Privacy

We keep data collection minimal, but we are honest about the parts that exist. Browsing the free library needs no account and sets no tracking cookies. Saving prompts and unlocking premium require an account, and that involves storing some data, described below.

Accounts

You can create a free account with email and password, a one-time email link, or Google sign-in. When you do, we store your email address, an account identifier, and the prompts you like. Authentication is handled by Supabase (hosted in the EU) acting as our data processor; your session is kept in your browser (local storage / an auth token) so you stay signed in. We never see or store your password in readable form.

Purchases

Premium is sold by Polar Software, Inc. as merchant of record. Your card details go to Polar and their payment processor; we never see them. After payment Polar tells us your email address, the amount, and an order reference so we can unlock your account and prove you bought it. That is the entire set of purchase data we hold.

The community wall

Anything you pin on /draw is public: the drawing, the caption and the link you attach. Do not draw anything you would not put on a noticeboard. Alongside it we store a one-way hash of your IP address, salted with a secret only our server holds, so that we can count how many drawings came from one place in a day and stop the wall being flooded by bots. It is not readable by anyone visiting the site, it cannot be turned back into your address, and it is used for nothing else. Ask us and we will remove your drawing.

Logs & analytics

Our hosting provider processes standard server logs (IP address, user agent) to serve and secure the site. We also keep a cookieless, anonymous count of how often each prompt is opened — only the prompt identifier and a timestamp, never your IP, identity, or any personal data — so the library can order itself by what people actually find useful. Saved prompts are tied to your account only when you choose to save one while signed in.

Who processes your data

Data controller: Byggarn, Sweden (hi@byggarn.se). We use these processors, and no others:

• Supabase — authentication and database, hosted in the EU (Stockholm).
• Vercel — hosting and server logs. USA.
• Polar Software, Inc. — payments and merchant of record. USA.
• Google — only if you choose Google sign-in. USA.

The US processors are covered by the EU-US Data Privacy Framework and standard contractual clauses. The only personal data that reaches them is your email address and, for Vercel, ordinary request logs.

How long we keep it

Account data lives until you delete your account, after which it is removed within 30 days. Purchase records (email, amount, order reference) are kept for as long as accounting rules require and so we can honour lifetime access — deleting your account removes the account but not the proof that a purchase happened. Anonymous prompt-view counts have no personal data in them and are kept indefinitely.

Your rights

Under the GDPR you can access, correct, export, or erase your data, including deleting your account, any time at hi@byggarn.se. You can also complain to the Swedish authority, Integritetsskyddsmyndigheten (IMY), if you think we have got this wrong.