This policy explains how Su-Kunst ("we", "us") handles personal data when you use Su-Kunst, either on the website or in the mobile app (together, "the platform"). By using the platform you agree to the practices described here. If you don't agree, please don't use it.
1. Data we collect
Account information you give us
- Required at sign-up: your name, email address, password, gender and account type (artist or user). We only ever store your password as a one-way hash, so we can't read it.
- Optional profile details: phone number, bio, profile photo, website and location. Your location is a text field you fill in yourself. We never read your device's GPS.
- Preferences: your theme (light or dark) and your notification settings.
Content you create
- Posts, including the photos and videos you upload.
- Comments, likes and follows.
- Events and opportunities you publish, including any contact email you add to them.
- Direct messages you send to other members.
Information collected automatically
- Sign-in sessions: while you are signed in, we store your IP address, browser or device type (user agent) and the time of your last activity. We use this to keep you signed in and to protect your account.
- Last login time: recorded on your account.
- App downloads: when you download the Android app, we log the time, your IP address and your user agent.
- Notifications: the in-app notifications we generate for you (for example "someone liked your post") are stored on our server until they are deleted.
- Analytics: if analytics is switched on, Google Analytics collects usage data such as pages visited, approximate location derived from your IP address, and device and browser information. See section 4.
What we don't collect
- We don't access your device's precise location, contacts, camera roll (other than the files you choose to upload) or microphone.
- We don't process payments, so we hold no card or bank details.
- We don't use push-notification services, and we don't build advertising profiles.
2. How we use your data
| Purpose | Data used | Why we're allowed to |
|---|---|---|
| Creating and running your account, and signing you in | Account information, sessions | Necessary to provide the service you asked for |
| Showing your profile and content to other members and visitors | Profile, posts, comments, events, opportunities | Necessary to provide the service |
| Delivering messages and notifications | Messages, notifications, email address | Necessary to provide the service |
| Sending service emails (verification, password reset, notification emails you opted into) | Email address, name | Necessary to provide the service, or your choice in notification settings |
| Keeping the platform safe: moderating content, investigating reports and preventing abuse | All of the above, including IP addresses | Our legitimate interest in a safe community, and legal obligations |
| Understanding how the platform is used so we can improve it | Analytics data | Our legitimate interest, where analytics is enabled |
We don't sell your personal data, and we don't use it for targeted advertising. Ads shown on the platform are placed by us directly. We don't use third-party ad networks, and we don't build advertising profiles about you.
3. Who can see your data
- Everyone, including visitors who aren't signed in: your name, profile photo, bio, website, location (if you filled it in), and your public posts, comments, events and opportunities. Some pages may be limited to members by the administrators.
- Other members: the members you message can see those messages. Members can see who you follow and who follows you.
- Platform administrators: administrators can see all account information, and they can read private conversations. They use this access only to investigate reports, enforce our Terms and Community Guidelines, protect users, and meet legal obligations. Direct messages are not end-to-end encrypted, so please don't use them to share things like passwords or financial details.
- Authorities: we may disclose data when the law requires it, or when it's needed to protect someone's safety, including reports of child sexual abuse material (see our Child Safety Standards).
Your email address and phone number are never shown publicly.
4. Service providers
We use a small number of third parties to run the platform. Each one receives only what it needs:
- Hosting (Amazon Web Services): our servers, database and uploaded files are hosted on AWS.
- Email delivery: service emails are sent through an SMTP email provider, which receives your email address and the message content.
- Google Analytics (Google LLC): used only when an administrator has enabled it. It sets cookies and receives usage data as described in Google's Privacy Policy.
- DiceBear (avatar service): if you haven't uploaded a profile photo, your browser requests a generated placeholder avatar from api.dicebear.com, and your display name is sent to create it.
- Content delivery networks (cdnjs, jsDelivr): icons and scripts are loaded from these networks, which receive your IP address and user agent as part of any normal web request.
These providers may process data outside Suriname. Where they do, we rely on their own safeguards and contractual commitments.
5. Cookies and local storage
- Essential cookies: a session cookie that keeps you signed in, and a security (CSRF) token cookie that protects forms. The platform can't work without them.
- Analytics cookies: set by Google Analytics, and only when analytics is enabled.
- Mobile app: the app stores your sign-in token and preferences on your device.
You can clear or block cookies in your browser settings, but if you block essential cookies you won't be able to sign in.
6. How long we keep data
- Account and content: for as long as your account exists. When you delete something yourself it disappears from the platform straight away.
- Suspended or archived accounts: kept hidden until an administrator restores or permanently deletes them.
- Sessions: they expire after a period of inactivity, and are removed when your account is deleted.
- App download logs: kept to protect the download service from abuse. When your account is deleted, these logs are unlinked from it.
- Backups: server backups may hold deleted data for a limited time until they are overwritten.
7. Your rights and choices
- Access and correction: you can view and edit your profile at any time in Settings.
- Notifications: you can switch email and real-time notifications on or off in Settings → Notifications.
- Deletion: you can ask us to delete your account and everything you've posted. See Delete Your Account.
- A copy of your data: you can ask us for a copy of the personal data we hold about you.
- Objection: you can object to how we use your data, or ask us to restrict it.
To use any of these rights, email sukunst26@gmail.com from the address linked to your account. We reply within 30 days.
8. Security
We protect your data with encrypted connections (HTTPS), hashed passwords, access controls that limit administrator tools to administrators, and private storage for downloadable files. No system is perfectly secure, though, so please use a strong, unique password and tell us straight away if you think your account has been compromised.
9. Children
The platform is not intended for children under 13, and you must be at least 13 to create an account. If you're under the age of majority where you live, you need permission from a parent or guardian. If we find out that a child under 13 has created an account, we'll delete it. If you think this has happened, please contact us.
10. Changes to this policy
We may update this policy as the platform changes. We'll change the "Last updated" date at the top of the page, and if the changes are significant we'll tell you on the platform or by email.
11. Contact
Su-Kunst, Suriname.
Questions about privacy: sukunst26@gmail.com.