Privacy Policy

This Policy applies to the Service. The Service may link to other websites (such as the pages of the museums that hold the paintings); those websites are responsible for how they handle information, and this Policy doesn't apply to them.

We collect only the information we need to provide the Service:

• Account information: your email address, phone number (if you sign up with or add one), username, and password. Passwords are stored only as cryptographic hashes, so we can't see your actual password. We also record your interface language preference, whether your email address and phone number are verified, and — when you change your email address — your previous address, so the change can be undone.
• Profile information: your display name, handle, avatar, and bio.
• Content you publish: images of your works, titles, descriptions, how each work was made and its creation details (such as models, tools, prompts, and parameters), content tags, license choices, and collections.
• Activity: your likes, favorites and favorite folders, follows, and the works you view.
• Technical and security information: your IP address, browser and device information (user agent), the time of your visits and the pages you visit, the IP address you signed up from, and security records such as failed sign-in attempts. We use your IP address to determine your country or region, but we don't collect your precise location.

When you view works without signing in, we also record the IP address and browser information of the view, to count views and filter out duplicates.

• To provide the Service: creating and managing your account, storing and displaying your works and profile, and running features such as likes, favorites, follows, and your viewing history;
• For verification and notifications: sending sign-up verification, password reset, and email change confirmation emails, as well as text message verification codes, in the language you've chosen;
• To keep the Service secure and prevent abuse: human verification checks, sign-up rate limits, temporary lockouts after repeated failed sign-ins, and detecting unusual or malicious traffic;
• To count views of works and filter out repeat views within a short period;
• To decide whether certain content is shown, based on its content rating and your country or region;
• To understand how the Service is used so we can improve it — for example, by measuring page visits with Google Analytics (see “Cookies”);
• To maintain and improve the Service and troubleshoot problems;
• To comply with laws and regulations and respond to lawful requests.

We don't sell your personal information, and we don't use it for targeted advertising.

The following information is public and can be seen by anyone, including visitors who aren't signed in:

• Your profile page: your display name, handle, avatar, bio, and your public works and public collections;
• The lists of who you follow and who follows you;
• Aggregate numbers for public works, such as like and view counts.

Works and collections you set to private are visible only to you. Your favorites and viewing history are shown only in your own account center, and we don't tell creators who viewed their works. Your email address and phone number are never shown publicly.

We don't sell your personal information. We share it with others only in these cases:

• with technical service providers that help us run the Service, which process information only as needed to provide their services to us and only on our instructions;
• to comply with applicable laws, legal process, or lawful requests from public authorities;
• to protect the safety, rights, and property of the Service, our users, or the public — for example, to investigate fraud or abuse;
• in a merger, acquisition, or transfer of assets, where your information may be transferred as part of the transaction; we'll require the recipient to continue to honor this Policy, or let you know;
• in other cases with your consent.

Information you choose to make public, such as your profile and public works, can be seen by anyone who visits the Service.

We use the following cookies:

• Sign-in cookie (payload-token): keeps you signed in. If you check “Remember me” when signing in, it lasts 7 days; otherwise it expires when you close your browser.
• Language preference cookie (xpaint_locale): remembers the language you pick with the language switcher, for 1 year.
• Analytics consent cookie (xpaint_analytics_consent): remembers whether you allow us to collect usage statistics, for 12 months; after that, we'll ask you again.
• Analytics cookies (_ga, _ga_<ID>): set by Google Analytics to tell visitors apart and measure usage, for up to 2 years. They're set only if analytics is allowed.

We use Google Analytics to understand how the Service is used — for example, which pages are visited, which countries or regions visitors come from, and what devices and browsers they use — so we can improve it. To do this, Google receives your IP address, browser and device information, and the pages you visit. We've turned off Google Analytics' advertising features and Google signals, and analytics data isn't used for advertising.

If you're in the European Economic Area, the United Kingdom, or Switzerland, we load Google Analytics and set analytics cookies only after you consent. Any visitor can change their choice at any time with “Cookie settings” at the bottom of the page; if you choose not to allow analytics, we stop collecting it and delete the analytics cookies already set.

In addition, a small number of cookies may be used for security purposes, to prevent abuse and malicious traffic. We don't use advertising or cross-site tracking cookies.

• Account and profile information: kept for as long as your account exists;
• Works: works you delete go to your trash and are permanently deleted, image files included, after 30 days; you can also empty your trash at any time to delete them permanently right away;
• Viewing history: you can clear your own viewing history at any time in your account center;
• Security records and logs: kept for a reasonable period as needed for security purposes.

We may keep information longer where the law requires it, or where it's necessary to resolve disputes or enforce our Terms of Service.

In your account center, you can:

• view and edit your profile, avatar, and handle;
• change your email address, add a phone number, and change your password;
• set the visibility of your works and collections, and choose each work's license and whether to allow AI use and original image downloads;
• delete works, empty your trash, clear your viewing history, and undo likes, favorites, and follows.

You can also contact us to request a copy of your personal information, correct inaccurate information, delete your information or your account, or object to or restrict certain processing. We'll respond within a reasonable time, as required by applicable law, after verifying your identity.

Depending on where you live (for example, under the EU General Data Protection Regulation or California law), you may have additional rights, including the right to lodge a complaint with a data protection authority. We won't discriminate against you for exercising these rights.

We take reasonable technical and organizational measures to protect your information, including HTTPS encryption across the site, storing passwords as cryptographic hashes, temporarily locking accounts after repeated failed sign-ins, and notifying your previous email address with a way to undo the change when your email address is changed.

No method of transmission or storage over the internet is completely secure, though. Please use a strong password that you don't reuse on other sites, and keep it safe.

The Service is used around the world, and our servers and technical service providers may be located outside your country or region, so your information may be transferred to, stored, and processed in those places. We take reasonable measures to keep your information protected in line with this Policy.

The Service is not directed to children under 13, and we don't knowingly collect their personal information. If you believe we have collected a child's information by mistake, please contact us and we'll delete it promptly.

We may update this Policy from time to time. We'll post the updated version on this page and change the “Last updated” date at the top; for significant changes, we'll let you know by a notice on the site, by email, or by other reasonable means.

If you have any questions, comments, or requests about this Policy or your personal information — including exercising the rights described above — please get in touch.