Cloudy Button Logo
Cloudy ButtonBETA
Menu

Privacy Notice

Last updated: 24 October 2026

This notice explains what personal data Cloudy Button (the "Service") collects, why, where it is kept, and what rights you have. It supplements the Terms & Conditions.

1. Who is responsible for your data

Your personal data is controlled by the founder of the Cloudy Button project ("we", "us", "our"). For privacy questions and to exercise your rights, email info@cloudy-button.com.

2. What we collect

2.1 Your account

  • Sign-in and registration run through our own single sign-on server. It stores your email address, password and the profile details you give it.
  • In the Service itself we store your sign-in account identifier, nickname, display name, bio, social links, avatar and the users you follow. During registration we may use your email to suggest a nickname, but we do not store it in the Service's database.
  • Your nickname, display name, avatar, bio, links and follows are visible to others.

2.2 Your content

  • Characters, references, fan-art and canvas placements. We automatically resize and re-encode character and fan-art images, which removes embedded metadata. Avatars are stored exactly as you upload them, including file metadata (such as camera details or location). Remove such data before uploading if you do not want it published.
  • AI labels. When you upload an image we read embedded Content Credentials (C2PA) to label AI-generated images. This check runs on our servers; images are not sent anywhere.
  • Comments and direct messages go through our own chat server. Each user gets an account there linked to their nickname. Character comments are public. Direct messages are stored on the chat server without end-to-end encryption, so do not send passwords or other sensitive information in them.
  • Community Rules proposals. An account on the Rules editing system is created automatically when you register or first take part in discussing the rules. It is linked to your sign-in account; we store its identifier and encrypted access tokens. Your proposals, comments and reactions in the Rules history are public and carry your name.

2.3 Activity

  • Reactions, follows, canvas placements, notifications and activity feed linked to your account.
  • Views. When you open a character or artwork page, we record the time, your IP address, your browser's User-Agent string, your device type and, if you are signed in, your account identifier. This powers view counts and protects against inflated counts.
  • Technical data. To rate-limit requests and prevent abuse we temporarily (up to one hour) keep your IP address or account identifier. Server logs may contain technical details of requests and errors.

2.4 Push notifications

If you turn on browser notifications, we store the subscription address, encryption keys, language and your browser's User-Agent. Notifications are delivered by your browser vendor's push service (for example Google, Mozilla, Apple or Microsoft). Their content is encrypted for your browser.

3. Cookies and browser storage

Necessary (the Service does not work without them, so no consent is needed):

  • session and sign-in protection cookies;
  • a temporary registration cookie, for one hour;
  • temporary cookies for connecting your Rules editing account, for up to 10 minutes;
  • your chosen language;
  • the side panel state in your account area;
  • in browser storage: whether you closed the notifications prompt, your analytics choice and, while your Rules editing account is being connected, the draft of your proposal or comment (until you close the tab).

Analytics (only with your consent). If you allow it, we load Google Analytics. It sets the `_ga` and `_ga_*` cookies and sends Google LLC (USA) data about your visit: pages viewed, approximate location, device and browser. Without your consent Google Analytics is not loaded. You can change your choice at any time with "Cookie settings" at the bottom of the page; if you decline, we delete the analytics cookies.

4. Why we use your data

  • To provide the Service under the Terms: your account, publishing content, comments, messages, canvases and notifications.
  • For our legitimate interests: security, preventing abuse and inflated counts, moderation, handling reports and counting views.
  • With your consent: analytics and push notifications. You can withdraw consent at any time.
  • To comply with the law, where required.

We do not sell personal data, do not show advertising and do not license your content for training AI models.

5. Where your data is kept and who receives it

  • The Service, its database, image storage, the sign-in server, the chat server and the Rules editing system run on servers we rent from a hosting provider in Ukraine. The provider does not use this data for its own purposes.
  • Google receives analytics data only with your consent; it is processed in the USA.
  • Browser push services receive encrypted notifications if you turned them on.
  • Other users see everything you publish openly, and the people you message see your messages.
  • We may disclose data where the law requires it, or to protect the rights and safety of users and the Service.

6. How long we keep data

  • Account data and content: for as long as the account exists.
  • View records: indefinitely, for statistics. On request we will delete the records linked to your account.
  • Rate-limiting data: up to one hour.
  • Unfinished registrations: up to one hour.
  • Push subscriptions: until you turn them off or your browser cancels them.
  • Backups may contain data for some time after deletion.

7. Deleting your account

To delete your account, email info@cloudy-button.com from the address linked to your account, or include your nickname. We will delete your profile, characters, artwork, reactions, follows and notifications, as well as your sign-in and chat server accounts. Messages you already sent may remain with their recipients, and Community Rules contributions may remain in the history as from a deleted user (see section 4 of the Terms).

8. Your rights

Under the Law of Ukraine "On Personal Data Protection" and, for users in the EU, the General Data Protection Regulation (GDPR), you can:

  • find out what data we hold about you and get a copy;
  • correct inaccurate data (most of it you can change yourself in your profile);
  • ask for deletion or restriction of processing;
  • object to processing based on our legitimate interests;
  • receive your data in a portable format;
  • withdraw consent (analytics, notifications) at any time;
  • complain to the Ukrainian Parliament Commissioner for Human Rights or to the data protection authority in your country.

To exercise these rights, email info@cloudy-button.com. We will reply within 30 days.

9. Children

You can create an account from the age of 13 (or older, if the law of your country requires it). If you believe a younger child has created an account, email us and we will delete it.

10. Security

We transfer data only over secure connections (HTTPS) and store credentials for connected services encrypted. No protection is absolute: direct messages are not end-to-end encrypted, so do not share sensitive information in them.

11. Changes to this notice

If we change this notice, we will update the date at the top and announce significant changes on the Service.