Privacy Policy

Your account

Sign-in uses Google: we receive your account-specific Google identifier, email address, first name and last name to identify you and manage your account.

We use protected sign-in credentials to maintain your session with Google. A Google outage may require you to sign in again; removing access in Google does not necessarily close an existing BenBen session immediately.

Managing your account and publications is based on providing the service you request.

What you add to your public profile (bio, links, contact details if you choose to display them) is visible to everyone.

What you publish

Artworks you make public, your comments and your likes are visible to other visitors.

Messages sent through the contact form are stored on the site for the recipient artist and may be delivered to them by email.

Visit statistics

We measure site traffic with Umami, a self-hosted tool that works without audience-measurement cookies.

To avoid counting visits to the same artwork repeatedly, we temporarily use a pseudonymised fingerprint derived from your IP address. The same network counts at most once per artwork per UTC day. The raw IP address is not stored in this counter.

Fingerprints are deleted automatically after the counting day, normally within five minutes after midnight UTC. An outage may delay erasure until service resumes. View totals are retained.

These measurements rely on our legitimate interest in understanding site traffic. You can object using the button below. This choice applies to audience measurement on this browser, not to technical security logs.

Cookies

The following cookies support sign-in or remember a choice to exclude traffic from statistics. Some are only present during sign-in or in specific situations.

bb-audience-opt-out: remembers your objection to audience measurement for 390 days, or until you withdraw that choice.

ba-no-track: excludes administrator-configured connections from Umami. Its 30-day lifetime is renewed on relevant requests; this cookie does not pseudonymise IP addresses.

next-auth.callback-url: remembers the redirect after sign-in; a browser-session cookie.

next-auth.csrf-token: protects authentication requests; a browser-session cookie.

next-auth.session-token: stores the encrypted session, readable by the servers but not page scripts, with a 30-day expiry that can be renewed when the session is used. This cookie does not guarantee 30 days of access: access depends on valid credentials and their renewal, with a new explicit sign-in required after at most 30 days. It may be split across cookies with numeric suffixes.

next-auth.state: protects the OAuth flow; lasts at most 15 minutes and is deleted when checked.

next-auth.pkce.code_verifier: protects the OAuth code exchange; lasts at most 15 minutes and is deleted when checked.

Storage in your browser

Apart from cookies, local storage saves your language in “locale” and your objection to the Umami tracker in “umami.disabled”. These entries have no automatic expiry. “umami.disabled” is removed when statistics resume or when the site detects that the opt-out cookie has expired or been deleted; the language remains until changed or until site storage is cleared.

These preferences are specific to the browser you use. Clearing cookies or site storage may reset them.

Technical logs

Servers record technical logs that may include your IP address, the requested address, the date and the time. They are used for security and troubleshooting, based on our legitimate interest in protecting the service, and are separate from the artwork counter.

Retention and sharing

Your account data is kept while the account exists. You can delete it as explained in the section below.

Copies of the database and images are kept in recovery backups to restore the site after an incident. Deleting your account does not automatically purge these archives. To request erasure of your data from these backups, email support.benben@gmail.com. Support handles these requests manually; sending a request does not trigger immediate erasure of the archives.

The site is hosted by OVH. It also uses email services and Google for sign-in. Public data is also accessible to visitors.

Delete your account

You can permanently delete your account from your profile, in the “Delete your account” section. A recent Google sign-in and confirmation are required; you will be offered a new sign-in if needed.

Deletion removes your profile, artworks and files managed by the site, likes, attributable messages and reports you submitted. Discussions on deleted artworks are also removed; on artworks that remain, an empty unattributed placeholder may remain to preserve replies from other users.

Recovery backups are not automatically purged, as explained above. Emails already delivered and copies outside the site cannot be deleted from BenBen. Accounts with administrative privileges must contact support.

Your rights

Under the GDPR, you can access, correct or delete your data, or object to its processing. You can also lodge a complaint with the CNIL (cnil.fr).