Pictureboard
Privacy policy
This policy explains how Pictureboard processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR).
1. Controller
Pupu Toivonen, Finland, pupu@pupu.me.
2. What we process, why, and on which legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Username, display name, account creation date | Providing your account; letting others share desktops with you | Art. 6(1)(b) GDPR (contract) | Until you delete your account |
| Passkey public keys and their metadata (name, dates, usage counter) | Logging you in securely. Your biometric data and private keys never leave your device. | Art. 6(1)(b) GDPR | Until you remove the passkey or delete your account |
| Session cookie, session dates, coarse device category (desktop/mobile/tablet, operating system and browser family) | Keeping you logged in; letting you see and end sessions; security | Art. 6(1)(b) and (f) GDPR | 30 days after login or until logout |
| Desktops, layouts, uploaded pictures, picture URLs, sharing settings | Providing the service | Art. 6(1)(b) GDPR | Until you or the desktop owner delete them |
| Hours in which you used the service, with device category | Aggregate usage statistics to operate and improve the service | Art. 6(1)(f) GDPR (legitimate interest in running the service) | 400 days |
| IP address, time and request in server logs | Delivering the website; defending against attacks | Art. 6(1)(f) GDPR | Only processed transiently by the application; reverse proxy logs per operator configuration (recommended: at most 14 days) |
We do not use tracking, advertising, analytics services, or third-party scripts or fonts. We do not sell data and do not make automated decisions with legal effect.
3. Pictures from the web
When you add a picture by URL, our server — not your browser — downloads it, and checks it again at the interval you chose. The website that hosts the picture therefore sees our server's address, not yours.
4. Recipients
Desktops you share are visible to the people you share them with, including your display name and username. The service is hosted by [Hosting provider, location], acting as processor under Art. 28 GDPR. We do not transfer personal data outside the EU/EEA unless the hosting location requires it, and then only with appropriate safeguards (Art. 44 ff. GDPR).
5. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can download all your data and delete your account at any time on your account page. For anything else, contact us at pupu@pupu.me. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your residence or place of work.
6. Cookies and local storage
See our cookie notice.
7. Security
All traffic is encrypted (HTTPS). Logins use passkeys (WebAuthn), which are resistant to phishing. Pictures are only delivered to people with access to a desktop that contains them.