PUBLIC POLICY

Privacy

Public replay shows accepted artwork and chronology, not painter identity or Lightning payment details.

Painting without an account

You can paint and pay without an account. The service processes the quote, settlement, coordinates, colors, and security data required to complete and protect the transaction.

Owner accounts

Banner owners use email authentication. Account and settlement records remain separate from public replay.

Public-page analytics

We use self-hosted analytics on public pages to count visits and painting activity. A first-party cookie holds a random session identifier for 30 minutes. Analytics records page paths, referrer origins, device/browser categories, and limited banner and checkout events—not account identity, email, wallet addresses, invoices, or payment credentials. Owner and administration pages are not tracked.

Recovery

Anonymous recovery secrets remain in your browser. The server stores only a one-way commitment.

A recovery code is a bearer credential: anyone who has it can spend the associated voucher credit. The plaintext code is not stored in service records, request URLs, or public pages and cannot be recovered for you.

Public metadata and embeds

A buyer may choose a public message, attribution label, and qualifying HTTPS link. These details can appear with currently visible artwork on a banner page or isolated embed. They can be disabled or invalidated while the underlying settlement and moderation audit remains restricted.

Records and retention

Public replay excludes invalidated artwork, payment credentials, email addresses, voucher secrets, and Lightning payment details. The service retains transaction, ledger, moderation, and security records needed to reconcile payments, protect balances, enforce policy, and maintain the append-only audit. Public redaction does not erase those restricted records.