Privacy

About you, if you have an account:

• Your username. It is the only public identifier on the site. You can change it in settings, with your password. We keep no record of the old name: it is free for anyone at once, and nothing leads from it to the new one.
• Your password, hashed with Argon2id. Nobody here can read it.
• Your email address. Every account has one, and it can be one you use for nothing else. It is never shown to anyone, and we use it only to mail you about your account: the link that confirms it, and password reset links. The one exception is one you choose: if you send feedback with your username so we can reply, the reply goes to this address, sent by the site, so whoever writes it never sees the address. An account only exists once you follow the link we mail at signup; until then your signup, with your password already hashed, is kept for 24 hours at most and then forgotten. You can log in with it instead of your username. Settings shows it in part, like m•••@e•••.org, so it stays private on a screen someone else can see. Signing up, changing your address and asking for a reset all get the same answer whether or not an address is already on an account: if it is, that inbox gets a mail saying so instead.
• If you lose access to your email, you can change it in settings while you're logged in. Once you're logged out, a forgotten password can only be reset through it, so losing both means losing the account.
• A short bio, if you write one. It is shown on your profile once something on it is public, and profiles ask search engines not to list them.
• When your account was made. It is used for spam cleanup and for account-age rules in moderation, and is never shown.
• Your drawer: items, statuses, notes, colour, dates, and what you have made public. Items start public, unless you tick private when you add them or in settings, and you can make the whole drawer private in one press. A public item adds to the count of public drawers on that toy's page, and your username appears on the full list behind it, which search engines are asked not to index. The same count also helps order the Popular toys on the home page and the catalogue's default order: only totals are used, and nobody is named. The toy's page never names anyone. Private items, retired ones and closed profiles are never counted or named, and the count is worked out each time, never stored.
• Your reviews: ratings, axis values, prose and photos. A photo is re-encoded when you upload it, which removes its location, camera and date details, and it shows as soon as it is saved, wherever the review is public. Nobody looks at a photo first. Anyone can report one, and a photo that two members report is hidden from everyone but you until an admin has looked.
• A photo of your own copy of a toy, one to an owned drawer item. It is handled like a review photo: re-encoded, and shown at once, with no one looking first. It shows on your profile only while the toy is owned and public, and, as with a review photo, two members reporting it hides it until an admin has looked. Move the toy to your wishlist or retire it, or make it private, and the photo is hidden but kept; remove the toy and it goes with it.
• A toy image you add to an entry, by link or upload. An upload is re-encoded the same way as a photo. It shows straight away; anyone can report an image, and one that breaks the rules comes down.
• The reason an admin gives when a review is hidden, a photo or toy image is rejected or a bio is removed. It is stored with the content and shown to you. A bio's reason is kept until you next save your bio.
• The edit suggestions you send us, and any tag request you sent while tags could be asked for.
• Your sessions: a hash of the session token and when it expires.
• Your settings, which today means whether product pictures are blurred until you click them.

That is the complete list. You can read the site without an account, and we store nothing at all about you if you do.

No real name, no date of birth, no address, no phone number, no gender, no orientation, no payment details. No IP addresses. No browser or device information. No location. No record of when you last logged in, last visited, or last changed anything.

We count anonymously, per day, which searches, pages and errors occur. Never who. There are no analytics, no tracking, no advertising, no profiling and no automated decision-making. Nothing on a page comes from anyone else's server, so nobody else sees that you asked for it.

Your IP address reaches the server, as it must for any site to answer you at all, and it is never written down. Rate limiting counts attempts against a salted hash of it, kept in memory only, for fifteen minutes to a day. A username or email address typed into the account forms is counted the same way, so memory never holds a list of them. The salt is new every time the server restarts, and the counters are gone with it.

One consequence, so it isn't a surprise: we cannot show you a list of your active devices, because we don't know what they are. Changing your password ends every other session, which is the tool we can give you instead.

• The web server keeps no access log. There is no record of any request, anywhere.
• The application logs errors only, with no IP address, no browser, no username and no session token. An error we can't debug without identifying someone is an error we debug from a stack trace instead.
• The database is configured not to log statements, connections or the text of a failed query, because those quote the values in them.
• The remaining output of the server processes is capped and rotates.
• No analytics of any kind, and no third-party counter. The only counts are anonymous daily totals, never linked to an account, an address or a session.
• No error tracking service, and no third-party service of any other kind.

One cookie, set when you log in. It holds a random token and nothing about you, it is readable only by this site, and it lasts 30 days.

Two other preferences are kept in your browser and never sent to us: your theme, if you change it from your system setting, and whether you prefer lists to grids.

All three are strictly necessary to do what you asked for, so none of them needs your consent. There is no cookie banner, and there will be none for as long as nothing third-party appears on the site.

Every page tells your browser to send no referrer off the site, both in the page and as a header on the response. Follow a link to a shop and the shop learns nothing about where you came from: not the product, not your drawer, not your profile.

Product images are our own small copies, served from this domain and credited to the shop or site they came from, so that looking at a product page never makes your browser ask a shop for anything. One a member uploaded carries no credit.

• OVH, in France, runs the server the site is on.
• Scaleway, in France, sends password reset and confirmation mail, and replies to feedback you signed, so it sees the address each one goes to and what it says, and holds the encrypted backups. An address that bounces goes on Scaleway's own list of addresses not to send to again. We keep no record of whether a mail arrived. The mail is plain text, with no tracking images and no tracked links. Scaleway keeps its logs of sent mail for 7 days, and counts of how much was sent for 31 days.
• Migadu hosts the mailboxes behind our contact addresses. It is a Swiss company and its mail servers are at OVH in France.

That is the complete list. There is no advertising network, no analytics provider, no content delivery network and no error tracker. Your data stays in the EU, and Switzerland has an adequacy decision from the European Commission, so a Swiss company handling our mail is covered by it.

Anything you send to one of our addresses sits in a mailbox at Migadu until it is answered, and is then deleted.

• Sessions last 30 days, and are extended only once fewer than 15 remain. The expiry date places a visit within about a fortnight rather than recording it.
• A password reset link lasts one hour, and a link to confirm a signup or a new email address 24 hours. Each is deleted when it is used or runs out, and none carries another date, so nothing records when you signed up, reset your password or changed your address. A signup whose link is never followed is deleted with it, password hash and address included.
• A rejected photo or toy image is deleted, file and all, after seven days.
• The detail and the contact details of a report, and the copy of the bio a profile report keeps, are cleared the moment it is resolved. The record that a report existed is kept for 90 days, as are resolved edit suggestions and tag requests, and then deleted.
• Feedback loses the email address you gave and the link to your username the moment we mark it done. The text is deleted 90 days after that.
• Everything else stays until you delete it, or delete your account.

The database is dumped nightly, encrypted on our own server before it leaves it, and stored at Scaleway, where it is deleted after 30 days. Uploaded photos are encrypted and archived the same way, because they are personal data and must not sit anywhere as plain files. Our host takes its own daily snapshots of the server alongside that.

So something you delete can survive in a backup for up to 30 days. We would rather say that than pretend otherwise. Backups are restored to recover from loss or corruption, never to bring back one account.

One step in settings: a page listing what goes, your password, and one button. The password is there because deleting can't be undone, and without it a borrowed phone or a stolen session could erase your account for good. There is no grace period and no way back.

Gone immediately, in one go:

• Your account, including your email address
• Every session, so you are logged out everywhere
• Any pending password reset, and any address waiting to be confirmed
• Your drawer and wishlist, with every note
• Your reviews, their photos, and their part in any rating
• The photos on your drawer items
• Toy images you uploaded, approved ones too, so the toy goes back to having none
• Feedback you sent with your username that we haven't dealt with yet

Kept, with nothing left pointing at you:

• Catalogue entries, shop links, toy images you added by link, edit suggestions and tag requests you submitted, with the submitter removed. These are shared facts about products, and taking them out would damage the catalogue for everyone.
• Open reports about you or your content are closed, and their detail, contact details and any copy of your bio cleared. Reports you sent, and feedback you sent without your username, were never linked to you in the first place, and the photo-report codes you made are deleted.

Your username is free again straight away. Keeping it reserved would mean keeping a record derived from you after you asked to be gone. Someone else could take the name; nothing of yours is left to appear under it.

A download from settings gives you everything we hold about you as one JSON file: your account, your drawer with its notes, your reviews with any moderation reasons, the photos and toy images you uploaded as the files we store, your sessions and reset links, feedback you sent with your username that we haven't dealt with yet, and everything still linked to you as its submitter. It is generated when you ask for it, never emailed and never stored. A spreadsheet you import into your drawer goes the other way and is read once, never kept.

Two things are deliberately left out of the file, and it says so at the top: the hashes of your password and your tokens, which are secrets rather than facts about you, and whatever somebody else wrote in a report about you, which is theirs. The report itself is listed.

The operator of Flaredbase is the controller of this data, in the EU, and you can reach them at privacy@flaredbase.app. We hold what an account needs in order to work, your email address included, because you asked for the account, we hold a bio because you chose to add one, and we hold the date an account was made because a site with open signups needs some defence against spam.

• To see your data and take it elsewhere: the export above.
• To correct it: edit it yourself, your username included.
• To erase it: delete your account. It happens at once.
• To object or to ask us to restrict what we do: write to us. There is no profiling, no automated decision-making and no marketing here, so these rarely apply.
• To complain: the data protection authority of the country you live in will take a complaint about us.

We answer within 30 days. There is one thing we have to be blunt about: a mail that seems to come from your address doesn't prove it's you, since the sender of a mail is easy to fake. We will not hand over, change or delete anything on the strength of a mail alone, because that would mean giving someone's drawer to a stranger who knows their username or their address. Logging in and using your settings is both the safe route and the fast one.

Anyone can report something on the site, with or without an account. A report is never linked to whoever sent it, even if you were logged in: it holds what it is about, why, and anything you chose to write. If you give us contact details so that we can answer you, we keep them only until the report is resolved, and then clear them. A report about a profile also keeps the bio as it was when you sent it, so that it can be judged even if it changes, and that copy is cleared on resolution too. How to report is on the takedown page.

One exception, so that a photo can be hidden once two different members report it: when you are signed in and report a photo, we also keep a code for that photo. It is a keyed hash of your account and the photo, made with a key only the server holds, so it can't be turned back into your name, and nothing else is stored with it. It is deleted when an admin decides about the photo, when the photo goes, and when you delete your account.

Feedback works the same way: it isn't linked to you unless you tick the box to include your username, and an email address you leave is cleared once we're done with your message.

When the site changes what it stores, this page changes in the same release. We send no email about it, so the date under the title is how to tell. If you want the reasoning as well as the rules, the legal page says who runs the site and how to reach them.