GDPR and Data Rights

• Account identity — email address, display name and session data, processed to create and operate the account you request (contract, Article 6(1)(b)).
• Saved Garden — model, paper, duration, title and saved creation data, processed to sync and restore your Garden (contract, Article 6(1)(b)).
• Authentication and abuse prevention— hashed sign-in challenges, timing, attempts and a keyed IP-derived request fingerprint, processed to secure accounts and the service (contract and legitimate interests, Articles 6(1)(b) and 6(1)(f)).
• Public Gallery post — display name, model, paper, creation date and optional caption, processed because you ask us to publish it and consent to its display (Articles 6(1)(b) and 6(1)(a)).
• Operational logs — limited network, security and error information processed to prevent abuse and keep the service reliable (legitimate interests, Article 6(1)(f)).
• Legal compliance — a limited record where processing is required by applicable law (Article 6(1)(c)).

Where we rely on legitimate interests, those interests are preventing automated abuse, protecting user accounts, diagnosing failures and maintaining a safe public Gallery. We limit the information used, apply one-way hashing where practical and do not use this basis for advertising or cross-site profiling. You may object based on your particular circumstances.

Railway hosts the application and production database; Resend delivers one-time sign-in emails; Cloudflare provides DNS and related network services. Authorised personnel and professional advisers may access limited information only when needed for support, security, compliance or legal claims.

Resend and Railway publish data-processing addenda. We do not give personal data to advertisers or data brokers. Public Gallery data is, by definition, available to anyone who visits or receives its link.

Some providers operate internationally, including in the United States. When personal data protected by EEA or UK law is transferred to a country without an applicable adequacy decision, the transfer is covered by an approved mechanism such as the EU Standard Contractual Clauses, the UK addendum, an applicable Data Privacy Framework certification or another lawful safeguard. Contact us for information relevant to your data.

• One-time codes expire after 10 minutes; challenge records are routinely cleared.
• Sessions expire after 30 days and the current session is ended when you sign out.
• Account and synced Garden data is retained while the account remains open.
• Public Gallery posts remain until withdrawn or removed.
• Backups and security records expire on limited operational schedules unless law requires longer retention.

Subject to the conditions and exceptions in applicable law, you may:

• request access to personal data and a copy of it;
• correct inaccurate or incomplete data;
• request erasure where there is no lawful reason to retain data;
• restrict processing in the circumstances set out by law;
• receive data you provided in a structured, machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent without affecting earlier lawful processing; and
• complain to a competent supervisory authority.

We do not make solely automated decisions that produce legal or similarly significant effects about you.

Email hello@origamisite.com with “Data rights request” in the subject. Using the email address on your account usually gives us enough information to locate the account. We may ask for limited additional verification when reasonably necessary and will not request more identification than the risk requires.

We normally respond within one month and do not charge a fee. A lawful extension or reasonable fee may apply to a complex, repeated or manifestly unfounded request; if so, we will explain why. Guest-only Garden data and private reflections are controlled by your browser and can be removed by clearing this site’s local data.

Please contact us first so we can investigate. You may also complain to the data protection authority where you live, work or believe an infringement occurred. The European Data Protection Board lists EEA authorities; UK users may contact the Information Commissioner’s Office.