Privacy

last updated 3 November 2026

Short version: I only collect what I need to draw your commission and, if you sign up, to email you when slots open. No cookies, no analytics, no ads, no tracking, and I never sell or share your data for anything else.

Who's responsible

This page is run by pupDarius, a private individual artist. For anything about your data, email pupdarius00@gmail.com.

What I collect, and why

When you send a commission request

Your name, the platform and username (or Gmail address) where I should message you, your description, the reference images you add, and what you picked: sizes, flat or shaded, SFW or NSFW, promo code and the price, plus when you sent it and any notes I add while working on it. I use it to read, answer and draw your commission (GDPR Art. 6(1)(b): steps before and for our agreement). Only I can see your contact details, your description, your references and my notes. If your request is NSFW it says something about your sex life, so I keep it strictly to drawing your piece. I need your name, contact and description to answer you; references and the quote are optional.

On the public Queue

Every open request hangs on the Queue as a receipt: order number, date, sizes, flat or shaded, SFW or NSFW, the price, whether a promo code was used, and its status. Your name is on it only if you tick "show my name on the public Queue" (your consent, Art. 6(1)(a)), and then it sits next to SFW or NSFW; otherwise it says "anonymous". Changed your mind? Message me and I'll switch it to anonymous.

When you sign up for the newsletter

Your email address and when you signed up, to tell you when commission slots open, about new art and promo codes (your consent, Art. 6(1)(a)). Unsubscribe any time by emailing me; every newsletter will also have an unsubscribe link. The newsletter is for people 16 and older.

To stop spam

When you send a request or sign up, the database keeps a scrambled version of your IP address (a salted hash, not the address itself) so one connection can't flood the form (my legitimate interest in keeping the page usable, Art. 6(1)(f)). It is erased automatically within 24 hours.

There are no automated decisions about you: I read and answer every request myself.

What stays in your browser

No cookies. A few things are kept in your own browser so the page works, and never leave it:

• pupos-music: whether you turned the music off.
• pupos-mine: which Queue receipts are yours, with the name and description you sent, so yours shows a YOU tag.
• pupos-tos and pupos-order: that you agreed to the terms, and your price quote, for this tab only.

Clear them any time by clearing this site's data in your browser settings.

Who else handles it

• Supabase: the database and file storage for requests, reference images and the newsletter, on servers in Frankfurt, Germany. Any access from outside the EU is covered by the EU Standard Contractual Clauses in Supabase's data processing agreement. Every visit loads the Queue from Supabase, so it also sees your IP address: its logs keep the IP, the rough location worked out from it (city, country, network provider) and your browser type for 1 day.
• Cloudflare: hosts this page and serves the animation library. Like any web host, it sees your IP address to deliver the page.
• jsDelivr: serves the database library, and Google Fonts: serves the fonts. Both see your IP address to deliver their files.
• When I message you or you pay: the platform you picked (Instagram, X, TikTok, Discord or Gmail) and PayPal or Ko-fi, under their own privacy policies.

Cloudflare, Google and jsDelivr can deliver files from servers outside the EU; Cloudflare and Google are certified under the EU-US Data Privacy Framework. Sending you the page and its files, and keeping it running, is my legitimate interest (Art. 6(1)(f)).

How long I keep it

• Requests and their reference images: deleted within 90 days after the commission is finished or declined.
• Reference images from a request that never got sent: deleted within 30 days.
• Newsletter email: until you unsubscribe.
• The scrambled IP address: within 24 hours.
• Supabase's request logs (IP address, rough location, browser type): 1 day.

Your rights

You can ask me for a copy of your data, to correct or delete it, to limit or object to how I use it, or to get it in a portable format. You can take back your consent any time (unsubscribe, or switch your Queue name to anonymous); that doesn't undo anything done before. Just email pupdarius00@gmail.com. You can also complain to a data protection authority, for example the one in the EU country where you live.