PRIVACY POLICY

Last updated: 13 July 2026 · Operated by The Forever Canvas, United Kingdom · Contact: hello@theforevercanvas.com

THE SHORT VERSIONWe collect the minimum needed to sell you a plot and keep it on the wall: your email, your purchase details, and the content you put on the Canvas (which is public — that's the product). Cards are handled entirely by Stripe. No advertising, no tracking cookies, no selling your data, ever. Email hello@theforevercanvas.com about your data and a human answers.

1. WHAT WE COLLECT, AND WHY

Your email address — collected by Stripe at checkout and shared with us so we can send your receipt, your "plot is live" notification, and any moderation notices about your plot. Legal basis: performing our contract with you.
Your purchase details — plot coordinates and size, amount paid, and a Stripe payment reference. We keep these as our record of what you bought and as evidence if a payment is ever disputed. Legal basis: contract, plus our legal obligation to keep business and tax records.
Your submitted content — your pixel art, your note, and your optional link. These are displayed publicly on the Canvas at your coordinates, permanently, with a public permalink. That is the service. Your name and email are never displayed — unless you choose to put them in your note.
Mailing-list email — only if you signed up on the landing page (double opt-in, via Buttondown). Legal basis: consent; unsubscribe at any time with the link in any email.
Your IP address — used briefly to prevent abuse (limiting how fast plots can be reserved, and recording who reported a plot so reports can't be spammed) and to show the anonymous "people here now" count on the canvas. Reservation IPs are deleted as soon as the reservation ends; rate-limit and presence records are deleted within minutes. Legal basis: our legitimate interest in keeping the Canvas working for everyone.

We do not collect card details (Stripe handles payment entirely — the card form is theirs), we don't run advertising or analytics trackers, and the only cookie the site sets is a sign-in cookie for our own admin console — regular visitors and buyers get no cookies from us at all.

2. WHO PROCESSES IT FOR US

A few boring, well-known services run the plumbing, each seeing only what it needs: Stripe (payments), Supabase (our database, hosted in the EU — Paris), Vercel (website hosting), Resend (transactional email), and Buttondown (the mailing list, only if you joined it). We may post publicly about sales on social media, but those posts contain only what's already public on the Canvas — never your email or identity.

We don't sell or rent personal data to anyone. There are no ad networks here.

3. HOW LONG WE KEEP IT

Canvas content: displayed indefinitely — permanence is the product. If content is removed for breaching the content policy, we keep a copy of the removed content and the reason as evidence for handling disputes.
Purchase records: kept for 6 years, as UK tax law requires.
Emails we've sent you: retained as part of the purchase record.
IP addresses: minutes, as described above.

4. YOUR RIGHTS

Under UK data protection law you can ask us what we hold about you, ask us to correct it, or ask us to delete it — email hello@theforevercanvas.com and a human will sort it, normally within a month. Two honest caveats: we can't delete purchase records the law requires us to keep, and asking us to take your plot off the Canvas is a request to end the display service — we'll do it, but per the terms that doesn't come with a refund. If you're unhappy with how we've handled your data, you can complain to the ICO (ico.org.uk).

5. CHANGES

If we change this policy, the current version lives at this address with the date at the top. Material changes that affect existing buyers get an email.

6. QUESTIONS

hello@theforevercanvas.com — a human reads it. Back to the canvas.