Who is responsible

[legal name not set], trading as MyWorldsArt, decides how the information described here is used, and is the data controller for it. You can reach us at myworldsart@gmail.com.

What we collect

Only what an account needs in order to work:

• Your account — the display name you choose, your email address, whether that address has been confirmed, and your password stored only as a cryptographic hash. We never hold your password itself and cannot tell you what it is.
• Your sign-ins — each active session, when it expires, and the IP address and browser description it was created from. That is what lets you stay signed in and lets us end a session you no longer want.
• Abuse counters — how many times sign-in, sign-up and password-reset have been attempted from an IP address recently, so that guessing a password in bulk does not work.
• Your subscription — an identifier from our payment provider, the status of the subscription and its renewal or end dates.
• Access tickets — short-lived tokens, stored hashed, that let a MyWorldsArt project confirm your access without handling your password.

What we never collect

Card details never reach this site. Payment is handled entirely by Paddle.com Market Ltd, which is the seller of record; we receive only a customer reference and whether the subscription is paid.

There are no analytics, no advertising trackers, no third-party embeds that watch you, and no profiling or automated decisions about you. We do not sell or share your information with anyone for their own purposes.

Cookies

This site sets one cookie: the session cookie that keeps you signed in. It is strictly necessary for a feature you asked for, so there is nothing to consent to and no banner to click. Sign out and it is gone.

Who else processes it

These companies handle some of this information on our behalf, and only on our instructions:

• Paddle — payments, invoicing and tax, as Merchant of Record.
• Neon — hosts the database holding accounts and subscription records.
• Vercel — hosts and serves this site.
• Resend — delivers password-reset and confirmation email.

How long we keep it

• Sessions expire after 30 days, and sooner if you sign out.
• Password-reset links last one hour and work once.
• Email confirmation links last 24 hours.
• Access tickets last minutes, and no account holds more than ten at a time.
• Account and subscription records are kept while your account exists. Records of payments may have to be kept longer, by our payment provider, to satisfy tax and accounting law.

How it is protected

Passwords are hashed, never stored in a readable form. Every request checks your session against the database rather than trusting a signed copy, so signing out takes effect immediately. Resetting a password signs out every other session, so a stolen session cannot survive the recovery it forced. The site is served only over HTTPS.

Your choices

• See or correct it — your account page shows what we hold, and your display name can be changed there at any time.
• Delete it — email myworldsart@gmail.com and we will delete your account and its data. There is no self-service delete button yet; asking us is currently the way.
• Object, or ask for a copy — email the same address and we will respond.

Children

Accounts are not intended for children under 13. If you believe a child has created one, tell us and we will remove it.

Changes

If this policy changes in a way that matters, we will say so on this page and, where the change affects subscribers, by email.