Privacy Policy

Thingaling ("the Platform", "we", "us") is a personal project operated by an individual based in Saskatchewan, Canada. This Privacy Policy explains what personal information we collect, how we use it, and your rights regarding that information.

By using Thingaling, you agree to the collection and use of information as described in this policy.

If you have questions or concerns, contact us at: support@thingaling.net

Thingaling is subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). We are committed to handling your personal information responsibly and transparently.

If you are located in the European Union or United Kingdom, you may have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR. Where applicable, we will honour those rights as described in Section 10.

3a. Information You Provide Directly

• Email address — collected at registration and used for account management, login, and legal notices
• Username — chosen by you at registration, displayed publicly on the Platform
• Password — stored in encrypted (hashed) form; we never store or see your plain-text password
• Profile information — any optional information you choose to add to your profile
• Uploaded images — images you submit as Things or use as your profile picture or banner
• Copyright request information — if you submit a copyright complaint, we collect your name, company (if supplied), email, mailing address, relationship to the work, work identification, evidence, statements, electronic signature, the affected Thing, and submission timestamps
• Payment information — if you purchase a membership or paid feature, payment is processed by our third-party payment processor (Stripe). We do not store your full card number, CVV, or banking details on our servers

3b. Information Collected Automatically

• IP addresses — logged when you interact with the Platform and used for security, abuse prevention, fraud detection, rate limiting, and compliance with applicable legal obligations
• Session data — we use cookies to manage your login session (see Section 6)
• Usage data — general information about how you interact with the Platform, such as votes cast, duels viewed, and features used

We use the information we collect to:

• Create and manage your account
• Operate the Platform, including duels, leaderboards, voting, and the Marketplace
• Process payments for memberships and paid features
• Moderate content and enforce our Terms of Service
• Detect and prevent fraud, abuse, and automated activity
• Receive, document, investigate, and respond to copyright complaints and related legal inquiries
• Respond to your support requests or legal inquiries
• Improve and maintain the Platform

We do not guarantee that personal information we hold about you is always accurate, complete, or up to date, and rely on users to update their information where necessary.

Legal Basis for Processing (GDPR)

If you are located in the European Union or United Kingdom, we process your personal data under the following legal bases:

• Contract — to provide and operate the Platform
• Legitimate interests — to improve the Platform, prevent abuse, and ensure security
• Legal obligations — to comply with applicable laws, including copyright and law enforcement requirements
• Consent — where required, such as for optional features or communications

You may withdraw consent at any time where processing is based on consent.

Thingaling uses the following third-party services that may receive or process your data. Their use of your information is governed by their own privacy policies, and we encourage you to review them.

Stripe (Payment Processing)

When you make a purchase, your payment information is handled directly by Stripe. We receive a transaction confirmation but do not store your full card details. Stripe's privacy policy is available at stripe.com/privacy.

Sightengine (Image Moderation)

Uploaded images may be submitted to Sightengine for automated content moderation to detect policy-violating material. Sightengine processes images for this purpose and does not retain them beyond the moderation check. Sightengine's privacy policy is available at sightengine.com/privacy-policy.

Railway (Hosting)

The Platform and its database are hosted on Railway. Your data is stored on Railway's infrastructure. Railway's privacy policy is available at railway.app/legal/privacy.

Cloudflare (Image Storage)

Uploaded images are stored using Cloudflare R2. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

Thingaling uses cookies to keep you logged in across sessions. A cookie is a small text file stored on your device by your browser.

We use cookies for:

• Maintaining your login session so you don't have to sign in every visit
• Basic security functions

We do not use cookies for:

• Advertising or ad tracking
• Third-party analytics
• Selling or sharing your browsing behaviour

You can disable cookies in your browser settings, but doing so will prevent you from staying logged in to the Platform.

We do not currently respond to "Do Not Track" browser signals.

Please be aware that certain information on Thingaling is public by default:

• Your username
• Your profile picture and banner
• Things you have submitted and their performance stats (unless set to private)
• Comments you post

Do not include personal information in your username, Thing titles, or comments that you would not want to be publicly visible.

Copyright claimant contact details, declarations, and evidence are not displayed publicly. They are available to authorized administrators and may be used or disclosed where reasonably necessary to investigate a request, obtain legal advice, enforce our Terms, protect legal rights, or comply with applicable law or valid legal process.

We retain your personal information for as long as your account is active or as needed to operate the Platform.

If you delete your account:

• Your personal profile information will be removed
• Your submitted content may remain in anonymized form to preserve voting history and leaderboard integrity, as described in our Terms of Service
• IP address logs may be retained for up to 12 months for security and legal compliance purposes
• Copyright request records and related decisions may be retained as reasonably necessary to investigate claims, prevent abuse, maintain an audit trail, establish or defend legal rights, and comply with applicable legal obligations

We take reasonable technical and organizational measures to protect your personal information, including:

• Encrypted (hashed) password storage
• HTTPS encryption for data in transit
• Access controls limiting who can view user data

You are responsible for maintaining the confidentiality of your account credentials and for any activity under your account.

No system is completely secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the appropriate authorities as required by Canadian law.

Canadian Users (PIPEDA)

Under PIPEDA, you have the right to:

• Access the personal information we hold about you
• Request corrections to inaccurate information
• Withdraw consent for certain uses of your data (subject to legal or contractual restrictions)
• File a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

EU / UK Users (GDPR / UK GDPR)

If you are located in the EU or UK, you additionally have the right to:

• Erasure ("right to be forgotten") — request deletion of your personal data
• Portability — receive a copy of your data in a portable format
• Object to certain processing of your data
• Restrict processing in certain circumstances
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at support@thingaling.net. We will respond within 30 days.

Thingaling is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a user is under 13, we will delete their account and associated data promptly.

If you believe a child under 13 has created an account, please contact us at support@thingaling.net.

Thingaling is operated from Saskatchewan, Canada. If you access the Platform from outside Canada, your information will be transferred to and processed in Canada. By using the Platform, you consent to this transfer.

We make reasonable efforts to ensure your data is handled in accordance with this Privacy Policy regardless of where it is processed.

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by posting a notice on the Platform or by email.

Your continued use of the Platform after changes are posted means you accept the updated policy.

For any privacy-related questions, requests, or concerns, contact us at:

support@thingaling.net

For complaints that we are unable to resolve, you may contact the Office of the Privacy Commissioner of Canada:

• Website: priv.gc.ca
• Toll-free: 1-800-282-1376