Privacy Policy

When you log in or link an account, the chosen provider (Discord, Google, or LINE) securely transmits only the basic profile data necessary to create and manage your account:
- Discord: user ID, username, and email address (with an optional prompt to join the official community Discord server).
- Google: Google ID, name, and email address (including Google One Tap support).
- LINE: LINE user ID, display name, and email address (if granted by the user or an internal account identifier).

Usernames are automatically sanitized (retaining only a-z0-9_\-. characters, with a length between 3 and 20 characters) and checked against reserved and previously deleted usernames to ensure system compatibility and prevent impersonation. We do not request access to your private messages, contacts, Google Drive, Discord servers (beyond optional community join), or other sensitive account data.

Authentication interactions taking place on external platforms (Discord, Google, or LINE) are governed by their respective privacy policies:
- Discord Privacy Policy
- Google Privacy Policy
- LINE Privacy Policy

Fumoshare acts as an independent data controller once authentication is completed.

When you log in or link an account via Discord, Google, or LINE, we store your unique provider account ID, account name, and email address. By default, your profile avatar on Fumoshare is assigned from a random Fumo plush in our catalog, keeping your social media avatar private unless updated by you from our catalog. You may also configure optional profile preferences such as country, interface language, profile visibility, whether to show your collection's estimated market value, and whether your saved bookmarks are visible publicly.

For security, session maintenance, and abuse prevention, we temporarily process the IP address and browser User-Agent associated with your session. Session cookies are cryptographically signed and expire automatically after 30 days (with sliding daily expiration updates during active use) or upon explicit logout. We also maintain technical anti-abuse tokens (rate-limiting windows and Turnstile challenges) and a flag indicating whether the platform was accessed via the official Android app (Trusted Web Activity) to award platform badges.

The photos you upload (FumoFumo plushies, captions, tags, physical plush sizes) and social interactions (comments, likes on posts and comments, follows) are stored in our database to provide community features. In addition to standard posts, users can share Fumo Stories: temporary photos that automatically expire and cease public display after 7 days (168 hours). Uploaded images are processed and optimized via self-hosted tools (see Section 9).

You can save and bookmark your favorite posts for quick personal access. Your saved posts list is kept private by default or made visible on your public profile according to your account privacy preferences (showSaved).

When publishing a post, you may optionally attach geographic coordinates. To protect your privacy, latitude and longitude coordinates are automatically blurred server-side using a random offset of approximately 0.02 degrees (~2 km) before being saved. Meter-precise location is never stored in our database or displayed on the sightings map. Location submission is entirely optional and can be edited or removed at any time.

We save your notification preferences (which community activities trigger alerts). If you enable browser Web Push notifications, we store the required cryptographic push endpoints (endpoint URL, p256dh, and auth keys). Push notifications can be revoked at any time through your browser or site settings.

If you report a post, comment, or story, we store the report ID and selected reason. This data is non-public and accessible only to staff for moderation purposes. In the event of platform rule violations, account standing records (temporary or permanent suspension state, suspension reason, and reinstatement timestamps) are recorded to protect the community and compute fair reputation scores.

Your saved wishlist and owned Fumo plush models are stored to render your personal FumoDex collection page. You may also optionally record personal Fumo purchase dates to track your collection history.

If you participate in community features, we record your digital card packs, card collection, card recycling state, and card trading records with other collectors (participation can be toggled in profile settings). We also store your customized FumoWall (Fumo Room) layout, background theme, placed plush coordinates, and received wall likes. Furthermore, we track earned community badges and 3D achievements.

Comments are shown in their original language. Registered users can request a display-only machine translation of a single comment written in a language different from their own; the original text and its moderation status are never modified. When a translation is requested, the comment text (up to 2,000 characters) is processed by our self-hosted translation engine and the result is stored in a translation cache keyed by a SHA-256 hash of the text together with the target language, so identical texts are not re-processed and are served instantly on subsequent requests.

Account authentication, publishing and browsing posts, stories, community feed, global sightings map, comments, likes, saved bookmarks, user profiles, wishlist, personal collection history, customized FumoWall rooms, collectible cards, and notifications.
Legal basis: performance of a contract (providing the service requested by the user).

Published posts, stories, comments, and profile content are shown publicly to the community and may be visible to visitors. Comments can be machine-translated on demand for display only (see Sections 3.J and 9), and approved public posts may be announced on our official community channels on Discord, Telegram, Bluesky, and X. You retain ownership of your photos and grant us the non-exclusive, royalty-free, worldwide license described in our Community Rules.
Legal basis: performance of a contract and consent.

Protecting the platform against unauthorized access, spam, and fraudulent activity. Includes IP rate-limiting, upload anti-abuse tokens, Cloudflare Turnstile (CAPTCHA), SHA-256 image hashing to detect duplicate blocked uploads, and automated/manual content moderation.
Legal basis: legitimate interest of the data controller.

Aggregated web traffic measurement using self-hosted Plausible Analytics and Cloudflare Web Analytics, both completely cookie-free and GDPR-compliant.
Legal basis: legitimate interest of the data controller.

Verification of Fumo plush presence via OpenAI CLIP (ViT-B/32) and detection of inappropriate or sensitive (NSFW) content (including pornography, hentai, and sexually explicit imagery) via a dedicated, self-hosted nsfwjs model. All models run in isolated self-hosted Docker containers.
Legal basis: legitimate interest of the data controller (maintaining platform safety and content standards).

Editorial articles are machine-translated into the supported site languages through a self-hosted LibreTranslate engine, so readers can access our content in their own language; the original language is always preserved as the canonical version. In addition, registered users can request an on-demand, display-only translation of individual user comments written in a language other than their own. Translation is purely presentational: moderation and enforcement always apply to the original text, which is never altered. Cached translations are keyed by a non-reversible hash of the text (see Section 3.J).
Legal basis: legitimate interest of the data controller (multilingual accessibility).

We may retain and disclose personal data where necessary to comply with legal obligations, or in response to valid requests from competent authorities (such as law enforcement agencies or judicial orders). Where legally permitted and feasible, we will inform the affected user before disclosing their data.
Legal basis: compliance with a legal obligation to which the data controller is subject.

All image analysis is performed server-side by local Machine Learning models running in isolated, self-hosted Docker containers:

OpenAI CLIP (ViT-B/32): Multimodal AI model running in a dedicated container (fumoshare_ml). It performs zero-shot semantic matching between the image embedding and customizable verification prompts configured by staff administrators. The model is used exclusively for Fumo Detection: verifying the presence of a physical FumoFumo plush toy in the uploaded photo.

nsfwjs (TensorFlow.js): Specialized neural network classifier running in a dedicated microservice container (fumoshare_nsfw). It categorizes images across five standard visual classes (Porn, Hentai, Sexy, Drawing, Neutral) to compute a weighted sensitivity score:
- NSFW & Sensitive Content Detection: accurately identifying photographic and illustrated sexual content, hentai, and explicit imagery before publication.

Both models run in isolated local Docker containers on our own server. Images are transmitted exclusively over an internal Docker network bridge and are NEVER sent to OpenAI, third-party cloud APIs, or external processors.

Our machine learning system does not send user photos to any third-party cloud service. All inference takes place 100% within our self-hosted server infrastructure. Both models (OpenAI CLIP and nsfwjs) use static, pre-trained open weights hosted entirely on our own Docker containers. No data leaves our European Union servers during classification.

Analysis scores determine whether a post is automatically published, queued for manual staff review in the admin panel, or blocked. Stories are evaluated via automated screening. Decision thresholds are fully configurable by staff administrators through the admin panel to ensure fair moderation. In borderline cases, posts are flagged for human review.

Automated moderation does not produce legal effects or similarly significant effects on your account without human involvement. Under Article 22 of the GDPR you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. You may request human review of any automated moderation decision affecting your content by contacting our staff on the official Discord server, and you can express your point of view and contest the decision.

A cryptographically signed session cookie maintains your logged-in state after authentication (Discord, Google, or LINE). Managed by Better Auth, it is named __Secure-better-auth.session_token over HTTPS (or better-auth.session_token), configured with httpOnly (inaccessible to client scripts), sameSite: 'lax', and strictly enforced over secure connections. Maximum duration: 30 days (automatically extended once daily during active use). Invalidated instantly upon logout.

The PARAGLIDE_LOCALE cookie remembers your selected language (English, Italian, Japanese, French, Spanish, German, etc.). Duration: 1 year (up to 400 days). Used solely to serve localized content.

The fumo_style cookie remembers your visual preference for rendering Fumo plushies (transparent photography vs. pixel art). Duration: 1 year. Stored as a purely technical cookie for both visitors and registered members.

The theme cookie remembers your selected color theme (light, neon or amoled). Duration: 1 year. Stored as a purely technical cookie for both visitors and registered members.

The fumo_friday_music cookie preserves your audio preferences (volume level and pause/mute state) for the weekly Fumo Friday community event. For guests and anonymous visitors, this cookie avoids audio restarting unexpectedly when opening multiple tabs. Duration: 1 year.

Short-lived, technical cookies used strictly during specific user flows: join_discord (transient cookie recording your request to join the community Discord server during OAuth login, immediately deleted after use), new_user (lasts 60 seconds after registration to direct you to onboarding and profile setup), and onboarding_last_attempt (temporary rate-limit protection for username selection).

Non-personal user UI preferences are saved locally in your browser: FumoSnap settings, FumoDex version grouping, active theme, and temporary navigation state. This data remains confined to your device and is never uploaded.

Self-hosted Plausible instance running on our infrastructure. Captures anonymous aggregated metrics (page views, browser, OS, general country) using a daily rotating hash of IP + User-Agent. No persistent user tracking or cross-site profiling.
Plausible Data Policy.

Privacy-focused web traffic statistics at the DNS/CDN level without cookies or browser fingerprinting.
Cloudflare Privacy Policy.

Application servers and PostgreSQL database run on Hetzner Online GmbH infrastructure in Nuremberg, Germany (Network zone eu-central, European Union). All relational user data and databases reside securely in Germany in full compliance with GDPR.
Hetzner Website | Hetzner Privacy Policy.

Uploaded post images, stories, and Fumo catalog assets are stored on Cloudflare R2 (S3-compatible storage) with explicit European Union (EU) data jurisdiction.
Cloudflare Privacy Policy.

Non-intrusive, cookie-free CAPTCHA system used for anti-bot verification when upload tokens expire.
Cloudflare Privacy Policy.

Self-hosted Docker container performing real-time image resizing and WebP conversion. Image URLs are cryptographically signed with HMAC-SHA256 keys to prevent unauthorized image manipulation.

Site typography uses the Outfit variable font, self-hosted and served directly from our own infrastructure (/fonts/). No requests are made to external font services such as Google Fonts, and no data is shared with third parties for typography.

Editorial articles are automatically translated into the supported site languages by a self-hosted LibreTranslate engine (Argos Translate models) running in an isolated Docker container on our European Union infrastructure. Translation runs entirely on our own servers and no article or comment text is ever sent to external translation APIs (Google Translate, DeepL, etc.). Articles are staff-authored editorial content; individual user comments are additionally translated on demand for display purposes only, when a user requests it (see Sections 3.J and 4).

Sightings map tiles loaded from OpenStreetMap (tile.openstreetmap.org).
OpenStreetMap Privacy Policy.

Country flag images shown in the profile country selector are loaded from flagcdn.com, a public CDN for country flags. Only a standard image request is made and no personal data is transmitted.
flagcdn.com.

The official Fumoshare bot connects community interactions with Discord: it synchronizes the server roles linked to your account (language, badges, and staff roles), keeps your display name and username aligned, sends optional direct-message notifications you can disable, and mirrors comments between the community Discord forum threads and the site. In particular, messages you post in a linked forum thread are stored as comments on the corresponding Fumoshare post (and vice versa), so they become visible to the Fumoshare community. In addition, approved public posts may be announced across official community channels on Telegram, Bluesky, and X to highlight collector photography.

All traffic between your browser and Fumoshare is encrypted in transit using TLS/HTTPS. Data stored in our PostgreSQL database and in Cloudflare R2 object storage is encrypted at rest by our infrastructure providers. Uploaded images are served through cryptographically signed URLs. Session cookies are cryptographically signed and set with httpOnly and sameSite protections.

Access to non-public personal data is limited to staff members with a legitimate operational need, through authenticated admin accounts governed by a fine-grained permission system (panel and sub-section access). Administrative actions are recorded in an audit log. Secrets and API keys are kept in environment files that are never committed to the source repository. We do not store passwords, because authentication is delegated entirely to Discord, Google, and LINE.

Fumoshare hosts and processes personal data on servers located in the European Union (application servers and PostgreSQL database on Hetzner in Nuremberg, Germany; Cloudflare R2 object storage configured with EU data jurisdiction). We do not transfer your personal data to countries outside the EU/EEA.

When you authenticate through Discord, Google, or LINE, those providers process your data under their own terms and international transfer mechanisms, as they act as independent controllers for that processing. Any transfer to them is governed by their respective policies (see Section 2).

Session cookies and technical session logs (IP, User-Agent) are kept for the active session duration or up to a maximum of 30 days.

Fumo Stories are temporary and automatically expire and cease public display after 7 days (168 hours).

Published posts, photos, comments, likes, follows, saved bookmarks, card collections, FumoWall rooms, and wishlist items are retained while the user account remains active or until account deletion.

Rate-limit windows reset automatically. Image SHA-256 hashes for blocked content are retained to prevent re-uploading policy-violating images.

Plausible Analytics retains anonymized aggregate data (IP salt rotated every 24 hours).

Cached machine translations of user comments are retained to speed up repeat requests and are keyed by a non-reversible SHA-256 hash of the source text together with the target language. They contain no direct user identifier and may be evicted at any time.

When an account is suspended or permanently banned, we retain the account and its moderation records, and we may retain limited identifiers such as the username to prevent the person from evading the ban. This information is kept for as long as necessary to enforce our rules and protect the community, and in any case for a minimum of 12 months. Content that was hidden solely because of a suspension or ban is restored if the account is reinstated.

Hetzner Online GmbH (VPS & Database, Nuremberg, Germany, EU) and Cloudflare Inc. (R2 Storage & Turnstile).

Discord Inc., Google LLC, and LINE Corporation (OAuth2 identity providers).

Plausible Insights OÜ (self-hosted), OpenStreetMap Foundation, and flagcdn.com (country flag images).

In the event of a merger, acquisition, reorganization, or transfer of assets, personal data may be transferred to the successor entity, which would remain bound by this Privacy Policy. We would notify users of any such change as described in Section 16.

By creating an account you confirm that you are at least 13 years old. Accounts that we become aware belong to a child under 13 will be deleted together with the associated data. If you are a parent or guardian and believe that a child under 13 has created an account, please contact our staff on the official Discord server so we can remove it promptly.

Beyond the minimum age, you may not use Fumoshare if you have been permanently banned for a serious violation of our rules, or if you are barred from using the service under applicable law.

If you believe that a moderation action such as a suspension or an account restriction was applied in error, you may appeal it by contacting the staff on our official Discord server. Appeals are reviewed by a human moderator, who may reinstate your account and restore content that was hidden solely because of the action. Repeated or bad-faith appeals may be disregarded.

You can permanently delete your account at any time via the button on the Privacy page. Account deletion is instant and irreversible: it permanently deletes your profile, posts, stories, uploaded images from Cloudflare R2, comments, likes, saved bookmarks, follows, card records, FumoWall rooms, and wishlist entries. The username is permanently reserved to prevent third-party impersonation.

For privacy requests or technical support, you can reach out to the staff on the official Fumoshare Discord server or send a email to Emailmoc.liamg@erahsomuf.

The date of the latest revision is always shown at the top of this page. For significant changes we will provide a prominent notice, such as an in-app notification or an announcement on our official Discord server. Your continued use of Fumoshare after an update takes effect constitutes acceptance of the revised policy.