What we keep about you,
and how to make us forget it.

Who is responsible

The data controller is ArtDots, an independent project run by Vinicius Vecchiatti. For anything about your data, write to mosaico@racelogplus.com.

What we collect

Reading the public pages (the welcome page, the artist, collection and gallery pages, and the list of galleries) needs no account and collects nothing about you beyond the anonymous visit statistics described at the end of this list. The map and the photos are for members only. Creating an account and logging finds involves the following.

Your account

• E-mail address, received from the sign-in method you choose.
• Sign-in provider id: an identifier from Apple, Google or our e-mail code login, so we can recognise you next time. We never see or store a password.
• Nickname, which is public, and an optional name and avatar.
• Where you live, as a city or region, or "visiting". Used to understand which cities have hunters, not to locate you.
• How you heard about the project, language and your hunt preference (hunt mode or explore mode).
• The date you accepted the terms and confirmed you are 18 or older.

What you contribute

• Photos you upload. Location metadata inside the photo is read to place the find and is not kept in the stored file beyond what the browser leaves in it.
• The location of each find (coordinates and the address we derive from them).
• Comments, artist suggestions and claims you make.
• Reports you file about other content, including the reason.
• Connections: requests you send and accept, and members you block. Connected members see your recent finds with photos and the connections you have in common; other members see only your nickname, avatar, city, member since, counts and the pieces you discovered. Using someone's invite link connects you to them. A setting in your profile controls whether you appear in search and suggestions.

Visit statistics

Every page records a visit: the page, the channel you came from (for example a link shared on WhatsApp) and a random visitor id that lives in your browser's local storage. The id is not linked to your account, contains nothing about you and can be cleared by clearing site data. No IP addresses are stored by us and nothing is sent to an analytics company.

Why, and on what basis

• To run the service you asked for (performance of a contract): your account, your finds, the map, the leaderboard, share cards, e-mails with your login code.
• To keep it safe (legitimate interest): the text filter, reports, the review queue, rate limits, blocking abusive accounts and understanding which pages and channels bring people in.
• Legal duties: answering a lawful request from an authority, or keeping a record of a takedown.
• Consent: access to your device's location, which the browser asks you for and which you can refuse or revoke at any time. We only use it to place a find; we never store your live position.

We do not profile you, we do not make automated decisions about you, and we do not sell or share your data for advertising.

Where it is stored, and who helps us

We use a small number of providers to run ArtDots. Each one only receives what it needs for its job.

• Supabase: the database and the photo storage. This is where your account, finds and photos live.
• Netlify: serves the website itself.
• Resend: sends transactional e-mails, such as your login code. They receive your e-mail address for that purpose only.
• OpenStreetMap: provides the map tiles. Your browser requests them directly, as it would any image, so OpenStreetMap sees your IP address and the area you are looking at.
• Nominatim (OpenStreetMap's geocoder): when you log a find, its coordinates are sent to Nominatim to turn them into an address. Only the coordinates of the find are sent, never your own position or identity.

These providers may process data outside the United Kingdom, the European Union or Brazil, in particular in the United States. Where that happens, the transfer relies on standard safeguards recognised by the GDPR and the LGPD, such as standard contractual clauses in the provider's data processing terms.

How long we keep it

• Your data is kept while your account exists.
• When you delete your account, your profile, finds, photos, suggestions and reports are deleted. If you were the first to find a piece, the discovery passes to the next person who found it, so the piece stays on the map with no trace of you.
• When a piece is removed (by its author or after review), its photos are purged from storage after 30 days.
• Login codes expire in minutes and are not kept.
• Visit statistics are anonymous from the start and are kept as aggregate numbers.
• Connections and blocks are deleted when either of the two accounts is deleted.

Your rights

Under the GDPR and the LGPD you can:

• Access the data we hold about you and receive a copy.
• Correct it. Nickname, name, avatar and preferences can be edited in your profile.
• Delete it. Use "Delete my account" in your profile; it works immediately and needs no e-mail. You can also delete individual finds.
• Take it with you (portability): ask us and we will send your finds and profile in a machine-readable format.
• Object to processing based on legitimate interest, and withdraw consent for location access at any time in your device settings.
• Disconnect or block anyone at any time, from their profile or from Profile > Connections.

To exercise any of these, write to mosaico@racelogplus.com. We will answer within one month. If you are not satisfied, you can complain to the Information Commissioner's Office (ICO) in the United Kingdom or to the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, or to the authority of the country where you live.

Children

ArtDots is not directed at people under 18 and we do not knowingly collect data from them. We do not collect dates of birth. If you are a parent or guardian and discover that a minor has created an account without your consent, write to us and we will delete it.

Cookies and local storage

ArtDots does not set advertising or tracking cookies. Your browser's local storage holds your session (so you stay logged in), your preferences (hunt or explore mode, language) and the random visitor id described above. All of it is strictly necessary to run the service or is anonymous, which is why you do not see a cookie banner. Clearing site data in your browser removes it all.

Changes to this policy

If we add a provider, collect something new or change how long we keep data, we will update this page and the date at the top, and we will show a notice in the app for anything that matters. Old versions are available on request.

Contact

Anything about your data: mosaico@racelogplus.com. For the rules of the game, read the Terms of Use.