Privacy Policy

1. Introduction

SOTP ("we," "us," or "the Service") provides a real-time collaborative drawing and chat platform. This Privacy Policy explains our commitment to your privacy in compliance with the Swiss Federal Act on Data Protection (nLPD/FADP) and the EU General Data Protection Regulation (GDPR).

2. Data Controller

The individual responsible for processing your personal data is:

• Name: Avdyl Avduli
• Email: contact@sotp.ch

3. Access Control & Membership

To ensure the security and accountability of our collaborative environment, SOTP follows a Member-Only access model:

• Authenticated Access: Core features—including drawing on the canvas, participating in the real-time chat, and saving work to a personal gallery—are strictly inaccessible to non-logged-in users.
• Guest Limitations: Unauthenticated visitors can only access a public landing page and cannot interact with the canvas or the chat system.

4. Data We Collect & Third Parties

We apply the principle of Data Minimization, collecting only what is essential for the service:

• Authentication: SOTP offers both Google OAuth and direct account registration. When using Google, we receive your email, name, and profile picture. When registering directly, we store your email and a securely hashed version of your password. We never store plain-text passwords.
• User Contributions: We store the pixel updates (strokes) you make on the canvas and the messages you send in the chat.
• Gallery Interactions (AI Recommendations): To provide a personalized experience, we record interactions such as likes, shares, and saved canvases. This data is used exclusively to improve our gallery recommendation system within the app.

5. Storage Technologies & Lifecycles

We use various storage methods to balance security with user experience:

6. Data Hosting & "Zero-Log" Policy

• Swiss Hosting: All application servers and the database are physically located in Switzerland, ensuring your data is protected by Swiss law.
• No IP Logging: We do not log your IP address, further protecting your anonymity during use.

7. Data Retention & The Right to be Forgotten

We provide a robust Delete Account feature:

• Full Deletion: Triggering this action permanently removes your user profile and all personal canvases you have created from our database.
• Anonymization: Any remaining interaction data on shared canvases (pixels or chat messages) is stripped of all personal identifiers and linked only to an anonymous ID.

8. Your Rights

Under the nLPD and GDPR, you have the right to:

• Access your data.
• Correct inaccurate information.
• Delete your data ("Right to be Forgotten").
• Export your data in a structured, machine-readable format.

9. Legal Notice / Impressum