Who is responsible
Shadeon is operated by [Operator legal name] ([Postal address, if required]). For any question or request about your data, write to [contact email address].
What we collect, and why
If you only browse the site
- Anonymous page statistics. We use Vercel Web Analytics to count page views. According to Vercel's documentation it uses no third-party cookies; a visitor is recognised by a hash created from the incoming request, and that is discarded after 24 hours. With each page view it may record the time, the page address, the referring site, an approximate location (country, region, city), the browser, the operating system and the device type. We send it the page path only: query strings are removed first, and the waitlist confirmation and removal pages are not reported at all. We use these numbers to see which pages are used.
- Server logs. Our hosting provider processes your IP address and browser details in order to deliver the site and keep it secure, as every web server does.
- Preferences on your device. Your theme choice is saved in your browser's local storage. It never leaves your device. See the cookie notice.
If you create an account
You can explore every shader without an account. To see and copy the code you need a free account, which you can create with an email address and password, or with Google.
- Your email address, to identify your account, to sign you in, and to send you the emails the account needs (confirming your address, resetting your password). We do not send newsletters or marketing to account holders.
- Your password, only in scrambled form. We store a bcrypt hash of it, from which the password cannot be read back. Nobody at Shadeon can see your password.
- If you use Google: Google tells us your email address, that Google has verified it, and a number that identifies your Google account to us. We ask Google for nothing else: not your name, photo or contacts.
- Sign-in sessions. When you sign in we store a scrambled copy of a random session key, with when it was created and when it expires, so we know the browser holding the matching cookie is you.
- Your acceptance of the terms: which version of the Terms of use and this policy you accepted, and when.
- One-time email links (to confirm your address or reset your password), stored only in scrambled form. A sign-up that is never confirmed keeps your address and password hash only inside its link record, which expires after 24 hours; no account is created.
We use this to provide the account you asked for and to keep it secure. We do not use it for anything else.
If you join the Pro waitlist
- Your email address, the date you asked to join, and a record of the consent wording you agreed to.
- We use it for one purpose: to send you a confirmation email, and later a single announcement when Shadeon Pro is available. We rely on your consent, which you give by ticking the box and confirming by email.
If you request a shader or send a message
- What you write, and your email address if you choose to give one.
- We use it to read and act on your request or message, and to reply if you asked for a reply.
To protect the forms from abuse
- When you submit a form or try to sign in, we count attempts per network address and, for the waitlist and accounts, per email address or account, for a short time. The counters are keyed by a scrambled (hashed) version of the address, not the address itself, and expire within an hour.
- Forms may include a check by Cloudflare Turnstile to tell people from automated submissions. When it is active, Cloudflare receives technical details about your browser and connection to perform that check.
What we do not collect
- We do not store IP addresses in our database.
- We do not use advertising or cross-site tracking.
- We do not sell personal data or share it for marketing.
- We do not ask for your name. An account holds only what is listed above.
How long we keep it
- Waitlist, not confirmed: deleted 30 days after the last confirmation email.
- Waitlist, confirmed: until you remove yourself, or until the Pro announcement has been sent, after which the list is deleted.
- Shader requests and messages: deleted after 24 months.
- Account: until you delete it. Deleting it on your account page removes the account, its password hash, its Google link, its sessions and its email links at once.
- Sign-in sessions: until you sign out, or at most 30 days.
- Unconfirmed sign-ups: the link record expires after 24 hours and is deleted within a day after that. Password reset links expire after 30 minutes.
- Abuse counters: up to one hour.
Our database provider keeps short-term backups so the site can recover from a failure. Deleted data disappears from them when they expire, within 1 day, and is not used for anything in the meantime.
Who processes data for us
We use the following service providers. They process data on our instructions and only as needed to provide their service.
- Vercel: website hosting and page statistics.
- Neon: the database that holds accounts, waitlist addresses, requests and messages.
- Resend: sending account emails (confirmations and password resets) and the waitlist emails.
- Upstash: the short-lived abuse counters.
- Cloudflare: the Turnstile check on forms, when active.
If you choose Continue with Google, you sign in on Google's own pages, and Google handles that under its own privacy policy. Google then tells us only what is listed above.
These providers may process data in countries other than your own, including the United States.
Your choices and rights
- Leave the waitlist at any time with the link in any email we send you. Your address is deleted, not just switched off.
- Delete your account yourself at any time on your account page. It takes effect at once.
- Ask what we hold about you, ask us to correct it, or ask us to delete it, by writing to [contact email address]. Tell us the email address you used so we can find it.
- Withdraw your consent at any time. It does not affect what was done before you withdrew it.
- Complain. If you are unhappy with how we handled your data, please write to us first. You also have the right to complain to the data protection authority where you live.
We aim to answer every request within 30 days.
Children
The forms on this site are meant for people aged 18 or over. We do not knowingly collect data from children. If you believe a child has given us their data, write to us and we will delete it.
Security
The site is served over an encrypted connection. Passwords are stored only as bcrypt hashes (passwords must be at least 12 characters). Sign-in sessions, confirmation links and removal links are stored only in scrambled (hashed) form, so they cannot be recovered from our database. The session cookie cannot be read by scripts on the page. No system is perfectly secure, and we cannot promise that a breach will never happen; if one affects your data, we will tell you as the law requires.
Changes to this policy
If we change what we collect or why, we will update this page and its date. If a change affects data we already hold about you in a significant way, we will tell you by email where we have your address.