Privacy Policy

Spill & Sketch makes fake coffee spills and lightning scorches for you to print and draw on, and has a gallery of finished drawings. It's a free hobby project run from Canada. This page explains what it collects, why, and what you can do about it.

1. What we collect

• Making spills: nothing. Spills are made in your browser. A share link carries the spill after the # in the address, a part browsers never send to our server.
• Google sign-in: your Google account ID, name and email address. Google also sends your profile photo, which we throw away without storing it. We don't keep the tokens that would let us use your Google account.
• Your profile: the profile name you pick and when you agreed to these terms.
• Saved spills you choose to save.
• Uploads: the photo or scan of your drawing, the spill it was drawn on, any title you add, and when you uploaded it. We remove all hidden data from the photo (including camera details and location) and resize it, then delete the original file.
• Guest uploads: you get a private delete link. We keep only a scrambled (hashed) copy of its code, which can't be turned back into the link.
• Reports: the reason you pick and any note you add. To stop the same person reporting a drawing twice we keep a scrambled code made from your IP address, not the address itself.
• Technical details: your IP address and browser type, recorded with your sign-in session, used briefly to limit how often uploads and reports can be sent, and kept for a short time in our host's server logs.

2. How we use it

To sign you in, show your uploads in the gallery, keep your saved spills, moderate uploads, and stop spam and abuse. Every upload is checked by an automated filter for nudity, which runs on our own servers, and may be looked at by a person before it's published. We don't sell your information, show ads, or use analytics or tracking.

3. What other people see

• Approved uploads are public: the drawing, the spill under it, its title and your profile name.
• Guest uploads show no name.
• Your Google name and email address are never shown to anyone else.

4. Who else handles your information

• Google, for sign-in. Google's privacy policy
• Vercel, which hosts the site and stores uploaded images. Vercel's privacy policy
• Neon, which hosts the database. Neon's privacy policy
• Upstash, which counts requests to enforce upload and report limits.
• Cloudflare, which checks guest uploads aren't from bots (Turnstile) and runs our domain's DNS. Cloudflare's privacy policy

Your information is stored and processed in the United States, where it may be accessible to US authorities.

5. Cookies and browser storage

One sign-in cookie that keeps you signed in for up to 7 days and renews while you use the site, plus short-lived security cookies during sign-in. Your browser also remembers whether you've seen the how-to demo. No advertising or tracking cookies.

6. How long we keep it

Until you delete it or ask us to. Deleting your account removes your profile, saved spills and uploads. Rejected uploads are deleted within a week. Guest uploads stay until you use the delete link or we remove them. Copies in backups and logs can last a little longer before they're cleared. Signing out doesn't delete anything.

7. Your rights

Under Canadian privacy law you can ask to see the information we hold about you, correct it, or delete your account. There's no delete button yet, so email chris@chrismcg.ca from the address you sign in with, and we'll reply within 30 days. You can also complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

8. Children

Spill & Sketch isn't for children under 13. If a child has made an account, tell us and we'll delete it.

9. Changes

If we change this policy in a way that matters, you'll be asked to agree again the next time you sign in.

10. Contact

Spill & Sketch, chris@chrismcg.ca

See also the Terms.