Privacy Policy

Arcane Portraits (arcaneportraits.com) is run by Jakub Warchoł, based in Poland (“we”). For anything in this policy, contact jw@redwoods.tech. We are the data controller for the personal data described below.

• Email address. If you sign in, we store your email address to operate magic-link login. There are no passwords.
• Your content. Saved portrait prompts (title, chosen traits, and the generated prompt text) and reusable templates. These stay private to your account unless you explicitly publish a prompt, which makes it visible to anyone at its share link and in the public gallery.
• “Describe” text. If you use the describe-your-character feature, the description you type (up to 2,000 characters) is sent from our server to an AI provider — Google (Gemini) or Anthropic (Claude) — solely to map it onto trait selections. We do not store the description, and it is never linked to your account by us.
• Usage analytics. Only if you accept the cookie banner, we use Google Analytics 4 to understand how the site is used: page views and product events such as generating, copying, saving, or sharing a prompt. Google Analytics sets cookies and processes your IP address and device information on Google’s infrastructure. If you decline, nothing is loaded from Google.
• Technical logs. Our server keeps short-lived request logs (including IP addresses) for security, debugging, and rate limiting.

You can use the generator and browse the library, gallery, and shared prompts without an account.

• To provide the service you asked for (Art. 6(1)(b) GDPR): login, saved history, templates, and sharing.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the service secure and preventing abuse.
• Your consent (Art. 6(1)(a) GDPR): usage analytics, which run only after you accept the cookie banner. You can withdraw consent at any time via the “Cookies” link in the footer; the site works fully without analytics.

• Supabase — database and authentication, hosted in the EU (Frankfurt, Germany).
• Hetzner — application hosting, in Germany.
• Google — analytics (Google Analytics 4), and the Gemini API when the describe feature runs on it. Google may process data outside the EU under the EU–US Data Privacy Framework.
• Anthropic — the Claude API, only when the describe feature runs on it, and only receiving the description text itself.

We never sell your data or share it with anyone beyond these processors.

• Authentication cookies (Supabase) — strictly necessary to keep you signed in. Set only when you log in.
• Analytics cookies (Google Analytics) — set only if you accept the cookie banner. You can change your choice at any time via the “Cookies” link in the footer.

Your account data and content are kept until you delete them. You can delete individual prompts and templates at any time, or delete your entire account — with everything in it — from your history page. Server logs rotate automatically and are not kept long-term.

Under the GDPR you can ask for access to your data, correction, deletion, a portable copy, or restriction of processing, and you can object to processing based on legitimate interests. Email jw@redwoods.tech and we’ll respond within a month. You also have the right to lodge a complaint with your local supervisory authority (in Poland: the UODO).

If this policy changes materially, we’ll update the effective date above and, where the change affects signed-in users, note it on the site.