Privacy Policy

This policy explains how we handle your personal data. The data controller is Photon Consulting Limited, trading as SquareWave Studio, an Irish company registered with the Companies Registration Office under number 702545, registered address Ashbourne, Co. Meath, A84 D925, Ireland. We process personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

What we collect

• Account data: your email, display name, handle, and password (hashed).
• Social sign-in: if you use social sign-in, that provider gives us your email, name and avatar reference. We support Discord, Google, GitHub and Apple; the options shown on the sign-in page are the ones currently enabled.
• Content and activity: what you upload, like, follow, and your profile.
• Technical data: IP address and request logs (for security and abuse prevention), anonymous aggregate analytics, and, with your consent, richer product analytics.

Why, and our legal bases

• To provide your account and the Service (performance of a contract, Article 6(1)(b)).
• To keep the Service secure and prevent abuse, including bot protection and content moderation (legitimate interests, Article 6(1)(f)).
• To send service emails such as verification and, if you opt in, a followed-creator digest (contract / consent).
• For anonymous, cookieless analytics that stores nothing on your device and uses only a temporary identifier that does not persist or recognise you across pages or visits (legitimate interests, Article 6(1)(f)).
• For richer product analytics that uses cookies and an identifier, only where you have consented (consent, Article 6(1)(a); see Cookies).
• To meet legal obligations where they apply (legal obligation, Article 6(1)(c)).

Who processes it for us

We use the processors below. Where a provider is outside the EEA, that transfer relies on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

• Cloudflare (US): hosting, database (D1), file storage (R2), edge logs, image handling, and Turnstile bot protection.
• PostHog (EU region): anonymous aggregate analytics without cookies, and richer product analytics after you consent.
• Resend (US): sending transactional email.
• Anthropic (US): automated safety review of uploaded content, cover images and comments (see Automated moderation below).
• Discord, Google, GitHub or Apple (US): whichever social sign-in provider you choose, if you use social sign-in.

Authentication and sessions run in our own database (Better Auth), not a separate processor.

Automated moderation

To keep the community safe, text you submit (such as titles, descriptions and comments) and cover images may be screened by automated tools, including AI provided by Anthropic. This is not a decision based solely on automated processing that produces legal or similarly significant effects: flagged or uncertain content is held for a person to review. You can ask us to review any moderation decision that affects you.

Retention and deletion

We keep account data while your account is active. You can export your data at any time from your settings, and delete your account there too. When you delete your account we erase your personal data (your profile, sessions, sign-in credentials, app tokens, likes, follows and collections). You choose what happens to your uploads: either keep them published, relicensed to CC0 with your name shown as "Deleted user", or remove them and purge their files. Comments you posted are kept for thread continuity but anonymised to "Deleted user". Security and request logs are retained for a maximum of 90 days.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, to object to processing, to withdraw consent, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. To exercise any of these, contact hello@squarewave.studio. You can also complain to the Irish Data Protection Commission (dataprotection.ie); if you are in another EU country you may instead contact your local supervisory authority.

International transfers and children

Some processors are outside the EEA (see the list above); those transfers rely on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. The Service is not directed at children under 16, the digital age of consent in Ireland under the Data Protection Act 2018.