Who is responsible

[legal name not set], trading as MyWorldsArt, decides how the information described here is used, and is the data controller for it. You can reach us at contact@myworlds.art.

One account across MyWorldsArt

Your sign-in is shared by the MyWorldsArt sites that use it, such as Upside Son and SoundWorld: one email and password works on all of them. Each site keeps its own records about you separately, and one site cannot read another’s. This page covers what www.myworlds.art keeps; each site describes its own.

What we collect

Only what the site needs in order to work:

• Your account — the display name you choose, your email address, whether that address has been confirmed, and your password stored only as a cryptographic hash. We never hold your password itself and cannot tell you what it is.
• Your sign-ins — each active session, when it expires, and the IP address and browser description it was created from. That is what lets you stay signed in and lets us end a session you no longer want.
• Abuse counters — the sign-in service counts recent sign-in, sign-up and password-reset attempts from each IP address, so that guessing a password in bulk does not work. The feedback and newsletter forms count recent submissions the same way, keeping only a one-way hash of the address.
• Your subscription — an identifier from our payment provider, the status of the subscription and its renewal or end dates.
• Access tickets — short-lived tokens, stored hashed, that let a MyWorldsArt project confirm your access without handling your password.
• The newsletter — if you sign up, your email address, kept in our list at Resend, which sends the newsletter. Every newsletter has a link to unsubscribe, which takes effect straight away.
• Your charity vote — if you subscribe and vote, which charity you chose each month. Only the totals are ever shown publicly, never who voted for what.
• Feedback — what you write in the feedback form, the app it is about, and any contact details you choose to add, read only by the site administrator. No account is needed.

What we never collect

Card details never reach this site. Payment is handled entirely by Paddle.com Market Ltd, which is the seller of record; we receive only a customer reference and whether the subscription is paid.

There are no analytics, no advertising trackers, no third-party embeds that watch you, and no profiling or automated decisions about you. We do not sell or share your information with anyone for their own purposes.

Cookies

This site sets one cookie: the session cookie that keeps you signed in. It is strictly necessary for a feature you asked for, so there is nothing to consent to and no banner to click. Sign out and it is gone.

Who else processes it

These companies handle some of this information on our behalf, and only on our instructions:

• Paddle — payments, invoicing and tax, as Merchant of Record.
• Supabase — provides sign-in, and hosts the database holding accounts and subscription records.
• Vercel — hosts and serves this site.
• Resend — delivers password-reset and confirmation email, and keeps and sends the newsletter.

How long we keep it

• You stay signed in until you sign out, or until a password reset ends your other sessions.
• Password-reset and email-confirmation links work once and expire within an hour.
• Access tickets last minutes, and no account holds more than ten at a time.
• Account and subscription records are kept while your account exists. Records of payments may have to be kept longer, by our payment provider, to satisfy tax and accounting law.

How it is protected

Passwords are hashed, never stored in a readable form. Every page checks your session with the sign-in service rather than trusting what the browser holds, so signing out takes effect immediately. Resetting a password signs out every other session, so a stolen session cannot survive the recovery it forced. The site is served only over HTTPS.

Your choices

• See or correct it — your account page shows what we hold, and your display name can be changed there at any time.
• Delete it — email contact@myworlds.art and we will delete your account and its data. There is no self-service delete button yet; asking us is currently the way.
• Object, or ask for a copy — email the same address and we will respond.

Children

Accounts are not intended for children under 13. If you believe a child has created one, tell us and we will remove it.

Changes

If this policy changes in a way that matters, we will say so on this page and, where the change affects subscribers, by email.