Privacy Policy

This Privacy Policy explains how Handmade Hearts ("we", "us" or "our") collects, uses, stores and protects personal information when you visit the site or use your account. It's here to inform you: you don't give up any rights by reading it, and simply visiting the site doesn't mean you consent to anything. Where the law asks us to rely on your consent for something, we ask for it separately.

1. Who is responsible for your information

Handmade Hearts is run by one person, the operator, who is responsible for the personal information described here (the "controller" in the language of laws like the GDPR).

The operator's name and postal address are available on request through the contact address below.

Contact for anything in this policy, including requests about your data: [email protected] (see also Contact & Reporting).

2. What we collect

When you sign up:

• your email address and username;
• your password, which is stored only in a scrambled one-way form (a hash) that can't be turned back into the password;
• your date of birth, to check that you are at least 18. It is never shown on your profile;
• your gender, which is shown on your profile;
• the country you are in, used only to apply regional registration rules. It is never shown on your profile;
• the date you joined, the invitation code you used (while sign-up is invitation-only), and the times you agreed to the Terms and confirmed that you are at least 18.

What you choose to add to your profile and post: display name, bio, interests, the place you pick as your location (chosen from a list of towns and regions; we store that place and its approximate coordinates, never your device's location), links to your website or social accounts, your profile picture, header image, ProfiButton and photos, your theme, colours and custom CSS, and everything you post: guestbook entries, Personals (and your status, a copy of one of them, if you set one), Heartbeats with their comments and pictures, ProfiRings (names, descriptions, cover images, badges and group chat), your Plaza character's look, the Plaza photos you keep and the postcards you send.

Your private activity: private messages (their text, when they were sent, edited and read), your fellows and the history of fellow requests between you and others (who asked whom, when, and how it was answered), your favorites, the Heartbeats you bookmark, the people you block, the conversations you hide, the hearts and likes you give, the reports you file and the reports filed about you, and your settings.

Supporter payments: if you join the Supporter membership, Ko-fi sends us a notice of each payment with the email address you used on Ko-fi, the message you typed (your username, so we can match the payment), the amount and currency, the type of payment, Ko-fi's transaction number and the date. We never receive your card or bank details.

Technical information:

• Every visit passes through Cloudflare, our network provider (see section 5), before it reaches our server. Cloudflare uses your IP address to work out which country you're connecting from, so that it can block visits from the United Kingdom and Australia (see section 11), and to protect the site against attacks and automated abuse. For this it can also set short-lived security cookies (see the Cookie Policy).
• Our web server keeps standard logs of the requests it receives: your IP address, the date and time, the page asked for, and your browser's description of itself (its "user agent"). They are deleted automatically after about 14 days.
• To stop password guessing, spam and scraping, we briefly count requests and failed logins per IP address and per account. These counters live only in the server's memory cache and expire on their own, after somewhere between a minute and 24 hours.
• If a date of birth under 18 is entered at sign-up, that browser gets a cookie for 30 days and that IP address is kept in the cache for 24 hours, so sign-up is paused (see the Cookie Policy). The date of birth itself is not kept.
• When you log in, we keep a session (a record that you're logged in) and the time of your last login.

The Plaza: chat in the Plaza and in club rooms is never stored or logged; positions and what's happening in a room exist only in the server's memory while people are there. For members, the look your character last wore is saved. If you keep a photo from a photo booth, we save the picture (a small pixel-art image), the day and the names of who was in it; photos nobody keeps are never saved. A postcard is saved with its note until your fellow throws it away or takes it down. Photos you show on your profile, and postcards you put up in your guestbook, are seen by anyone who can see your profile. Guests (visitors without an account) appear under a random guest number, and we keep nothing about them; the number of guests per IP address is counted in memory to keep things fair.

What we don't collect: we don't put analytics or advertising tools, tracking pixels or social-media plugins on our pages, we don't read your device's location, contacts or files, and we don't ask for identity documents.

3. Why we use it, and on what basis

• To run the service you signed up for: your account, profile, posts, fellows, private messages, notifications and the other features (because it's necessary to provide the service under the Terms).
• To keep the community adults-only and follow regional rules: checking age at sign-up, pausing under-18 sign-ups, applying registration restrictions and blocking visits from the United Kingdom and Australia (to comply with legal obligations, and in our legitimate interests in protecting young people and in not offering the site where we can't meet the local rules).
• To keep people safe: handling reports, moderating content, enforcing the Terms and the Safety Rules, filtering insults and screening uploaded photos, limiting repeated fellow requests (in our and our members' legitimate interest in a safe community, and to meet legal obligations).
• To keep the site secure and working: server logs, rate limits, login protection, Cloudflare's protection against attacks, and backups (legitimate interest in security and in not losing members' data).
• To send account emails: email confirmation and password reset emails. We don't send newsletters or marketing emails (necessary for the service).
• To run the Supporter membership: matching payments to accounts and applying perks (necessary for the service), and keeping payment records (to meet tax and accounting obligations).
• To meet legal requirements: answering valid legal requests and protecting the rights and safety of members and others.

We don't sell, rent or trade personal information, we don't build advertising profiles, and nothing is ranked or recommended to you by an algorithm. No decision with legal or similarly significant effects on you is made by automated means alone: the automatic filters only mask words and refuse images (see section 7), and a person decides on reports and account closures.

4. Who can see what

• Anyone, including visitors who aren't logged in (these pages are not offered to search engines): Browse results (display name, picture, location and interests), Personals, your status if you set one (which anyone can also show on their own website, like a ProfiRing badge), the list of ProfiRings and each ring's page, published Heartbeats with their comments, ProfiRing badges (which anyone can put on their own website), and in the Plaza, members' names, characters and chat while they're there.
• Logged-in members: your full profile (bio, photos, gender, location, links, guestbook, hearts, ProfiRings and ProfiButtons), your heart on the Kindred Hearts map unless you keep it off the map, and the Supporters Wall if you are a Supporter. Members you've blocked, and members who blocked you, can't see your profile.
• Only you, and the other person involved: your private messages (the other person can also see when you've read their messages), your fellows (each fellow knows you're fellows; the list itself is visible only to you), fellow requests, favorites, bookmarks, blocks and settings. Your email address, date of birth and country are never shown to other members.
• The operator and moderators: moderators can see reports and the account details needed to act on them. The operator has technical access to the whole database, including private messages, which are not end-to-end encrypted. We don't read messages as a matter of routine; we look at them only when we need to, for example to investigate a report or a safety concern, to fix a technical problem, or when the law requires it.

Please don't put anything on your profile or in posts that you don't want other members or visitors to see.

5. Service providers, and when information is shared

We use a small number of services to run the site. They only get what they need:

• Our hosting provider, which rents us the server (a virtual private server) where the site, its database, uploaded photos and backups are stored.
• Cloudflare (Cloudflare, Inc., United States), our network provider. Every visit to the site passes through Cloudflare's servers, so Cloudflare handles your IP address, your browser's details and everything exchanged between your browser and the site, including what you post and send. It uses this to deliver the pages, to protect the site against attacks and automated abuse, and to block visits from the United Kingdom and Australia. Cloudflare keeps its own records of this traffic for a limited time, and shows us traffic statistics and the requests its security rules blocked or challenged. It handles this information under its data processing terms with us and its own privacy policy.
• Resend (run by Plus Five Five, Inc., United States), which delivers our account emails. It receives your email address and the content of the email (for example, a confirmation link), and handles them under its data processing terms.
• Ko-fi (Ko-Fi Labs Limited, United Kingdom) handles Supporter payments as an independent service with its own privacy policy. You give your payment details to Ko-fi, not to us; Ko-fi sends us the payment notice described in section 2.

Pages on Handmade Hearts don't load anything from other websites: fonts and scripts come from our own site. Your browser only contacts another site if you choose to, for example by following a link to a member's website or to Ko-fi, or by loading a picture that a Heartbeat links from another site (those pictures only load when you ask for them). That site then receives your IP address and browser information, under its own privacy policy.

Apart from these services, we only share personal information when the law requires it (for example, a valid court order), when it's necessary to protect someone's life, safety or rights (for example, reporting the sexual exploitation of a minor to the authorities), or with your permission. If Handmade Hearts were ever handed over to a new operator, we would tell members in advance, and you could delete your account before it happened.

International transfers: your information is stored on our server and may be handled in other countries where our service providers work, including the United States (Cloudflare and Resend). Cloudflare handles each visit in one of its data centres near you, which may be in another country. Those countries may have different data protection laws from yours. The data processing terms of Cloudflare and of Resend include the European Union's Standard Contractual Clauses, and both companies are certified under the EU-U.S. Data Privacy Framework.

6. How long we keep it

• Your account, profile and posts: until you delete them or your account, or until we close the account.
• Private messages: until the sender deletes them, until either of the two accounts is deleted, or until they become older than the most recent 500 messages of that conversation, which happens automatically. ProfiRing group chats keep their most recent 500 messages in the same way.
• Fellows and fellow requests: a fellowship lasts until either of you ends it; the history of fellow requests between two members is kept while both accounts exist, because the limits on repeated requests depend on it.
• Reports and moderation records: kept after either account is deleted (with the link to the deleted account removed) for as long as they're needed for the safety of the community, to prevent repeated abuse, or for legal reasons.
• Accounts closed for breaking the rules: may be kept, deactivated, for as long as needed to stop the person from coming back, to deal with disputes, or to meet legal obligations.
• Supporter payment records: kept for as long as tax and accounting rules require, even after the account is deleted (with the link to the account removed).
• Server logs: about 14 days. Backups of the database and uploaded photos: 28 days, then deleted automatically.
• Cloudflare's traffic records: kept by Cloudflare for a limited time, as described in its own privacy policy. Its security cookies are short-lived (see the Cookie Policy).
• Security counters: from a minute up to 24 hours. Under-18 sign-up pause: 24 hours for the IP address; the cookie stays in your browser for 30 days unless you clear it.
• Login sessions: until you log out, or for up to 14 days.

What happens when you delete your account is set out in detail in the Account Deletion Policy.

7. Automated content screening

• Text filtering: text you post passes through an automatic filter that replaces words from a list of insults and slurs with "*" symbols, and refuses usernames and some names that contain them. It works on a best-effort basis without a person checking each message, and nothing about it is stored separately.
• Image screening: photos you upload (profile pictures, gallery photos, header images, ProfiRing covers and Heartbeat pictures) are checked for nudity by detection software (NudeNet) that runs entirely on our own server. No photo is sent to an outside service for this. A flagged photo is refused and not stored. The check is best-effort and can be wrong; if the checker is unavailable, a photo may be accepted without being checked.

8. Security

The site is served over an encrypted connection (HTTPS), and Cloudflare screens traffic for attacks before it reaches our server. Passwords are stored only as hashes, logins are protected against guessing, the administration area has extra protection, and access to the server and its backups is limited to the operator. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a security incident puts your information at risk, we will tell you, and the authorities where the law requires it.

9. Your rights

Depending on where you live, you have rights over your personal information, such as the right to:

• see what we hold about you and get a copy of it;
• have it corrected if it's wrong;
• have it deleted (you can delete your account yourself at any time);
• object to or ask us to limit how we use it, or ask us to stop using it;
• receive the information you gave us in a commonly used format; and
• withdraw any consent you gave, at any time.

You can change most of your information yourself on the Edit My Profile and Settings pages. For anything else, email [email protected], preferably from the address on your account, so we can confirm the request is really from you. We answer without undue delay and within one month at the latest (if a request is complex, we may need longer and will tell you why).

If you're unhappy with how we handled your information, please tell us first, so we can try to put it right. You also have the right to complain to a data protection authority, for example the one in the country where you live (in the European Union, your national data protection authority; in Japan, the Personal Information Protection Commission).

10. Children

Handmade Hearts is only for adults aged 18 and over, and not for high school students. We don't knowingly collect information from anyone under 18. If a date of birth under 18 is entered at sign-up, no account is created and sign-up is paused as described above. If we learn that an account belongs to someone under 18, we restrict it immediately and then close it, as described in the Terms. If you believe a child is using the site, please tell us.

11. Countries where the site isn't available

Visits from the United Kingdom and Australia are blocked. Cloudflare checks which country each visit comes from, using its IP address, and turns away visits from those countries before they reach our server. We don't keep the result of that check; Cloudflare's own records are described in section 5.

Registration also isn't available to people located in Japan, the United Kingdom and Australia. This is based on the country you tell us at sign-up. The country you give is stored with your account and is visible only to the site's administrator.

12. Cookies and browser storage

We only use cookies and browser storage that the site needs to work (for example, to keep you logged in and to protect forms), plus a few remembered preferences that you set yourself. Cloudflare can also set short-lived security cookies to protect the site. There are no tracking or advertising cookies. The Cookie Policy lists every one of them.

13. Changes to this policy

We may update this policy as the site changes. The "Last updated" date at the top shows when it last changed, and we will announce important changes on the site before they take effect.

14. Contact

For questions or requests about this Privacy Policy or your personal information, write to [email protected] or see Contact & Reporting.