Privacy Policy

Scope and contact

This policy describes the current BeadArtify service at beadartify.com. Questions about data handling can be raised through our contact page. Operator legal identity and location are still being finalized; this notice will be updated when those details are confirmed.

Images processed on your device

When you select an image in the converter, the browser processes it locally. Selecting that image alone does not upload the source file to the application server. The current conversion can remain in browser memory while the page is open. Local draft storage may retain the resulting editable pattern; clearing a tab is not the same as clearing browser storage.

Account and project information

Creating an email/password account stores your email, a password hash, display name, username and timestamps. Google sign-in provides identity information including an account identifier, verified email, name and profile image. We do not receive your Google password. Profile fields you choose to edit, saved project grids, palettes, titles, previews, visibility and likes are stored to operate account and community features.

Private projects are restricted by account access. Public projects appear in the gallery and can be viewed and remixed by others. The current unlisted setting is not a public sharing guarantee; do not treat it as a replacement for a private project. Publishing may allow visitors to copy or retain content beyond our control.

Community image uploads

Submitting a gallery photo uploads the chosen file to Cloudflare R2. Submission details include your account association, title, creator name, craft, image location, review status and timestamps. A pending submission is not listed in the public gallery, but an object URL is not an access-control mechanism. Do not submit confidential files. The current uploader does not promise automatic removal of image metadata; remove location and other identifying metadata before uploading.

Cookies and local storage

The first-party beadartify_session cookie supports sessions, sign-in security and CSRF protection. It is configured as Secure, HttpOnly and SameSite=Lax, with a browser expiry of up to 30 days. A session may start when the site checks sign-in status, before you log in. Logging out clears the active session.

Browser local storage supports editable drafts, a previous-draft backup, saved colors, craft progress, inventory and UI preferences. These entries can remain until you remove them or clear site data. Inventory is currently local only, not synchronized to your account. The small storage notice records acknowledgement locally. No analytics or advertising scripts are currently included in the application. The banner is informational; it does not pretend to switch off essential sessions or provide consent for services that are not deployed.

Service providers and technical data

The application runs on a web server using PHP and MySQL, with Cloudflare delivery and R2 media storage. Public blog images and the logo are served from media.beadartify.com. Some project previews currently remain in the database. Google processes sign-in requests when you choose that option. Provider and server request logs may contain IP addresses, browser information, URLs and timestamps for delivery and security.

Cloudflare Turnstile integration is prepared but requires site configuration before it is active. If enabled, the security check sends browser and request information to Cloudflare. We will update this notice when service configuration materially changes. Data may be processed in countries different from your location; a particular data-residency location is not promised.

Purpose, retention and your choices

Account data is used to provide the requested account service; project data supports storage and publishing; technical information supports delivery and abuse prevention. We do not use the application to sell personal information or run advertising profiles. We have not established a single fixed retention period for all records. Data may remain while needed for the service, security, dispute handling or applicable obligations; backup deletion may take additional time.

You can change available profile fields, change a project’s visibility and delete individual projects from your dashboard. A self-service full-account deletion and export workflow is not yet implemented. Request assistance through the contact page; identity verification may be necessary before disclosing or deleting account data. Depending on applicable law, rights may include access, correction, deletion, portability, objection or a complaint to a relevant regulator. This notice does not limit rights provided by law.

Children, security and changes

The service is not intended to collect personal information from young children. Do not create an account if you are below the age at which you may lawfully use this service without appropriate parental authorization. A parent or guardian who believes a child has supplied personal data should contact us.

We use access controls, encrypted transport and password hashing, but no online service can guarantee complete security. Keep your credentials private and export backups of important projects. Policy revisions will carry an updated date; materially different processing may require additional notice or choices.