What we know about you, and what we do not

The short version

We collect what the site needs to work and nothing beyond it. There is no analytics tool on Random Art, no advertising network, no tracking pixel and no third party watching what you read.

We do not sell your personal information, we do not rent it, and we do not hand it to anyone building advertising profiles.

What we collect from artists

Your account: the email address and password you sign up with. The password is hashed by our authentication provider and we never see it.

Your profile: username, display name, biography, avatar and banner. All of it is public by design, because your artist page is meant to be found.

Your work: the files you upload, their titles and descriptions, and whether each one is a draft or published. Files are stored in a private storage bucket and served from it.

Your activity on the site: comments you write, works you favourite, and the projects you create.

If you subscribe to Pro: your subscription status and the identifiers our payment provider gives us. We never see or store your card number.

What we collect from visitors

A view counter, and only that. When a work is opened, we add one to a daily total for that work. We do not store who viewed it, we do not store an address, and we do not build a reading history. An artist can see that a chapter got forty views on a Tuesday, and nothing more.

If you join the waiting list, we keep your email address and the date, so we can tell you when the beta opens.

If you write to us through the contact form, your message goes straight to our inbox by email. It is not stored in the site's database.

Commission clients

An artist using the commission gallery can record a client's name, email address and notes so the platform can send updates about the work.

If you are that client, this information was given to us by the artist you hired, and it is used for nothing except sending you those updates. You can ask us to delete it at any time, and you can ask the artist directly as well.

Cookies

Only the ones that keep you signed in. They are set by our authentication provider, they hold your session, and they disappear when you sign out.

There are no advertising cookies, no analytics cookies and no third party cookies. That is why you have never seen a cookie banner here, and why you never will.

Who else processes your data

Supabase hosts the database, the accounts and the uploaded files.

Vercel hosts and serves the site, and keeps short-lived technical logs of requests, as any web server does.

Stripe processes subscription payments and is the merchant of record for them. Your payment details go to Stripe and never touch our servers.

Resend sends the transactional emails: account confirmations, commission updates, and the messages you send us.

These providers act on our instructions and are not allowed to use your information for their own purposes. Depending on the provider, data may be processed outside Quebec, including in the United States and in the European Union.

Why we are allowed to hold it

Because you asked for a service and we cannot deliver it otherwise: an account needs an email, a page needs the files you uploaded.

Because you consented, for the waiting list and for anything optional.

Because we have a legitimate interest in keeping the platform running and safe, for moderation and for handling reports.

Because the law sometimes requires it, for payment and tax records.

How long we keep it

Your account and your work stay until you delete them. Deleting your account removes your profile, your projects and your files.

Backups can hold a copy for a short period after deletion before they rotate out. Caches outside our control, such as a search engine's, may also hold a copy for a while.

Waiting list emails are kept until the beta opens or until you ask us to remove yours.

Payment and subscription records are kept as long as accounting rules require.

Your rights

You can see what we hold about you, correct it, and have it deleted. Most of it you can do yourself from your settings, without asking anyone.

You can ask for a copy of your information in a structured, commonly used format, and you can withdraw your consent at any time.

Write to us and we will answer within thirty days. If our answer does not satisfy you, you can file a complaint with the Commission d'accès à l'information du Québec.

Security, and what happens if it fails

Access to the database is restricted row by row, so one artist cannot read another artist's drafts. Connections are encrypted. Payment details never reach us.

No system is perfect. If a breach happens that presents a risk of serious harm, we will notify the people affected and the Commission d'accès à l'information, as the law requires, and we will say what happened rather than hide it.

Children

Random Art is not built for children under 13 and we do not knowingly collect their information. If you believe a child under 13 has an account, tell us and we will remove it.

No automated decisions

Nothing here decides anything about you automatically. Moderation, removals and bans are decided by a human who looked at the case.

Who is responsible, and changes to this page

Eric Ouellette is the person responsible for the protection of personal information at Random Art, and can be reached through the contact page.

When this page changes in a way that matters, we will update the date at the top and tell account holders by email before it takes effect.