Who handles your information
This draft explains how Fashionframe handles information when you browse the site, create an account, upload screenshots, or save a look. The operator responsible for that processing is wadbot, at tenno.style. Privacy contact: [email protected].
Operator details and operational policies are still being confirmed. This draft does not represent a completed compliance assessment. Fashionframe is an independent community project and does not access your Warframe account.
Information the service uses
- Account information: username, email address, password verification data, account creation dates, and any display name or biography held in your profile. Profile editing is currently unavailable in the interface.
- Your looks: titles, descriptions, tags, selected Warframes and editions, cosmetics, palette selections, visibility, creation and update dates, and your creator identity.
- Uploaded images: the screenshot files you submit and information needed to validate, order, store, and display them, such as format, dimensions, and file size. Anything visible in a screenshot may become part of the shared image.
- Session information: access and refresh credentials and their expiry times, used to keep you signed in and authorize account actions.
- Requests and communications: requests to the site, its API, and image delivery services necessarily disclose connection information such as your IP address to those services. Infrastructure providers may also process access or security logs. If you contact the operator, the contents of your message and contact details are processed to answer it.
You do not need an account to view public fashion or use the palette catalog. An email address, username, and password are needed to create an account; optional descriptions, tags, and screenshots should contain only information you want to provide. Passwords are checked against a stored password hash and are not saved in browser storage.
Why information is used
Information supports account access, storing and displaying your looks, enforcing visibility settings, delivering images, maintaining security, diagnosing failures, responding to requests, and meeting applicable legal obligations.
Where the GDPR or a similar law applies, the proposed bases for review are performance of the service agreement for account and look features; legitimate interests in secure and reliable operation, subject to balancing against your rights; and legal obligation where a specific law requires processing. Optional activities that require consent would need a separate choice. Accepting terms is not blanket consent.
The operator must confirm each processing activity, its actual legal basis, and any legitimate-interest assessment before finalizing this policy. No automated decision-making with legal or similarly significant effects is implemented in the current application.
Browser storage and tracking
The application stores sign-in credentials and expiry times in your browser’s local storage so it can maintain your session. Logging out clears these credentials from that browser. Clearing site storage also removes them and signs you out locally; it does not delete your account or saved looks.
The current frontend contains no advertising or analytics integration and does not set advertising or marketing cookies. Its interface font is hosted with the site. Infrastructure providers may have their own necessary delivery or security processing, which still needs to be documented for the deployed site.
If optional analytics, advertising, or other tracking is introduced, this policy and any required consent controls must be updated before that processing starts. You can manage browser storage through your browser settings.
Retention and deletion
Saved looks remain available until you edit or delete them or the operator removes them. Deleting a look removes it from normal access and starts removal of its associated stored images. The current backend also retains a record marked as deleted; removing a look from the interface does not establish that every related record or backup has been erased.
The operator must specify and apply retention periods for account data, expired sessions, deleted-look records, abandoned uploads, logs, support messages, and backups. Those periods have not been verified for this draft, so no fixed deletion deadline is promised here. Legal obligations or the handling of a dispute may justify limited retention of relevant information.
You can delete your looks through the site. Account deletion and broader erasure requests currently need to be sent to [email protected]. Deletion cannot recall copies another person has independently downloaded or shared.
Security and international processing
The current application hashes passwords, uses expiring session credentials, and checks owner access for private look pages and changes to a look. These measures do not guarantee that data can never be lost or accessed without authorization. Protect your credentials and use a unique password.
Hosting and delivery may involve processing outside the country where you live. Provider locations, processing countries, and applicable international-transfer arrangements must be confirmed for the deployed service. Where the law requires safeguards, the operator must establish the appropriate mechanism and explain how you can obtain information about it before finalizing this policy.
Your rights and requests
Depending on applicable law and the processing involved, you may have rights to access, correct, erase, restrict, or receive a portable copy of your personal data, and to object to certain uses. Where processing is based on consent, you can withdraw it without affecting earlier lawful processing. Some rights have legal exceptions.
Send a request to [email protected]. The operator may ask for proportionate information to verify your identity and must respond within the time required by the applicable law. Do not send passwords or unnecessary identity documents.
Where the GDPR applies, requests generally require a response within one month; lawful extensions must be explained. You can also complain to a competent data protection authority, including in your country of residence, work, or the alleged infringement. Learn more from the European Commission’s information for individuals.
Age policy and updates
The accompanying draft Terms of Service propose a minimum account age of 16, subject to higher requirements or parental authorization under applicable law. The operator must confirm the age policy and appropriate safeguards before publication. If you believe information has been submitted by a child who does not meet the applicable requirements, contact [email protected].
The operator should update this policy when practices change, show a new revision date, and provide appropriate notice of material changes. A change requiring consent must not be treated as accepted merely because you continue browsing.