Privacy Policy

Version: 2026-08-21

1. Controller

The controller of personal data processed in this application is App, operated by Caio Felipe Giasson. The privacy contact (LGPD data protection officer equivalent) is the same person, at cainitech@gmail.com.

2. Purposes

We process personal data to:

• create and maintain the user account;
• store, display, and manage images uploaded by the user;
• authenticate sessions and protect the platform (security, abuse prevention, and incidents);
• receive and review reports of content or conduct, and comply with legal duties.

3. Legal bases

Processing is generally based on performance of a contract (the account and image-hosting service) and, where applicable, the data subject’s consent (for example, accepting this policy at registration). Security, prevention of unlawful use, and cooperation with authorities may also rely on legal obligation and on protecting life, dignity, and the rights of others. Additional LGPD/GDPR bases may be invoked after legal review.

4. Categories of data

We may process, among other data:

• account and identity data (name, nickname, email, profile photo);
• authentication credentials (password hash, session/device identifiers);
• user-submitted content (images, titles, descriptions, tags, and visibility flags);
• preferences (theme, language, and other settings);
• essential session, theme, and language cookies needed for the interface to work (we do not use marketing trackers);
• site usage metrics (pages visited, events such as sign-up, login, and table creation, device and browser type), collected by Google Analytics through Google Tag Manager only if you accept in the cookie notice. Without your consent, no analytics cookie is stored. Addresses sent do not include table, invite, or token identifiers. We do not use this data for advertising. You can change your choice by clearing the site data in your browser, which brings the notice back;
• technical records needed for security and operation of the service;
• report and investigation information, when applicable.

5. Retention

Account and image data are kept while the account is active. In short:

• after account deletion (request in your profile), the account enters a 30-day quarantine: content is hidden immediately; if you sign in within that period, you can cancel deletion and restore the account; after the deadline, data is erased irreversibly in the online environment (anonymization and file removal);
• technical session records follow the authentication token’s lifetime;
• operational logs are kept for a limited time (on the order of 90 days in the environment);
• residual orphan files in storage have a cleanup target of about 7 days;
• backups follow their own cycle, managed separately from the online system.

Internal retention details are maintained by service operations. Data strictly required for legal duties or investigation of unlawful activity may be kept as authorized by law.

6. International transfers

Image files and related objects may be stored on DigitalOcean Spaces, region nyc3 (United States). This involves an international transfer to the USA.

The contractual basis for that transfer is DigitalOcean’s Data Processing Agreement, incorporated into the [Terms of Service](https://www.digitalocean.com/legal/terms-of-service-agreement-2023) and accepted when the operator’s DigitalOcean account was created (and, where applicable for EEA/UK data subjects, the Standard Contractual Clauses in that DPA). Operational details live in the operators’ internal documentation; legal review remains recommended.

7. Data-subject rights (LGPD art. 18 / GDPR)

The data subject may request, as provided by law: confirmation of processing; access; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; portability; information about sharing; information about the option not to consent and its consequences; withdrawal of consent; and review of automated decisions, where applicable.

8. Reports and legal cooperation

We may process data to investigate Terms of Use violations, remove content, close accounts, and, when the law requires or allows, share information with competent authorities and entities. Content rules are set out in the Terms of Use.

9. Contact

The privacy contact (data protection officer equivalent under Brazilian LGPD) is Caio Felipe Giasson. To exercise rights or ask privacy questions, use cainitech@gmail.com.