Privacy and data use

Privacy at a glance

You can browse references and practice without an account. Poses saved without signing in stay in this browser. Signing in lets you sync saved poses across devices; browser-saved poses are imported only when you confirm.

You can delete your drawing account and cloud-saved poses from the account page. Separate browser-saved poses stay in your browser unless you clear them.

The sections below explain account data, image reports, support messages, service providers, retention and any analytics we use. For privacy questions, contact support@dynamicposes.art.

Browsing, practice and browser saves

The practice viewer does not capture your drawings or use your camera or microphone. Session links include filters and a random seed; sharing a link shares those settings.

Without an account, saves contain reference identifiers and save times in this browser. They remain until you remove them or clear browser data. If storage is unavailable, changes last only for the current page session. A browser-saved practice round can keep its references in this tab, but does not preserve timer progress. Account-owned rounds stay in page memory and are lost on a full reload.

Optional accounts and importing saves

Supabase handles authentication and cloud-saved collections. Email sign-in codes are delivered through Resend. If you choose Google sign-in, Google also processes identity information. Authentication may include your email and profile information. Signing in does not subscribe you to marketing.

We link your verified identity to a drawing account and store your saved reference identifiers, save times and the records needed to keep your collection in sync and complete imports or account deletion. Cloud changes require an internet connection; they are not queued for later offline replay.

Importing browser saves requires your confirmation and leaves the browser list unchanged. Account saves are not automatically copied into that browser list. This tab temporarily remembers an import identifier so you can check its result after a refresh; this contains no email, authentication token or pose list. It is cleared when the import resolves or the relevant account session changes. Expired markers are discarded when read. Checking a result does not repeat an import.

Sign-in uses short-lived verification records and a browser cookie. Verification details are encrypted on the server. Rate limits use protected representations of email addresses and, where configured, IP addresses. Cloudflare Turnstile may provide an additional abuse check. Save reminders only keep a non-sensitive shown-or-dismissed marker in this tab.

Deleting your account and retaining security records

The account page offers sign-out and deletion. Deletion requires fresh verification of the same identity and a final confirmation. It removes your drawing account, cloud saves, import records and application sessions. It does not delete separate browser saves, your email account or your Google account. An authentication identity also needed for site administration is retained for that separate role.

If deletion cannot finish, cloud access remains blocked while deletion is pending. You can retry from the same browser for seven days; contact support if that period expires before completion. After completion, a minimal confirmation without your user identifier remains available until that retry period ends.

Import confirmations are available for seven days. Expired import confirmations and completed deletion records are removed by scheduled cleanup. Expired sign-in records can no longer be used and are also cleaned up. Expiry is not a promise that every stored copy has already been erased. Pending deletions are retained until resolved. Provider logs and backups follow their own retention settings and may remain after account deletion.

Image reports and support messages

An image report includes the reference identifier, reason, optional note and submission time. A protected representation of the source IP address limits repeat submissions; the report record does not store the raw IP. Reports are available to authorized administrators and are not displayed publicly.

If you email support@dynamicposes.art, we receive your email address and the message and attachments you send. The support mailbox is hosted by Dynadot. We use these messages to reply, investigate the issue and handle related requests. Do not include passwords, verification codes or unrelated sensitive information.

Deleting a drawing account does not automatically delete image reports or support correspondence. There is no published fixed deletion period for those records. You can ask us to review or delete information you submitted by contacting support; we will explain any information that needs to be retained when responding.

Analytics and your choices

Public pages use Umami Cloud for page visits and referral sources, Google Analytics for page and practice events and Microsoft Clarity for interaction analysis and session replay. Google Analytics and Clarity may use cookies or identifiers. Practice events can include reference identifiers, session settings and active practice time; they do not include report notes. Page addresses sent to Umami and Google Analytics keep campaign tags (utm_ parameters) and ad-click identifiers from the link you followed, but leave out other parts of the address such as library filters. Referrer addresses sent to Umami omit query strings and fragments. Vercel Speed Insights measures page loading performance (Core Web Vitals) together with the page address without its query string, general device, browser and network-speed information, and country. Vercel describes these measurements as anonymous and not linked across pages.

If you visit from the European Economic Area, the United Kingdom or Switzerland, Umami, Google Analytics and Microsoft Clarity load only after you choose Accept in the analytics banner, and no practice events are sent before then. To decide whether to show the banner, the site checks the country of your connection as reported by its hosting provider; it does not store the country. If that check fails, the banner is shown. Your choice is kept in this browser for six months. Visitors elsewhere can also turn analytics off: choose “Analytics choices” at the bottom of a page and then Reject. A withdrawal stops new practice events and Umami measurements at once and turns off the providers’ scripts from the next page load. Vercel Speed Insights does not use this choice, because Vercel describes its measurements as anonymous.

If your browser sends a Do Not Track or Global Privacy Control signal, public pages do not load Umami, Google Analytics, Microsoft Clarity or Vercel Speed Insights and send no practice events, whatever was chosen in the banner. Tracking blockers can also limit these services.

Login and account pages do not initialize analytics, performance measurement or session replay. Authentication callbacks redirect without rendering tracking scripts. Account-related custom events exclude names, emails, authentication tokens, account identifiers and complete saved-pose lists.

Read Umami’s privacy policy, Google Analytics data information, Microsoft Clarity’s collection details and Vercel Speed Insights privacy information for the providers’ handling of analytics data.

Services that operate the site

Vercel hosts the website. Supabase provides the database and authentication, and Cloudflare provides image delivery. These services process requests needed to operate the site and may keep operational logs, including connection information. Resend delivers sign-in email, Dynadot hosts support mail, and Google participates when you choose Google sign-in. Analytics and optional security checks are described above.

Sentry receives error reports when part of the site fails, so we can fix it. A report contains the error and where it happened in our code, the page address without its query string, the browser and operating system, and the recent steps before the error, such as page changes and network requests (also without query strings). Reports are configured to leave out cookies, other request headers, form contents, console output and account details, and the site does not send Sentry separate usage or session pings. Your browser does not send error reports from login, account or admin pages, and if your browser sends a Do Not Track or Global Privacy Control signal, no error reports are sent from your browser or about your requests.

Service providers may process information in countries other than yours. This page does not promise a particular storage country or a fixed deletion time for provider logs and backups.

Privacy requests

For questions or requests concerning access, correction, a copy of your information or deletion, email support@dynamicposes.art. We may need to verify that the information belongs to you. Depending on the law that applies, you may also have rights to object to or restrict processing, and to raise a concern with a data-protection authority.

See account terms for account use and image use for reference-image permissions.