Privacy Policy

When you log in, the chosen provider (Discord or Google) securely transmits only the basic profile data necessary to create and manage your account:
— Discord: user ID, username, and email address.
— Google: Google ID, name, and email address.

Usernames are automatically sanitized (retaining only a-z0-9_\-. characters) to ensure system compatibility. We do not request access to your private messages, contacts, Google Drive, Discord servers, or other sensitive account data.

Authentication interactions taking place on external platforms (Discord or Google) are governed by their respective privacy policies:
— Discord Privacy Policy
— Google Privacy Policy

Fumoshare acts as an independent data controller once authentication is completed.

When you log in via Discord or Google, we store your unique provider account ID, account name, and email address. By default, your profile avatar on Fumoshare is assigned from a random Fumo plush in our database, keeping your social media avatar private unless updated by you.

For security, session maintenance, and abuse prevention, we temporarily process the IP address and browser User-Agent associated with your session. Session cookies are cryptographically signed and expire automatically after 7 days or upon explicit logout.

The photos you upload (FumoFumo plushies, captions, tags, physical plush sizes) and social interactions (comments, likes, follows) are stored in our database to provide community features. Uploaded images are processed and optimized via self-hosted tools (see Section 8).

When publishing a post, you may optionally attach geographic coordinates. To protect your privacy, latitude and longitude coordinates are automatically blurred using random coordinate offset logic before being saved. Meter-precise location is never stored or displayed. Location submission is entirely optional.

We save your notification preferences (which community activities trigger alerts). If you enable browser Web Push notifications, we store the required cryptographic push endpoints (endpoint URL, p256dh, and auth keys). Push notifications can be revoked at any time through your browser or site settings.

If you report a post or comment, we store the report ID and selected reason. This data is non-public and accessible only to staff for moderation purposes.

Your saved wishlist and owned Fumo plush models are stored to render your personal FumoDex collection page.

Account authentication, publishing and browsing posts, community feed, global sightings map, comments, likes, user profiles, wishlist, and notifications.
Legal basis: performance of a contract (providing the service requested by the user).

Protecting the platform against unauthorized access, spam, and fraudulent activity. Includes IP rate-limiting, upload anti-abuse tokens, Cloudflare Turnstile (CAPTCHA), SHA-256 image hashing to detect duplicate blocked uploads, and automated/manual content moderation.
Legal basis: legitimate interest of the data controller.

Aggregated web traffic measurement using self-hosted Plausible Analytics and Cloudflare Web Analytics, both completely cookie-free and GDPR-compliant.
Legal basis: legitimate interest of the data controller.

Verification of Fumo plush presence via OpenAI CLIP (ViT-B/32) and detection of inappropriate or sensitive (NSFW) content (including pornography, hentai, and sexually explicit imagery) via a dedicated, self-hosted nsfwjs model. All models run in isolated self-hosted Docker containers.
Legal basis: legitimate interest of the data controller (maintaining platform safety and content standards).

All image analysis is performed server-side by local Machine Learning models running in isolated, self-hosted Docker containers:

OpenAI CLIP (ViT-B/32) — Multimodal AI model running in a dedicated container (fumoshare_ml). It performs zero-shot semantic matching between the image embedding and customizable verification prompts configured by staff administrators. The model is used exclusively for Fumo Detection: verifying the presence of a physical FumoFumo plush toy in the uploaded photo.

nsfwjs (TensorFlow.js) — Specialized neural network classifier running in a dedicated microservice container (fumoshare_nsfw). It categorizes images across five standard visual classes (Porn, Hentai, Sexy, Drawing, Neutral) to compute a weighted sensitivity score:
— NSFW & Sensitive Content Detection: accurately identifying photographic and illustrated sexual content, hentai, and explicit imagery before publication.

Both models run in isolated local Docker containers on our own server. Images are transmitted exclusively over an internal Docker network bridge and are NEVER sent to OpenAI, third-party cloud APIs, or external processors.

Our machine learning system does not send user photos to any third-party cloud service. All inference takes place 100% within our self-hosted server infrastructure. Both models (OpenAI CLIP and nsfwjs) use static, pre-trained open weights hosted entirely on our own Docker containers. No data leaves our European Union servers during classification.

Analysis scores determine whether a post is automatically published, queued for manual staff review in the admin panel, or blocked. Decision thresholds are fully configurable by staff administrators through the admin panel to ensure fair moderation. In borderline cases, posts are flagged for human review.

A cryptographically signed session cookie maintains your logged-in state after Discord or Google authentication. Managed by Better Auth, it is set as httpOnly (inaccessible to client scripts) and strictly enforced over HTTPS. Maximum duration: 7 days. Invalidated instantly upon logout.

The PARAGLIDE_LOCALE cookie remembers your selected language (English, Italian, Japanese, French, Spanish, German). Duration: 400 days. Used solely to serve localized content.

Non-personal user UI preferences are saved locally in your browser: FumoSnap settings, FumoDex version grouping, active theme, and temporary navigation state. This data remains confined to your device and is never uploaded.

Self-hosted Plausible instance running on our infrastructure. Captures anonymous aggregated metrics (page views, browser, OS, general country) using a daily rotating hash of IP + User-Agent. No persistent user tracking or cross-site profiling.
Plausible Data Policy.

Privacy-focused web traffic statistics at the DNS/CDN level without cookies or browser fingerprinting.
Cloudflare Privacy Policy.

Application servers and PostgreSQL database run on an IONOS VPS in European Union data centers. All relational user data resides in Europe.
IONOS Privacy Policy.

Uploaded post images and Fumo catalog assets are stored on Cloudflare R2 (S3-compatible storage) with explicit European Union (EU) data jurisdiction.
Cloudflare Privacy Policy.

Non-intrusive, cookie-free CAPTCHA system used for anti-bot verification when upload tokens expire.
Cloudflare Privacy Policy.

Self-hosted Docker container performing real-time image resizing and WebP conversion. Image URLs are cryptographically signed with HMAC-SHA256 keys to prevent unauthorized image manipulation.

Typography files loaded from Google Fonts (fonts.googleapis.com, fonts.gstatic.com).
Google Privacy Policy.

Sightings map tiles loaded from OpenStreetMap (tile.openstreetmap.org).
OpenStreetMap Privacy Policy.

Content Delivery Network for fast serving of open-source static frontend libraries.

Session cookies and technical session logs (IP, User-Agent) are kept for the session duration or up to a maximum of 7 days.

Published posts, photos, comments, likes, follows, and wishlist items are retained while the user account remains active or until account deletion.

Rate-limit windows reset automatically. Image SHA-256 hashes for blocked content are retained to prevent re-uploading policy-violating images.

Plausible Analytics retains anonymized aggregate data (IP salt rotated every 24 hours).

IONOS SE (VPS & Database, EU) and Cloudflare Inc. (R2 Storage & Turnstile).

Discord Inc. and Google LLC (OAuth2 identity providers).

Plausible Insights OÜ (self-hosted), Google Fonts, OpenStreetMap Foundation, and jsDelivr.

You can permanently delete your account at any time via the button on the Privacy page. Account deletion is instant and irreversible: it permanently deletes your profile, posts, uploaded images from Cloudflare R2, comments, likes, follows, and wishlist records.

For privacy requests or technical support, you can reach out directly to the staff on the official Fumoshare Discord server.