stripe, which collects your card details directly. We receive and keep the payment and checkout identifiers, the amount, what you bought, its status and the receipt email address. We never receive your full card number.
Moderation records. If we restrict an account or identity, erase paint, remove a link or block a network, we keep a record of what we did, when, and why.
Technical logs. Our hosting providers automatically keep server logs (which can include IP address, time of the request and browser details) for security and reliability, for a limited time.

2. Cookies and local storage

We only use cookies and browser storage that the Service needs to work. We do not use advertising or third-party tracking cookies, and we do not build marketing profiles.

Name	Type	Purpose	Duration
mp_token	Cookie (essential)	Your anonymous identity, or your signed-in session. Keeps your ink, artwork and purchases linked to you.	About 400 days
mp_ref	Cookie (functional)	Remembers which invite link brought you, so the right person gets the credit.	7 days
mp_token and preferences	Local storage (functional)	A backup of your token (it restores your identity if the cookie is lost), your saved colours, your last ink balance, and which tips and prompts you have already seen. Stays on your device and is not used for tracking.	Until you clear it

3. Why we use your data (legal bases)

To provide the Service you asked for (GDPR Art. 6(1)(b)): running the canvas and your account, sending confirmation and sign-in emails, processing purchases, and paying out invite ink.
Legitimate interests (Art. 6(1)(f)): keeping the Service secure and reliable, preventing fraud and abuse, and moderating the canvas (for example the hashed network checks and the moderation records). We weigh these interests against your rights.
Legal obligations (Art. 6(1)(c)): keeping accounting and tax records of payments, and acting on unlawful content when the law requires it.

We only email you about your account and your purchases. We do not send marketing email.

4. Automatic checks

Whether an invite earns ink is decided automatically, by checks such as how long the visitor stayed, whether they painted, and whether they are on the same network as the person who invited them. These checks only affect invite rewards and have no legal effect on you. If you think one got it wrong, contact us and a person will look at it.

5. Who we share data with

We do not sell your personal data. We use these service providers (processors) to run the Service. Each works under a contract and only on our instructions:

Stripe: payment processing.
Vercel: website and API hosting.
Neon: database hosting.
Upstash: storage for the live state of the canvas.
Cloudflare: real-time canvas updates, image snapshots and scheduled maintenance.
Resend: sending account emails (confirmation and sign-in links).

We may also disclose data where the law requires it, or to protect our rights and users.

6. International transfers

Some of these providers process data outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep data

Anonymous identity, artwork, ink and owned pixels: as long as needed to run the shared canvas.
Account details: until you ask us to delete your account.
Signed-in sessions: until you sign out, and at most about 400 days.
Email links: they stop working after 24 hours (confirmation) or 1 hour (sign-in).
Rate-limit counters: short rolling windows, from minutes to a day.
Invite and moderation records: as long as needed to run the invite program fairly, enforce our Terms, and show what action was taken and why.
Payment and accounting records: as long as Hungarian law requires (generally 8 years).

8. Your rights

Under the GDPR, you have the right to:

access the personal data we hold about you;
have wrong data corrected, or your data erased;
restrict or object to some processing;
data portability; and
complain to the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

To use any of these rights, email nagy.gergely.m@gmail.com. If you have an account, write from its email address so we can find your data. Without an account we only know you by an anonymous token, so we may need more information from you to find your data (GDPR Art. 11).

If you ask us to delete your account, we delete your email address and sessions. Artwork already on the shared canvas stays there without anything that links it to you, under the licence in our Terms. Payment records we must keep by law are kept until that period ends.

9. Children

The Service is not meant for children under 13, and only adults may make purchases. If you think a child has given us personal data, contact us and we will deal with it.

10. Changes to this policy

We may update this policy. The “Last updated” date above shows the current version.

11. Contact

For any privacy question, email nagy.gergely.m@gmail.com.