Privacy Policy

Last updated: 21 October 2026

This policy explains what personal data Aequorea Victoria collects when you use our website, our mobile app and our Museum on Steam, why we collect it, who we share it with, and the choices and rights you have. It applies together with our Terms and Conditions.

In short: we collect what we need to run an art platform: your account details, the art you share and the information you attach to it, and technical data about how the services are used. We do not sell personal data, we do not show advertising, and we do not use your data to rank or profile you. Your art, artist name, bio and comments are public by design; your e-mail address is not. Analytics and ad-measurement cookies on the Website are optional and stay off unless you accept them.

Contents

• 1. Who is responsible for your data
• 2. What this policy covers
• 3. The data we collect
• 4. Why we use it and on what legal basis
• 5. What is public
• 6. Who we share data with
• 7. International transfers
• 8. How long we keep data
• 9. Cookies, analytics and similar technologies
• 10. Security
• 11. Your rights
• 12. Children
• 13. Third-party links and services
• 14. Changes to this policy
• 15. Contact

1. Who is responsible for your data

The data controller is Aequorea Victoria Limited, a private company limited by shares registered in Ireland ("Aequorea", "we", "us"). For any question about this policy or your data, write to support@aequoreavictoria.com.

• Legal entity: Aequorea Victoria Limited
• Registered in: Ireland, company number 828849
• Registered office: 4 Blackrock Court, Old Blackrock Road, Cork T12 RF9K, Ireland
• E-mail: support@aequoreavictoria.com

2. What this policy covers

This policy covers personal data processed through:

• the Website at aequoreavictoria.com, including the art submission forms and the public artist and artwork pages;
• the App for iOS and Android;
• the Museum, our shared 3D space distributed through Steam; and
• e-mail and other correspondence with us, including copyright notices.

It does not cover services run by other companies that you may reach from ours, such as Steam, the Apple App Store, Google Play, Discord, Spotify, Apple Music or YouTube. Those services have their own privacy policies (see Section 13).

3. The data we collect

Data you give us.

• Account: e-mail address, username, and a password. Passwords are handled by our authentication provider and stored only in hashed form; we never see them in clear text.
• Profile: your artist name, bio, profile picture, and country, if you provide them.
• Submissions: everything you enter when you submit a work: title, description, year, tools used, genres, language, credits (producers, writers, cast, composers, record label, director), links to the work on other platforms, and the URLs of the image, audio, video, poster or cover files you host elsewhere. We may make a copy of those files so the work keeps displaying inside the services.
• Community content: comments you leave on works, room names and anything else you post where other people can see it. Museum text chat is relayed live and not stored by us (see "Museum session data" below).
• Correspondence: what you send us when you contact support, appeal a decision, or exercise a privacy right. Copyright notices and counter-notices additionally contain the name, postal address, telephone number and signature that the law requires (see our copyright policy).

Data collected automatically.

• Technical data: IP address, device type and model, operating system and version, app version, browser type, language and time zone.
• Usage data (Website only, and only if you accept analytics cookies): pages viewed, buttons used (for example a click on an app-store or Steam link) and visit length, collected through Google Firebase Analytics (see Section 9). The App and the Museum contain no analytics or crash-reporting SDK.
• Abuse-prevention signals: our submission forms use Google reCAPTCHA, which collects hardware and software information and cookies to tell people from bots.
• Museum session data: Museum multiplayer is peer-to-peer. A session is hosted by one player's game and carried over Valve's Steam networking, including the Steam relay network. Your position, avatar, text chat and voice travel through Valve's network and the hosting player's game to the other players in the session; they do not pass through Aequorea's servers and we do not store them. Voice is compressed by Steam, played back live, and never recorded or stored by us. You can turn voice chat off, or switch to push-to-talk, in the Museum's Settings.
• Server logs: our hosting provider keeps standard access logs (IP address, request, time, user agent) for security and troubleshooting.

In the Museum. On top of the above, the Museum processes:

• Sign-in: either an Aequorea account (e-mail address and password, which you can create in the game) or an anonymous guest account, both through Google Firebase Authentication.
• Steam identity: the Museum reads your Steam ID and Steam display name from the Steam client on your computer. Your display name is shown to other players in text chat and lobbies. When you host a session, your Steam ID is published in the Steam lobby as the address other players connect to. We do not store your Steam ID or display name on our servers.
• Dreams: the text you write in the Dreams room is stored with your user ID, your username, whether you chose to sign it, and the time. A moderator reviews every dream before anyone else can see it. Unsigned dreams are shown without a name, but stay linked to your account internally so that we can moderate them and delete them when you ask. Please do not put anything in a dream that identifies you or other people, or that reveals health, beliefs or other sensitive matters.
• Opinions: the short "good" or "bad" written reactions you leave on works, stored with your user ID, the work and the time, and reviewed by a moderator before they are shown.
• Likes: when you like or save a work, we store that against your user ID and the work so the Museum can remember it. Likes are private bookmarks: no like counts are shown to anyone, the artist included.
• Avatar: the body model you choose, the paint on your avatar (colours, brushes and positions), and whether you allow other players to paint on you.
• Rooms and paint: the layout, lighting and art you arrange in Your Art Room, which you can submit for review to become a public Artist Room; and paint added to the Museum's walls and objects during a session, which is saved to the account of the player hosting that session.
• Supporter status: whether you own the Supporter, Patron or Benefactor DLC is read from Steam and saved to your artist profile as a tier label. We never receive payment details; Valve handles the purchase.
• Settings on your computer: graphics and audio settings, key bindings, the selected microphone, voice-chat volume, voice-chat and push-to-talk preferences, and unlocked teleports. These are stored only on your computer and are never sent to us.

Data from other sources.

• Steam: as described above, the Museum reads your Steam ID, display name and DLC ownership from the Steam client. If you invite friends, you choose them in Steam's own overlay; we do not receive your friends list. We do not receive your Steam password or payment details.
• App stores: Apple and Google may tell us that the App was installed or that a purchase was made, without your payment details.
• Other people: when someone reports a work or a comment, or sends a copyright notice, we receive the information in that report.

We do not knowingly collect special categories of data (such as health, religion, sexual orientation or political opinions). Please do not include such information in your profile, works or comments unless you are content for it to be public.

4. Why we use it and on what legal basis

Under the GDPR we need a legal basis for each use. These are ours:

• Running the services and showing your work (creating and managing your account, publishing accepted works, syncing them between the App and the Museum, running multiplayer sessions, e-mailing you about the status of a submission). Basis: performance of our contract with you (Article 6(1)(b)).
• Reviewing submissions and moderating (checking that a work meets our rules, handling reports, appeals and copyright notices). Basis: our legitimate interest in keeping the platform lawful and safe, and our legal obligations under the EU Digital Services Act and copyright law (Articles 6(1)(f) and 6(1)(c)).
• Security and abuse prevention (reCAPTCHA, rate limits, detecting spam, cheating, scraping and account takeovers). Basis: legitimate interest (Article 6(1)(f)).
• Understanding and improving the Website (which pages and links are used). Basis: your consent to analytics cookies (Article 6(1)(a)), which you can withdraw at any time under Cookie settings in the Website footer.
• Measuring our own advertising (whether an ad we ran on another site or app led to a visit to the Website). Basis: your consent to marketing cookies (Article 6(1)(a)), which you can withdraw at any time.
• Telling you about important changes to the services or to our terms. Basis: contract and legal obligation.
• Keeping records that we may need to comply with the law, to establish or defend legal claims, and to prove that you accepted our terms (we store the date and version of the terms you accepted with each submission). Basis: legal obligation and legitimate interest.

We do not show advertising in the services, we do not sell your data, and we do not use it for personalised advertising, remarketing or advertising profiles. The only advertising-related processing is the optional conversion measurement above, which happens only if you accept marketing cookies. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated tools may flag spam, malware, known illegal material or abuse; any decision that affects your account is reviewed by a person.

5. What is public

Aequorea is a place for showing art, so a good deal of what you share is public on purpose. The following is visible to other users and, on the Website, to anyone on the internet, including search engines:

• your artist name, username, bio, profile picture and country;
• your works, together with their title, description, year, tools, genres, credits and links;
• comments you leave on works once they are published, and your presence and chat in a Museum session while you are there;
• dreams you sign, shown with your username, and dreams you leave unsigned, shown as text only, once a moderator has approved them;
• opinions on works, once a moderator has approved them;
• your avatar's appearance and paint, seen by the players in the same session;
• your Artist Room, once it has been approved and published, and paint added to the Museum during a session you take part in; and
• your supporter tier label, which is saved to your public artist profile.

Your e-mail address, password, IP address and other technical data are never published. Please think before including personal details about yourself or other people in a title, description, bio or comment.

6. Who we share data with

We share personal data only as described here:

• Service providers that process data on our behalf and under our instructions: Google (Firebase hosting, authentication, Firestore database, Cloud Functions, Cloud Storage and reCAPTCHA; and, only if you accept the matching cookies on the Website, Google Analytics and Google Ads conversion measurement); and our e-mail delivery provider for transactional messages.
• Platform providers that run their own services under their own privacy policies: Valve (Steam, which distributes the Museum, supplies your Steam identity and DLC ownership, and carries multiplayer traffic, text chat and voice between players through its network and relays); and Apple and Google (which distribute the App).
• Other players hosting a Museum session. When you join a session, the hosting player's game receives your position, avatar, display name, text chat and voice so it can pass them to the other players in that session.
• Other users and the public, as described in Section 5.
• People who file a copyright notice. If you submitted a work that is the subject of a valid notice, we may pass your counter-notice, including your contact details, to the person who complained, because the law requires it.
• Authorities and legal process. We may disclose data where the law requires it, to comply with a court order or a lawful request from a public authority, or to protect the rights, safety or property of Aequorea, our users or others. We will report child sexual abuse material to the relevant authorities.
• Business transfers. If Aequorea is reorganised, merged or acquired, your data may be transferred to the successor, who will be bound by this policy. We would tell you before that happens.
• With your consent, for anything else.

7. International transfers

We are in Ireland, but some of our service providers store or process data in the United States. In particular, our Cloud Functions and parts of our Firebase infrastructure run in Google data centres in the US, and Valve, Apple and Google are US companies. Where personal data leaves the European Economic Area we rely on the safeguards the GDPR provides: the European Commission's adequacy decision for organisations certified under the EU-US Data Privacy Framework, and otherwise the Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at support@aequoreavictoria.com.

8. How long we keep data

• Account and profile data: for as long as your account exists, then deleted or anonymised within 90 days of closure, except as noted below.
• Works and submissions: for as long as the work is published. When you remove a work or close your account, it is removed from public view promptly and from our systems within 90 days, subject to backups. Declined submissions are kept for up to 12 months so that we can handle questions and repeat submissions, then deleted.
• Comments and community content: for as long as the Museum or the conversation they belong to exists. When you close your account, comments may be kept in anonymised form unless you ask us to delete them.
• Dreams (signed and unsigned): while published, and deleted when you close your account. Declined dreams are deleted within 12 months, like declined submissions.
• Opinions: while published, and deleted when you close your account. Declined opinions are deleted within 12 months.
• Likes, avatar, Art Room and wall paint saved to your account: for as long as your account exists.
• Museum sessions: position, avatar, chat, voice and Steam lobby data are not stored by us. They exist only on Valve's network and the players' computers for the length of the session.
• Terms-acceptance records (date and version accepted): for the life of the account and up to 5 years afterwards, so we can prove consent.
• Copyright notices, counter-notices, reports and appeals: up to 5 years, so we can apply our repeat-infringer policy and respond to legal claims.
• Technical logs and analytics: server logs up to 12 months; Firebase Analytics data up to 14 months. Cookie lifetimes are listed in Section 9.
• Support correspondence: up to 3 years after the matter is closed.
• Backups: deleted data may persist in encrypted backups for up to 90 days before it is overwritten.

We may keep data for longer where a law requires it or where it is needed to establish, exercise or defend legal claims.

9. Cookies, analytics and similar technologies

Website. The Website has no sign-in, so it sets no session or login cookies of its own. It uses three kinds of cookies and similar storage:

• Strictly necessary (always on): remembering your cookie choice, and Google reCAPTCHA on the submission forms, which sets a cookie and reads device information to tell people from bots. reCAPTCHA is subject to Google's privacy policy and terms.
• Analytics (only with your consent): Google Firebase Analytics (Google Analytics) measures which pages are visited and which links are used. This data is pseudonymous and is not used for advertising.
• Marketing (only with your consent): the Google Ads conversion linker, which tells us whether one of our own ads on another site or app led to your visit. No ads are shown on the Website, and this data is not used for remarketing or personalised advertising.

When you first visit, a banner asks for your choice, with equal "Accept all" and "Reject all" buttons and a Settings option for each category. Until you accept, the Google Analytics and Google Ads code is not loaded at all and none of the optional cookies below are set. We use Google Consent Mode: every signal starts as "denied", and only the categories you accept are switched to "granted" (personalised advertising is never granted). You can change or withdraw your choice at any time under Cookie settings in the Website footer; withdrawing deletes the optional cookies from your browser. We ask again after 6 months.

You can also block or delete cookies in your browser settings, or use Google's Analytics opt-out browser add-on.

App. The App uses no cookies and contains no analytics, crash-reporting or advertising SDK. It stores your sign-in session on your device so that you stay signed in. If we ever add usage analytics to the App, we will update this policy first and ask for your consent in the App before collecting anything.

Museum. The Museum uses the Steam client, plus Google Firebase (Authentication and Firestore) to sign you in and to load and save art, rooms, dreams and comments. It contains no analytics or advertising SDKs; the Unity engine's analytics and crash-reporting services are switched off. Your settings are stored only on your computer (see Section 3).

We do not use cross-site tracking pixels or social media tracking, and no advertising cookies are set unless you accept the marketing category on the Website.

10. Security

We protect data with measures appropriate to the risk: encryption in transit (TLS) and at rest, hashed passwords, access limited to the people who need it, server-side validation of everything sent to us, captcha and rate limits on public forms, and infrastructure run by providers with independent security certifications. No system is perfectly secure, so please use a strong, unique password, keep your Steam and Apple or Google accounts secure, and tell us at once at support@aequoreavictoria.com if you think your account has been compromised. If a breach affects your data in a way that is likely to put your rights at risk, we will tell you and the supervisory authority as the GDPR requires.

11. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectify data that is inaccurate or incomplete;
• Erase your data ("right to be forgotten"), subject to the retention reasons in Section 8;
• Restrict processing while a dispute about accuracy or lawfulness is resolved;
• Data portability: receive the data you gave us in a structured, commonly used, machine-readable format;
• Object to processing based on our legitimate interests, on grounds relating to your particular situation;
• Withdraw consent at any time where processing is based on consent (for Website cookies, under Cookie settings in the footer), without affecting processing that took place before; and
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.

To exercise any of these rights, write to support@aequoreavictoria.com from the e-mail address linked to your account, or tell us how we can confirm it is you. We will respond within one month, which we may extend by two further months for complex requests; we will tell you if that happens. Exercising your rights is free unless a request is clearly unfounded or excessive.

You can remove individual works and edit your profile using the tools in the App. To close your account, follow the steps at aequoreavictoria.com/delete-account; you do not need the App or the Museum installed. One account is shared by the App and the Museum, so closing it removes you from both. Closing your account deletes your sign-in account, your artist profile, your works and the files stored for them, your dreams, opinions and likes, your avatar, your Art Room, and paint saved to your account, subject to the exceptions in Section 8.

If you are unhappy with how we handle your data, you have the right to complain to a supervisory authority. Because we are established in Ireland, our lead supervisory authority is the Data Protection Commission (DPC), dataprotection.ie. If you live elsewhere in the EU or EEA you can complain to the authority in your own country. We would appreciate the chance to resolve your concern first.

12. Children

You must be at least 16 years old to create an account or submit a work. Sixteen is the age of digital consent in Ireland (Data Protection Act 2018, section 31). The services are not directed at children under 16, and we do not knowingly collect personal data from them. If you are 16 or 17, please read this policy and our Terms with a parent or guardian. If you are a parent or guardian and believe a child under 16 has created an account or submitted a work, contact us at support@aequoreavictoria.com and we will delete the data.

13. Third-party links and services

The services link to, and depend on, services run by other companies. When you follow a link to Spotify, Apple Music, YouTube, a file host or any other site, or when you use Steam, the Apple App Store, Google Play or our community server on Discord at https://discord.gg/bNHJtgVR2k, those companies' privacy policies apply, not this one. We encourage you to read them.

14. Changes to this policy

We may update this policy as the services and the law evolve. We will post the new version here with a new "last updated" date. If a change materially affects how we use your data, we will tell you by e-mail or in the App or Museum before it takes effect and, where the law requires it, ask for your consent.

15. Contact

Privacy questions and requests: support@aequoreavictoria.com. Copyright notices: dmca@aequoreavictoria.com.

Changelog

• 21 October 2026: The controller is now Aequorea Victoria Limited, a company registered in Ireland (company number 828849), and the lead supervisory authority is the Irish Data Protection Commission. Described the data the Museum actually collects (sign-in, dreams, opinions, likes, avatar, room and wall paint, supporter status, local settings); explained that Museum multiplayer is peer-to-peer over Steam; added a cookie table, a cookie consent banner and the optional marketing category; corrected the App analytics section (the App has no analytics SDK); pointed account deletion to aequoreavictoria.com/delete-account; added retention periods for Museum data; based the minimum age of 16 on Irish law.
• 14 September 2026: Previous version.