Privacy policy
In short: no advertising, no analytics, no tracking, no social media plugins. The website asks for no camera, microphone or location. Paint on the shared canvases is public and stored without your name. One small exception to "everything from our own server": to show posters in your country's edition, your browser asks the service country.is for your country.
1. Controller and contact
Pascal Schwendener (artist name: Pascal Sender)Burghofstrasse 88
40223 Düsseldorf
Germany
Email: support@sprayar.com
We have not appointed a data protection officer because we are not legally required to. For all privacy questions write to the address above.
This policy covers the sprayar.com website. The SprayAR Streets street map (its privacy policy) and the SprayAR iOS app have their own privacy policies.
2. Hosting
The website, its painting interfaces and our email are hosted by 1blu AG in Germany as our processor. When you open the website your browser necessarily sends technical connection data to the hoster: IP address, time, requested address, referring page, browser type and language. The hoster uses it to deliver and secure the website and may keep it in server log files; the retention of those log files is set by the hoster, and we do not evaluate them for any other purpose. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, working website.
Fonts, images, 3D models, films and scripts are delivered by the website itself; no content delivery networks or font services are loaded.
3. Shared web canvases
When you spray on a shared canvas, your browser sends the stroke to our server: a random stroke ID, the painted surface, the compressed spray data (positions, colour, opacity, pressure and similar paint values) and, on the main canvases, the time it was saved. The server stores the stroke together with a short code derived from your browser's random writer key (see section 5), so that you can undo your own strokes from the same browser. We cannot link this code to your name.
Visible to everyone: every saved stroke and its writer code can be loaded and seen by every later visitor. Do not paint personal information.
Abuse protection: to limit how many strokes can be sent in a short time, the server counts requests per writer code and per hash of your IP address combined with the current date. The raw IP address is not stored. These counters are deleted on the next write after their two-minute window has passed.
Retention: strokes have no automatic expiry. They stay until you undo them, we remove them (moderation, removal request) or a canvas is reset or retired. The canvases have a fixed maximum size. You can ask us to remove your strokes; please describe where they are, ideally with a screenshot.
Legal basis: Art. 6(1)(b) GDPR – providing the shared canvas you choose to use under the terms of use – and Art. 6(1)(f) GDPR for abuse protection.
4. Country lookup (country.is)
Some posters and station signs on the website appear in a regional edition. To choose it, your browser asks the external service country.is (country.is) for the country of your IP address. Your browser connects to that service directly, so it receives your IP address; no cookies or referrer are sent. We only keep the two-letter country code in your browser's session storage (section 5) and never receive or store the IP address from this lookup. The service's own privacy information applies. Legal basis: Art. 6(1)(f) GDPR – our interest in showing a localised artwork. You can object at any time (section 8); the website then shows the default edition, and the lookup can also be blocked with any content blocker.
5. Storage in your browser
The website stores the following in your browser. They are used only for functions you use on the website and are strictly necessary for them (§ 25(2) no. 2 TDDDG); we do not use them for tracking or advertising.
| Name | Purpose | Duration |
|---|---|---|
sprayar-writer-v1 (localStorage) | random writer key for the main shared canvases, lets you undo your own strokes | until you clear your browser data |
sprayar-park-writer-v1 (localStorage) | random writer key for the skatepark canvas | until you clear your browser data |
sprayar-last-poster-wall (localStorage) | shows a different poster wall on your next visit | until you clear your browser data |
sprayar-v3-previous (localStorage), sprayar-v3-feature (sessionStorage) | which featured scene you saw, so the next visit shows another one | until cleared / end of the browser session |
sprayar-ranking-last (localStorage) | last loaded leaderboard, shown while the current one loads | until you clear your browser data |
street.capYaw (localStorage) | direction of your character's cap in the street scene | until you clear your browser data |
sprayar-earth-flight-1 (sessionStorage) | plays the earth flight intro only once per visit | end of the browser session |
sprayar-poster-country (sessionStorage) | country code from the country lookup (section 4) | end of the browser session |
sprayar_beta (cookie, HttpOnly, Secure) | only if you use the beta forms: protects forms and sign-ins | end of the browser session |
6. Private beta sign-up
If you ask to join the private beta, we store your email address with your consent (Art. 6(1)(a) GDPR, consent version beta-2026-10-26-v1) to email you about beta access and testing. Unconfirmed requests expire after 48 hours, confirmed requests and access after one year. You can withdraw at any time with the deletion link in our emails or by writing to us. All details are in the beta privacy notice.
7. Leaderboard, links and the street map
The leaderboard on the website shows public artist names and statistics from the SprayAR Streets street map. Our web server fetches this public list from the street map server; your browser does not connect to the street map for it.
Links to the App Store, to the street map and to other websites only connect you to them when you click them. Their own privacy policies apply. The street map processes location and account data as described in its privacy policy.
8. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing unless we can demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.
Write to support@sprayar.com. Because painting needs no account, we may need your help (for example the page, surface and time, or your writer code) to find your strokes.
You can also complain to a data protection supervisory authority, for example the authority responsible for us:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.
9. What we do not do
No advertising, no analytics or tracking tools, no social media plugins, no selling or renting of data, no automated decisions within the meaning of Art. 22 GDPR. The website does not request camera, microphone or location access.
10. Children
The website is meant for people aged 16 and over. Younger visitors should only paint or sign up for the beta with the permission of a parent or guardian.
11. Changes
We update this policy when the website or the law changes. The version identifier changes with every update.