Privacy Policy

Draft for legal review · Version 2026-10-16-v2. These policies are not legally certified; the operator must complete the launch review.

What we collect and why

No visitor account is required, and the upload form does not request your email or real name. When submissions are enabled, we receive the selected photograph, optional cat name, photographer credit, title and caption, your wording choice, and your permission/policy acceptance. We store a processed image, a random ID and shareable slug, dimensions, file size, submission time, moderation status, accepted policy version and acceptance time. Your optional words and credit can become public after approval. Avoid personal information in them.

Moderators add an image description and retain review decisions, reasons and audit records. Reports can include the photo reference, concern, explanation and an optional reply email. These complaint details are private to the operator and service providers, subject to lawful disclosure; they are not public comments. Correspondence sent to the contact address is handled through the operator’s email provider, whose identity and retention practices need to be confirmed before launch.

Network addresses and security

Cloudflare receives connection information, including IP addresses, to deliver and secure requests. Turnstile receives security-check information when the upload form opens. The application uses a secret-key hash (HMAC) of the network address for rate limits, one-vote-per-network controls and limited repeat-abuse review. We do not store raw IP addresses in our application database. A hash is pseudonymous, not anonymous: it can link activity from the same network and is not reliable proof of one person. Network blocks can affect people sharing a connection.

Submission identifiers, repeat-abuse blocks, reports and moderation audit records may be reviewed to investigate misuse. Cloudflare and the email provider may keep security/access logs under their own terms and account settings. We have not established a fixed provider-log retention period. Application error logging records an error type, not the uploaded photograph, report body or raw IP address.

Photographs and embedded information

The browser resizes supported photographs, and the server validates them and independently re-encodes them. Only processed WebP images are stored. Public derivatives have embedded EXIF, GPS/location and XMP metadata removed; original upload bytes are not retained in active image storage. This does not remove information visibly written or shown in the picture, such as an address on a collar. Review the image before uploading.

Cloudflare, hosting and international access

The intended upload service uses Cloudflare Pages/Workers for delivery, D1 for records, private R2 for image storage, Cloudflare Images for processing, Turnstile for abuse prevention, and Access for owner sign-in. Depending on the deployed host, a static preview may instead be delivered by Netlify without the upload backend. Providers process data on the operator’s behalf and may process it outside Canada, including in the United States or other countries under their infrastructure and terms. Canadian-only storage is not promised. Approved photographs are publicly accessible internationally and may be indexed when search indexing is enabled. The operator must review provider contracts, account settings, subprocessors and transfer obligations before launch.

Cookies, your browser and sharing

The gallery remembers liked photo IDs in local storage under clawtraits-likes; it can read the older loaf-likes key for compatibility. This storage has no automatic expiry in the code. Clearing it removes this device’s remembered choices, not database vote totals. You can unlike a photo normally or contact the operator about a data request. Shared networks mean a remembered choice is not always the same as the database vote identity.

Clawtraits does not add its own tracking cookies. Cloudflare security or owner Access features may use necessary browser storage/cookies depending on their configuration; consult Cloudflare’s privacy policy and data-processing terms. No analytics, advertising scripts, advertising trackers or advertising consent platform are included in the current application. Built-in caption suggestions do not call an AI service. Share actions use the device’s share feature or clipboard; choosing an external sharing service subjects that interaction to its own terms.

Retention and deletion

Approved photographs remain hosted until removed. Pending images wait for review; there is no automatic pending-image expiry. Unpublishing hides a photograph but keeps its processed image privately for review. Rejecting or deleting removes the active stored image, descriptive fields and votes; a failed storage deletion is flagged for an owner retry. Minimal submission/policy records, the URL slug, pseudonymous submission key, reports, removal reasons, blocks and audit records can remain for dispute and abuse handling. Slugs may contain words from an optional name or title, so mention them in a privacy request.

Rate-limit records expire by time window and are cleared on later rate-limited activity. Other retained records and provider backups do not have an automatic deletion schedule in this application. The operator must establish proportionate retention, review it regularly, delete or de-identify records no longer needed, and limit any legal hold. No invented number of days or guarantee of instant backup erasure is given. Outside downloads and search caches are not under our control; retained backups must not automatically restore removed photos to public view.

Requests and privacy rights

Use the contact below to request access, correction, removal, withdrawal of hosting permission or information about handling. Include the photo URL/ID if relevant and only the information needed to locate the request. Do not send identity documents or sensitive information unless a proportionate verification method has been agreed. Anonymous submissions can be difficult to verify; we may seek limited evidence of ownership. Applicable rights and lawful exceptions depend on the circumstances and jurisdiction.

Legal review required: the operator’s identity and privacy-responsibility contact, actual provider settings, retention schedule, meaningful consent, access/complaint handling, security and breach response must be settled before launch. Applicability of PIPEDA, provincial private-sector laws and any overseas laws requires assessment; this draft does not claim PIPEDA, GDPR or other legal compliance. Advertising or analytics requires a fresh privacy, cookie/consent and disclosure review before activation.

Contact

Contact details are not configured. Submissions remain closed until a monitored contact address is available.