Privacy

This page says what this site stores about you, how long each thing is kept and what it is kept for, which other companies ever receive anything, and what closing your account does. It goes item by item rather than summarising, because a summary is where the awkward items go missing.

It is not a legal document. Every sentence here describes something the code actually does, and every number on the page is read from this site's own settings as the page is drawn, so a limit that changes changes here with it.

Cookies

One cookie reaches your browser from this site, and only one. You can see that for yourself without taking anybody's word for it: press F12, open the storage tab and read the cookies your browser lists under this site's address.

ff_session — this site's own, and the only one it sets itself. It carries three things and nothing else: who you are signed in as, the token that stops another website posting forms here in your name, and the one-off messages the bar at the top of the page shows. All three travel in that single cookie. There is no audience measurement in it, no advertising, and nothing in it is shared with anybody.
How long that cookie lasts, which is two different answers. With keep me logged in left ticked on the sign-in form, it lasts 30 days, counted from the moment you sign in. With the box unticked, it lasts until the browser is closed and no longer. Either way it does not slide: visiting again does not extend it, so the count runs from when you signed in and not from your last visit. The box is ticked for you by default.
The check that you are a person, which only the sign-up page loads, runs inside a frame of its own belonging to the company named in the next section rather than to this site. Whatever that frame stores is stored under that company's address and not under this site's, your browser lists it under their name, and this site can neither read it nor write it. If you happen to hold an account with that company yourself, your browser will show you its cookies there while you are on that page; they are yours and theirs, and they have nothing to do with this site.

The other companies

Three things on this site send something outside it, and one company sits in front of all three.

The check that you are a person, on the sign-up page and on no other page. Your browser loads a small program from challenges.cloudflare.com, so that company sees the address you are coming from and some signals about your browser. When you submit the form, this site sends that company the answer the check produced, together with the key that identifies this site to them — and deliberately not your address, although the service offers a field for it.
Account mail, sent through api.mailgun.net, for three kinds of message and no others: confirming an email address, sending that confirmation again, and resetting a password. That company receives the address the message goes to, the subject, and the body, which carries your username and a signed link.
The rewriting of the two pages that show a contact address. The network in front of this site rewrites those two pages on their way out and puts a small program of its own into them, so that the address is assembled in the browser instead of sitting in the page for anything scraping it. That program comes from the network and not from this site.

And the network itself. Every request to this site passes through Cloudflare first: it terminates the encrypted connection, so it sees the address you come from and every page you ask for, before this site does.

What this site keeps, and for how long

Every item below says what is stored, how long it stays, and what it is there for.

Your account — your username, your email address, the address it was created from, and the birth year, country and sex you chose to fill in, if you filled any of them in. Kept while the account exists, so you can sign in and so that what you write here belongs to somebody. What survives closing the account is the last section of this page.
Your picture, if you upload one — two files on this site's own disk, a large copy and a small one, kept until you replace it or take it away, so that it can be drawn beside your name.
Your comments, every earlier version of one you edited, and the address each comment was written from. Kept with no time limit, for as long as the comment is here, so that what an account said on this site cannot later be denied. The earlier versions are kept for the same reason: an edited comment cannot be made to have said something it never said.
Your votes — which designs your account voted on, and which way. Kept for as long as the design is in the catalogue, because they are what its score is made of.
The sign-in log — every attempt to sign in, the address it came from, whether it worked, and the identifier that was typed into the box, exactly as it was typed. Because it is stored as it was typed rather than as it was matched, it accumulates real email addresses, including typos and other people's. Kept for 30 days and then deleted, by a clean-up that runs on its own about once a day. It is there because it is what stops somebody guessing passwords at this site.
The account-mail log — the address a confirmation or a password reset was asked for, whether or not it belongs to an account here, and the address it was asked from. Kept for 7 days, deleted by the same daily clean-up. It is there to limit how often those messages can be asked for.
The page-view log — the address of every view of four of this site's pages, and of every search run in the gallery, with the time it happened. This one is kept with no time limit: nothing deletes it and no clean-up touches it. It is there to see which pages get used and which features people like.
Designs sent through the submission form — sending one writes the sender's address and the author name they typed into a file on this site's disk, and that file is kept, so that a design can be credited to whoever sent it and they can be written back to.
One leftover from an earlier version of this site — a table that once queued requests to edit a design still holds the address of whoever asked for one. Nothing writes to it any more and nothing reads it. It is on this list because it is still there.

Never sold, never given away

None of it is sold, rented, or handed to anybody. There is no analytics service on this site, no advertising network, no tracking pixel and no data broker. The outside companies named further up receive exactly what is described beside each of them, and there is no other.

Closing your account

You can close your account yourself, from your profile page. It asks for your password, and it cannot be undone. Here is exactly what it does.

What goes

Your username, replaced by deleted_user_ followed by your account's own number. The name you chose no longer appears anywhere on the site.
Your picture: cleared from the account, and both files deleted from this site's disk.
Your sessions. You are signed out everywhere at once, on every device.

What stays

Your email address, in an altered form that nothing on this site reads or matches against.
The address the account was created from.
Every comment you wrote and every earlier version of one, still readable under the anonymised name, and the address each comment was written from.
The birth year, country and sex held on the account.
The stored unreadable form of your password.
Every vote you cast, and every score it contributes to.

Why it stays

So that what an account did on this site cannot later be denied. Without the record linking a comment to the person who wrote it, anybody could say afterwards that they never wrote it.

What else changes, and what does not

The account cannot be signed into again.
The same email address can be used to register a brand-new account straight away. That is a separate account, and it carries none of the old one's comments or votes.
The old username becomes free for anybody to take.
No score changes. Closing an account moves no design's score by a single point.
An account with administrator rights cannot be closed from that page.