Privacy Policy

The Grace Files ("we", "the site") is a fan-run, non-commercial photo archive. This policy explains what data we collect, why, and how it is handled.

1. Data We Collect

• X (Twitter) account data - if you sign in with X, we receive your Twitter ID, display name, handle, and profile picture URL via OAuth. We store these to identify your account on this site.
• Uploaded photos - images you submit, along with any caption or credit information you provide.
• Votes - your upvote and downvote activity, linked to your account or an anonymous visitor identifier.
• Anonymous visitor ID - for visitors who are not signed in, we derive a pseudonymous identifier from your IP address (one-way hashed) to track votes. We do not store raw IP addresses.
• Session data - standard session cookies used to keep you signed in. These are stored server-side and expire after 7 days.
• Unique visitor count - an aggregate count of distinct visitor hashes. No individual browsing history is retained.

2. How We Use Your Data

• To display your uploads and attribute them to your account
• To let you edit or delete your own content
• To prevent duplicate or abusive votes
• To allow moderators to manage the archive

We do not sell, share, or monetise any personal data. We do not run advertising.

3. Photo Storage

Uploaded images are stored on Cloudflare R2 and served via CDN. By uploading a photo you confirm you have the right to share it and consent to it being publicly displayed on this site.

4. Third-Party Services

• X / Twitter OAuth - sign-in is handled by Twitter's OAuth flow. Twitter's own privacy policy governs what they collect during that process.
• Cloudflare - used for CDN and object storage. Cloudflare may process request metadata per their privacy policy.

5. Data Retention

Your account record and uploads are retained for as long as your account exists. You may delete individual photos at any time from your profile page. To request full account deletion, contact a site admin.

6. Cookies

We use two types of cookies:

• Session cookie - keeps you signed in (httpOnly, expires in 7 days)
• Voter cookie - anonymous visitor identifier for vote tracking (30 days)

No third-party tracking or advertising cookies are used.

7. Your Rights

You can delete any photo you uploaded via your profile page. For other requests - including account removal or data export - reach out via the site's contact channels.

8. Changes

We may update this policy occasionally. Continued use of the site after changes constitutes acceptance.

9. Contact

This is a fan project with no formal corporate entity. For privacy concerns, contact the site admin through the community channels listed on the main page.