Aequorea

Legal

Privacy Policy

Last updated: 14 September 2026

This policy explains what personal data Aequorea Victoria collects when you use our website, our mobile app and our Museum on Steam, why we collect it, who we share it with, and the choices and rights you have. It applies together with our Terms and Conditions.

In short: we collect what we need to run an art platform: your account details, the art you share and the information you attach to it, and technical data about how the services are used. We do not sell personal data, we do not show advertising, and we do not use your data to rank or profile you. Your art, artist name, bio and comments are public by design; your e-mail address is not.

Contents

1. Who is responsible for your data

The data controller is Aequorea Victoria, an independent studio established in Portugal ("Aequorea", "we", "us"). For any question about this policy or your data, write to support@aequoreavictoria.com.

2. What this policy covers

This policy covers personal data processed through:

  • the Website at aequoreavictoria.com, including the art submission forms and the public artist and artwork pages;
  • the App for iOS and Android;
  • the Museum, our shared 3D space distributed through Steam; and
  • e-mail and other correspondence with us, including copyright notices.

It does not cover services run by other companies that you may reach from ours, such as Steam, the Apple App Store, Google Play, Discord, Spotify, Apple Music or YouTube. Those services have their own privacy policies (see Section 13).

3. The data we collect

Data you give us.

  • Account: e-mail address, username, and a password. Passwords are handled by our authentication provider and stored only in hashed form; we never see them in clear text.
  • Profile: your artist name, bio, profile picture, and country, if you provide them.
  • Submissions: everything you enter when you submit a work: title, description, year, tools used, genres, language, credits (producers, writers, cast, composers, record label, director), links to the work on other platforms, and the URLs of the image, audio, video, poster or cover files you host elsewhere. We may make a copy of those files so the work keeps displaying inside the services.
  • Community content: comments you leave on Museum walls, text chat, room names and anything else you post where other people can see it.
  • Correspondence: what you send us when you contact support, appeal a decision, or exercise a privacy right. Copyright notices and counter-notices additionally contain the name, postal address, telephone number and signature that the law requires (see our copyright policy).

Data collected automatically.

  • Technical data: IP address, device type and model, operating system and version, app version, browser type, language and time zone.
  • Usage data: pages and screens viewed, buttons used (for example a click on an app-store or Steam link), session length, and crash and error reports. On the Website and in the App this is collected through Google Firebase Analytics (see Section 9).
  • Abuse-prevention signals: our submission forms use Google reCAPTCHA, which collects hardware and software information and cookies to tell people from bots.
  • Museum session data: while you are in the Museum we process your position and actions in the space so that other visitors can see you, and we relay your voice and text chat to the visitors in the same room in real time. We do not keep recordings of voice chat. Wall comments are stored so that they persist between visits.
  • Server logs: our hosting provider keeps standard access logs (IP address, request, time, user agent) for security and troubleshooting.

Data from other sources.

  • Steam: when you use the Museum, Valve provides us with your Steam ID and display name, and, if you use the invite features, the friends you choose to invite. We do not receive your Steam password or payment details.
  • App stores: Apple and Google may tell us that the App was installed or that a purchase was made, without your payment details.
  • Other people: when someone reports a work or a comment, or sends a copyright notice, we receive the information in that report.

We do not knowingly collect special categories of data (such as health, religion, sexual orientation or political opinions). Please do not include such information in your profile, works or comments unless you are content for it to be public.

4. Why we use it and on what legal basis

Under the GDPR we need a legal basis for each use. These are ours:

  • Running the services and showing your work (creating and managing your account, publishing accepted works, syncing them between the App and the Museum, running multiplayer sessions, e-mailing you about the status of a submission). Basis: performance of our contract with you (Article 6(1)(b)).
  • Reviewing submissions and moderating (checking that a work meets our rules, handling reports, appeals and copyright notices). Basis: our legitimate interest in keeping the platform lawful and safe, and our legal obligations under the EU Digital Services Act and copyright law (Articles 6(1)(f) and 6(1)(c)).
  • Security and abuse prevention (reCAPTCHA, rate limits, detecting spam, cheating, scraping and account takeovers). Basis: legitimate interest (Article 6(1)(f)).
  • Understanding and improving the services (which pages and features are used, where the App crashes). Basis: consent where the law requires it for analytics cookies and identifiers (Article 6(1)(a)); otherwise legitimate interest (Article 6(1)(f)).
  • Telling you about important changes to the services or to our terms. Basis: contract and legal obligation.
  • Keeping records that we may need to comply with the law, to establish or defend legal claims, and to prove that you accepted our terms (we store the date and version of the terms you accepted with each submission). Basis: legal obligation and legitimate interest.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated tools may flag spam, malware, known illegal material or abuse; any decision that affects your account is reviewed by a person.

5. What is public

Aequorea is a place for showing art, so a good deal of what you share is public on purpose. The following is visible to other users and, on the Website, to anyone on the internet, including search engines:

  • your artist name, username, bio, profile picture and country;
  • your works, together with their title, description, year, tools, genres, credits and links;
  • comments you leave on Museum walls, and your presence and chat in a Museum room while you are there.

Your e-mail address, password, IP address and other technical data are never published. Please think before including personal details about yourself or other people in a title, description, bio or comment.

6. Who we share data with

We share personal data only as described here:

  • Service providers that process data on our behalf and under our instructions: Google (Firebase hosting, authentication, Firestore database, Cloud Functions, Cloud Storage, Analytics and reCAPTCHA); Valve (Steam, for distributing the Museum and multiplayer features); Apple and Google (for distributing the App and sending push notifications if you enable them); and our e-mail delivery provider for transactional messages.
  • Other users and the public, as described in Section 5.
  • People who file a copyright notice. If you submitted a work that is the subject of a valid notice, we may pass your counter-notice, including your contact details, to the person who complained, because the law requires it.
  • Authorities and legal process. We may disclose data where the law requires it, to comply with a court order or a lawful request from a public authority, or to protect the rights, safety or property of Aequorea, our users or others. We will report child sexual abuse material to the relevant authorities.
  • Business transfers. If Aequorea is reorganised, merged or acquired, your data may be transferred to the successor, who will be bound by this policy. We would tell you before that happens.
  • With your consent, for anything else.

7. International transfers

We are in Portugal, but some of our service providers store or process data in the United States. In particular, our Cloud Functions and parts of our Firebase infrastructure run in Google data centres in the US, and Valve, Apple and Google are US companies. Where personal data leaves the European Economic Area we rely on the safeguards the GDPR provides: the European Commission's adequacy decision for organisations certified under the EU-US Data Privacy Framework, and otherwise the Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at support@aequoreavictoria.com.

8. How long we keep data

  • Account and profile data: for as long as your account exists, then deleted or anonymised within 90 days of closure, except as noted below.
  • Works and submissions: for as long as the work is published. When you remove a work or close your account, it is removed from public view promptly and from our systems within 90 days, subject to backups. Declined submissions are kept for up to 12 months so that we can handle questions and repeat submissions, then deleted.
  • Comments and community content: for as long as the Museum or the conversation they belong to exists. When you close your account, comments may be kept in anonymised form unless you ask us to delete them.
  • Terms-acceptance records (date and version accepted): for the life of the account and up to 5 years afterwards, so we can prove consent.
  • Copyright notices, counter-notices, reports and appeals: up to 5 years, so we can apply our repeat-infringer policy and respond to legal claims.
  • Technical logs and analytics: server logs up to 12 months; Firebase Analytics data up to 14 months.
  • Support correspondence: up to 3 years after the matter is closed.
  • Backups: deleted data may persist in encrypted backups for up to 90 days before it is overwritten.

We may keep data for longer where a law requires it or where it is needed to establish, exercise or defend legal claims.

9. Cookies, analytics and similar technologies

Website. The Website uses a small number of cookies and similar technologies:

  • Strictly necessary: those needed to load the site securely, to keep you signed in, and to remember choices you make on the site.
  • Google reCAPTCHA on the submission forms sets cookies and reads device information to detect bots. It is subject to Google's privacy policy and terms.
  • Google Firebase Analytics (Google Analytics) sets cookies such as _ga to measure which pages are visited and which links are used. This data is pseudonymous and is not used for advertising. Where the law requires it, we ask for your consent before setting analytics cookies; you can also block them in your browser settings or with Google's opt-out browser add-on.

App. The App does not use browser cookies but uses device identifiers and the Firebase SDK for the same analytics and crash-reporting purposes. You can limit this on iOS under Settings, Privacy and Security, Tracking and Analytics, and on Android under Settings, Google, Ads.

Museum. The Museum uses Steam's own client and identifiers; Valve's cookie and privacy settings apply.

We do not use advertising cookies, cross-site tracking pixels, or social media tracking.

10. Security

We protect data with measures appropriate to the risk: encryption in transit (TLS) and at rest, hashed passwords, access limited to the people who need it, server-side validation of everything sent to us, captcha and rate limits on public forms, and infrastructure run by providers with independent security certifications. No system is perfectly secure, so please use a strong, unique password, keep your Steam and Apple or Google accounts secure, and tell us at once at support@aequoreavictoria.com if you think your account has been compromised. If a breach affects your data in a way that is likely to put your rights at risk, we will tell you and the supervisory authority as the GDPR requires.

11. Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you and receive a copy of it;
  • Rectify data that is inaccurate or incomplete;
  • Erase your data ("right to be forgotten"), subject to the retention reasons in Section 8;
  • Restrict processing while a dispute about accuracy or lawfulness is resolved;
  • Data portability: receive the data you gave us in a structured, commonly used, machine-readable format;
  • Object to processing based on our legitimate interests, on grounds relating to your particular situation;
  • Withdraw consent at any time where processing is based on consent, without affecting processing that took place before; and
  • Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you.

To exercise any of these rights, write to support@aequoreavictoria.com from the e-mail address linked to your account, or tell us how we can confirm it is you. We will respond within one month, which we may extend by two further months for complex requests; we will tell you if that happens. Exercising your rights is free unless a request is clearly unfounded or excessive.

You can also remove individual works, edit your profile and close your account using the tools in the App or the Museum.

If you are unhappy with how we handle your data, you have the right to complain to a supervisory authority. In Portugal that is the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. If you live elsewhere in the EU or EEA you can complain to the authority in your own country. We would appreciate the chance to resolve your concern first.

12. Children

The services are not directed at children under 16, and we do not knowingly collect personal data from them. If you are a parent or guardian and believe a child under 16 has created an account or submitted a work, contact us at support@aequoreavictoria.com and we will delete the data.

The services link to, and depend on, services run by other companies. When you follow a link to Spotify, Apple Music, YouTube, a file host or any other site, or when you use Steam, the Apple App Store, Google Play or our community server on Discord at https://discord.gg/bNHJtgVR2k, those companies' privacy policies apply, not this one. We encourage you to read them.

14. Changes to this policy

We may update this policy as the services and the law evolve. We will post the new version here with a new "last updated" date. If a change materially affects how we use your data, we will tell you by e-mail or in the App or Museum before it takes effect and, where the law requires it, ask for your consent.

15. Contact

Privacy questions and requests: support@aequoreavictoria.com. Copyright notices: dmca@aequoreavictoria.com.

Privacy questions and requests

support@aequoreavictoria.com