1

1. Our Privacy Philosophy

Still Human was founded by artists, for artists. In an era where online platforms indiscriminately monetize user content and feed original drawings into generative AI training datasets, our platform takes a radically defensive stand: Your art is yours, your identity is respected, and your privacy is preserved.

Defensive Invariant: Zero Data Selling & Zero AI Training Still Human does NOT sell, rent, license, or trade your personal information, contact details, or artwork to data brokers, ad networks, or AI companies. Period.
2

2. Information We Collect

We only collect information strictly necessary to provide the Still Human experience:

  • Account Credentials: Email address, username/handle, display name, and avatar picture. If you authenticate via Google or Facebook, we store only your OAuth provider user identifier and email.
  • Artwork & DualDraw Telemetry: Rendered artwork PNG/JPG images, and stroke telemetry (vector stroke coordinates, brush presets, pressure dynamics, timestamps, undo/redo logs) utilized exclusively to verify human creation and power the challenge proof system.
  • Community & Social Interactions: 1v1 duel submissions and votes, private collab space chat messages, comments, reactions, and content moderation reports.
  • Technical Diagnostics: IP address (retained temporarily in rolling logs for anti-DDoS, rate-limiting, and abuse prevention), app version, and device operating system version.
3

3. Self-Hosted Infrastructure & Storage Security

Unlike applications that route user data through opaque commercial cloud aggregators, Still Human operates on a self-hosted Supabase backend stack running on our dedicated European Contabo VPS infrastructure (89.116.26.170):

  • Database Security: PostgreSQL 17 with strict Row-Level Security (RLS) policies guaranteeing that private messages, collab spaces, and draft artworks can only be accessed by authenticated, authorized members.
  • Storage Encryption: S3-compatible encrypted object storage for artwork images and stroke recordings with signed temporary URLs for private attachments.
  • TLS 1.3 Encryption: All client-to-server communications are encrypted in transit using modern TLS 1.3 and HSTS headers enforced by Caddy.
4

4. Your Rights: Export (ZIP) & Complete Erasure

In strict compliance with the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), you maintain full control over your digital footprint:

Right to Portability (Download My Data) You can request a complete ZIP export containing all your high-resolution artwork images, vector stroke recordings, and profile history at any time from: Settings → Data & Storage → Request Archive.
Right to Erasure (Delete Account) You can permanently delete your account and all associated personal data directly within the app: Settings → Data & Storage → Delete Account. All database rows and storage records linked to your user identity are purged immediately.
5

5. Children's Privacy (COPPA)

Still Human is designed for creators aged 13 and older. We do not knowingly collect or solicit personal data from anyone under the age of 13. If we discover that an account belongs to a user under 13, we will terminate the account and purge their data immediately.

6

6. Privacy Inquiries & Data Protection Officer

If you have questions regarding this Privacy Policy, your rights, or wish to exercise data protection prerogatives, please contact our Data Protection Officer at: privacy@stillhuman.com.