Privacy Policy

1. Who we are

WeAreTheWorld is operated from Sweden. Contact us at hello@we-are-the-world.live for any privacy question.

2. What we collect

• Account data: email address, hashed password, sign-in timestamps. If you sign in with Google we receive your email and a stable account identifier from Google.
• Profile data: display name, country, optional bio.
• Portrait: the photo you upload, stored in four resized variants (original, 1024, 256, 64 px).
• Technical data: IP address and basic device information collected by our auth and hosting providers for security and abuse prevention.

3. Why we use it

• To run your account and let you sign in.
• To show your portrait in the mosaic and on your public profile.
• To moderate the mosaic and act on reports.
• To keep the service secure and prevent abuse.

4. Who sees what

• Your portrait is public as soon as it's approved — it appears in the mosaic for anyone to see.
• Your display name, country and bio are only public if you turn on the shareable profile link from your profile page.
• Your email address is never shown publicly.

5. Third parties

We use Lovable Cloud (Supabase) to host the database, file storage and authentication, and Google OAuth as an optional sign-in method. These providers process data on our behalf under their own privacy terms.

6. How long we keep it

We keep your data for as long as your account exists. When you remove your portrait, the image files and mosaic tile are deleted within a few minutes. When you delete your account, all profile data is removed within 30 days; backups age out within 90 days.

7. Your rights

You have the right to access, correct, export, or delete your personal data. Most of this you can do yourself from your profile; for the rest, email us at hello@we-are-the-world.live. If you're in the EU/EEA you also have the right to lodge a complaint with your local data protection authority.

8. Cookies

We only use cookies that are strictly necessary to keep you signed in. We don't run third-party analytics or ad-tracking cookies.