Privacy Policy

Last updated: 6 September 2026

This Privacy Policy explains how Nagy Gergely Máté (“we”, “us”) collects and uses personal data when you use ShareToPaint at sharetopaint.com (the “Service”). We are the data controller for this processing. We aim to collect as little personal data as possible.

1. The data we process

An anonymous identifier. To let you draw without an account, we assign a random token stored in your browser (see cookies below). It is not linked to your name or real-world identity.
Your IP address, as a one-way hash. We use your IP address to compute a salted, irreversible hash for rate-limiting and anti-fraud (for example, to detect self-referrals and abuse). We store the hash, not your raw IP address.
Payment information. When you buy ink, seal artwork, or renew a link, payment is handled by Stripe. Stripe collects your name, email, and card details directly; we receive only limited confirmation data (such as a payment/session identifier, amount, and status). We never receive or store your full card number.
Your artwork. The pixels you paint, and any link you attach to artwork you own, are stored and displayed publicly on the shared canvas.
Your ink balance and deeds. We store how much ink your token holds, when it last regenerated, how much you have spent in total, and which regions of the canvas you own. This is held against your anonymous token, not against your identity.
Technical logs. Our hosting and infrastructure providers automatically generate server logs (which may include IP address, request time, and device/browser information) for security and reliability, retained for a limited period.

2. Cookies and local storage

We use only cookies and browser storage that are necessary to run the Service. We do not use advertising or third-party tracking cookies, and we do not build marketing profiles.

Name	Type	Purpose	Duration
mp_token	Cookie (essential)	Your anonymous identity, so your artwork, ink balance and deeds stay linked to your browser.	~400 days
mp_ref	Cookie (functional)	Remembers which referral link brought you, so credit reaches the right person.	7 days
mp_token / mp_custom_colors / mp_intro_seen	Local storage (functional)	A backup of your identity token, your saved custom colours, and whether you have seen the intro. The token backup is what restores your ink balance and deeds if the cookie is lost. Stored on your device; not used for tracking.	Until you clear it

3. Why we process your data (legal bases)

Performance of a contract (GDPR Art. 6(1)(b)) — to operate the canvas, process your purchases, and award referral ink.
Legitimate interests (Art. 6(1)(f)) — to keep the Service secure and reliable and to prevent fraud and abuse (for example, the hashed-IP rate limits). We balance these interests against your rights.
Legal obligation (Art. 6(1)(c)) — to keep accounting and tax records of payments as required by law.

4. Who we share data with

We do not sell your personal data. We use trusted service providers (processors) to run the Service, each acting under contract and only on our instructions:

Stripe — payment processing.
Vercel — website and API hosting.
Neon — database hosting (the system of record).
Upstash — the live canvas state store.
Cloudflare — real-time updates and image snapshots.

We may also disclose data where required by law or to protect our rights and users.

5. International transfers

Some of our providers process data outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

6. How long we keep data

Anonymous identity, artwork, ink balance and deeds — for as long as needed to operate the shared canvas.
Hashed-IP anti-fraud counters — for short, rolling windows (typically hours to days).
Payment and accounting records — for the period required by Hungarian law (accounting documents are generally retained for 8 years).

7. Your rights

Under the GDPR, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected, or your data erased;
restrict or object to certain processing;
data portability; and
lodge a complaint with the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (NAIH, naih.hu).

To exercise any of these rights, contact us at nagy.gergely.m@gmail.com. Because we identify you only by an anonymous token, we may be unable to locate your data without additional information from you, and in some cases may ask you to provide it (GDPR Art. 11).

8. Children

The Service is not directed to children under 13, and purchases may only be made by adults. If you believe a child has provided us with personal data, contact us and we will address it.

9. Changes to this policy

We may update this policy from time to time. The “Last updated” date above reflects the current version.

10. Contact

For any privacy question, email nagy.gergely.m@gmail.com.