Privacy

1. Data controller

Pawlygon Studios is the data controller for the information processed through this site. You can reach us through the Contact page for any privacy related questions.

2. What we collect

• Contact form: your name, email address, message, and a record that you agreed to this privacy notice.
• Commission form: your name, email address, commission brief, selected tier, optional contact handles, reference links or files, and a record that you agreed to this privacy notice.
• Security tokens: when you submit a form, Cloudflare Turnstile receives a short-lived token and your IP address to verify you are not a bot. We do not store the token; Cloudflare processes it according to their own privacy practices.
• Preferences: your theme choice (light/dark/system) and audio mute state are stored in your browser's localStorage so the site remembers them across visits. The entrance animation cooldown and optional dev-toolbar settings are also stored locally.
• Technical data: our hosting provider sees routine connection data (IP address, browser type, timestamps) when your browser requests pages or assets. We do not log or analyse this data for tracking purposes.

3. Legal basis for processing

• Consent: contact and commission submissions are processed because you explicitly consent by checking the agreement box before submitting the form.
• Legitimate interest: we process IP addresses and Turnstile tokens to prevent spam and abuse, and we keep limited server logs for security and availability.
• Preferences: localStorage values are stored based on your explicit choices (clicking the theme or mute toggle) and are necessary to honour those choices.

4. How long we keep your data

Contact and commission submissions are kept for 24 months after the last activity on the request, unless you ask us to delete them earlier. Reference files uploaded with commission requests are kept for the same period. Turnstile tokens are verified and discarded immediately; Cloudflare retains them for a short period under their own policies. LocalStorage preference data remains on your device until you clear it.

5. Who we share data with

We do not sell personal data. We use a small number of service providers (subprocessors):

• Railway (hosting infrastructure) — processes server connection data.
• Directus (content management database) — stores contact and commission submissions and uploaded reference files.
• Cloudflare (Turnstile challenge + DNS/CDN) — processes challenge tokens and IP addresses for bot verification.

6. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure ("right to be forgotten").
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal).

To exercise any of these rights, contact us via the Contact page. We will respond within one month, free of charge.

7. Cookies and local storage

We do not use advertising, analytics, or third-party tracking cookies. We only store preference and security related values in your browser (theme, mute state, entrance cooldown, and your dismissal of this notice). You can clear these at any time through your browser settings.

8. Complaints

If you believe we are not handling your data properly, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence.