Your email. Your choice.

This notice covers the SprayAR website sign-in, beta access and earlier waiting-list requests.

Controller

Pascal Schwendener, Burghofstrasse 88, 40223 Düsseldorf, Germany. support@sprayar.com.

What we collect and why

For website sign-in, we store your encrypted email address, request and confirmation dates and access status. This is needed to provide the account access you request (Article 6(1)(b) GDPR). Email sign-in sends a private, one-use link that expires in 15 minutes. Opening it verifies your address and accepts access immediately. Google sign-in verifies your email and accepts access immediately. An existing access suspension remains in force. Signing in does not subscribe you to marketing or beta news.

Earlier waiting-list signups used this optional consent: “Email me about SprayAR beta access and testing. I can withdraw at any time.” Version beta-2026-10-26-v1. Those earlier consent records remain separate from the new account-only sign-in. You can withdraw earlier consent or request account deletion by contacting support@sprayar.com or using a deletion link in an earlier email. Withdrawal does not affect processing that was lawful before withdrawal.

Continue with Google

If you choose “Continue with Google” (or “Sign in with Google”), Google Ireland Ltd. confirms your email address and sends us a signed token. We check the token and store only your email address (encrypted, as described below), treated as confirmed. No newsletter consent is required to sign in. Google processes the sign-in under its own privacy policy.

Continue with Apple

When enabled and chosen, Apple verifies your identity and sends a signed sign-in token. We verify its signature, issuer, website identifier, expiry and the one-use sign-in challenge. We store the verified email address, which may be an Apple private relay address, encrypted as described below. Signing in does not subscribe you to marketing. Apple processes sign-in under its own privacy policy.

The street painting page

The street painting page at sprayar-streets.3ekproduction.workers.dev uses the same beta access service. Opening Streets from your signed-in website profile creates a one-use access link that expires after 90 seconds. Your street-game profile is managed separately by the street service. Its requests reach this service through our Cloudflare proxy, which passes on your network address in a signed header for the abuse checks above; the cookies described below are then stored for that page.

Protection and service providers

Email addresses are encrypted in the private database outside the public website directory. Access is limited to the operator. The website and outgoing email use the existing 1blu hosting service in Germany; email delivery also involves your email provider. Email necessarily travels through mail servers. We do not sell addresses. Apple receives information when you choose to open TestFlight and join a beta under Apple’s terms; this website does not automatically create an Apple account or register you with Apple.

Retention

Unconfirmed requests expire after 48 hours; confirmed requests and access expire after one year from confirmation. Expired records are removed on the next beta service request. Deletion links remove the signup and its access tokens immediately. One-use confirmation and sign-in tokens are stored as hashes. The essential cookie protecting forms and sign-ins (sprayar_beta) is HttpOnly and Secure and lasts until the browser session ends. After an approved sign-in, a remember-me cookie (sprayar_remember, HttpOnly, Secure) keeps that device signed in for up to one year, with a small hint cookie (sprayar_full) so the full page opens directly; signing out, withdrawal or revocation ends it. Admin authorization lasts eight hours.

Abuse prevention uses keyed address hashes that rotate hourly and are deleted after one hour on the next service request. With each signup we keep one keyed hash of the network address (never the address itself) to detect mass signups; it is deleted with the signup. No raw visitor IP address is stored in the beta database. If the operator explicitly enables trusted home access, that one public network address is stored for access control until the operator changes or removes it. Ordinary hosting security logs may contain connection data; these are separate from the beta database. Aggregate daily preview page-open counts are kept for 90 days, without cookies for analytics, individual visitor profiles or stored full URLs. Abuse prevention and these aggregate operational counts rely on our legitimate interest in securing and operating this service (Article 6(1)(f) GDPR).

Your rights

You may request access, correction, deletion, restriction, portability and, where applicable, object to processing. Contact support@sprayar.com. You can complain to a supervisory authority, including LDI NRW. Providing an email is optional; without it we cannot provide individual beta access. Beta access is accepted automatically after sign-in; existing suspended accounts remain unavailable.

The public moon canvas

Paint strokes are stored on the website server and shown to later visitors until removed, without an automatic expiry. A random local writer identifier lets you undo your own marks; it is separate from your beta email. Do not paint personal information. Contact support to request removal. Persistent storage is not a promise that the service will exist indefinitely.