Privacy Policy
Which personal data Draw Them All Dex processes, why, who it is shared with and what rights you have.
Who is responsible
Beyond Development CR (“we”), based in Costa Rica, is the controller of the personal data processed by Draw Them All Dex (drawthemalldex.com, “the site”).
Contact for any privacy matter: info@bedevcr.com.
What data we process
We only process what the site needs to work. We never ask for your real name, phone number or date of birth.
| Category | Data | Source |
|---|---|---|
| Account | email address, username, password (always stored as a hash, never in clear text), display name, bio, language, theme | you |
| Sign in with Google | your Google identifier, the name and avatar Google gives us, and the tokens needed to keep the link | Google, with your authorisation |
| Session | IP address and browser (user agent) of each open session, so you can see and close sessions from your profile and so we can detect abuse | your browser |
| Activity | artworks you upload (image, title, description, licence), comments, shinies (✦) given and received, game rounds, experience (XP) and level, reports you send | your use of the site |
| Moderation | the scores returned by the automatic moderation systems for each artwork you upload | moderation providers (see below) |
| Site usage | aggregated reading metrics (page views, “was this useful?” votes) with no cookies or personal identifiers | your browser |
Before storing an image we strip its EXIF metadata (location, device).
Why we use it and on what basis
- Providing the service (account, public profile, gallery, game, XP): performance of the contract you accept when you sign up.
- Moderating content and handling reports and claims: legitimate interest in keeping the community safe, and legal obligations regarding unlawful content.
- Security (rate limits, abuse detection, session log): legitimate interest.
- Transactional email (email verification, password reset): performance of the contract. We send no newsletters or advertising.
- Aggregated metrics: legitimate interest in improving the site; they cannot identify you.
We make no automated decisions with legal effects on you. Automatic moderation may reject an artwork; you can appeal the decision within 30 days of the rejection.
Who we share it with
We do not sell personal data or hand it over for advertising. We work with these providers, which process data on our behalf under contract:
| Provider | Purpose | Where |
|---|---|---|
| Cloudflare, Inc. | hosting, database, image storage and delivery, rate limits, metrics, detection of child sexual abuse material (CSAM) through hash matching, and automatic image moderation (Workers AI) | global network, headquartered in the US |
| Google LLC | Sign in with Google (only if you choose it) and web fonts | US |
| Resend, Inc. | transactional email | US |
| Sightengine SAS | automatic image moderation: checks every artwork you upload for sexual content, violence, gore or hate symbols. It receives only the image, never your account data | France (EU) |
If we add another image-moderation provider in the future, we will update this table before using it.
We may also disclose data where the law requires it (for example, a court order) or to report unlawful material to the competent authorities.
How long we keep it
- Account and content: while the account is active. If you deactivate it, it stays paused for 30 days (you can reactivate by signing in) and is then deleted.
- Sessions: until they expire or you close them.
- Images rejected by automatic moderation: 30 days from the rejection, so you can appeal; if you do, until the appeal is resolved. Then the file is deleted.
- Moderation verdicts and reports: while the artwork they refer to exists, and up to 12 months afterwards if there was a claim.
- Backups: up to 30 days after deletion.
Artworks published under a Creative Commons licence may keep circulating outside the site under that licence even after you delete your account; that is part of what the licence allows.
Your rights
You can access your data, correct it, ask for its deletion, object to processing, or obtain a portable copy. From your profile you can edit your data and deactivate the account. For everything else, write to info@bedevcr.com from your account email; we answer within 30 days.
If you live in Costa Rica you may contact the Agencia de Protección de Datos de los Habitantes (PRODHAB). If you live in the European Economic Area, the supervisory authority of your country.
Minors
The site is for people aged 14 or over. By signing up you declare you are at least that age. If we find an account belonging to someone under 14 we will delete it; if you are a parent or guardian and believe this is happening, write to us.
Cookies and local storage
We only use technical storage that the service cannot work without, so we show no cookie banner:
- one session cookie (
HttpOnly,Secure) that keeps you signed in; - the browser’s local storage to remember your theme (light/dark) and to resume the action you were doing if you had to sign in.
There are no advertising or cross-site tracking cookies.
Security
Passwords are stored hashed. Communications are encrypted (HTTPS). Sessions rotate on sign-in and on password change. If we detect a breach affecting you, we will tell you.
Changes
When we change this policy we update the version and date shown in the header. If the change is material we will let you know when you sign in.