Privacy Policy

When you log in, the chosen provider (Discord or Google) securely transmits only the basic profile data necessary to create and manage your account:
— Discord: user ID, username, and email address.
— Google: Google ID, name, and email address.

Usernames are automatically sanitized (retaining only a-z0-9_\-. characters) to ensure system compatibility. We do not request access to your private messages, contacts, Google Drive, Discord servers, or other sensitive account data.

Authentication interactions taking place on external platforms (Discord or Google) are governed by their respective privacy policies:
— Discord Privacy Policy
— Google Privacy Policy

Fumoshare acts as an independent data controller once authentication is completed.

When you log in via Discord or Google, we store your unique provider account ID, account name, and email address. By default, your profile avatar on Fumoshare is assigned from a random Fumo plush in our database, keeping your social media avatar private unless updated by you.

For security, session maintenance, and abuse prevention, we temporarily process the IP address and browser User-Agent associated with your session. Session cookies are cryptographically signed and expire automatically after 7 days or upon explicit logout.

The photos you upload (FumoFumo plushies, captions, tags, physical plush sizes) and social interactions (comments, likes, follows) are stored in our database to provide community features. Uploaded images are processed and optimized via self-hosted tools (see Section 8).

When publishing a post, you may optionally attach geographic coordinates. To protect your privacy, latitude and longitude coordinates are automatically blurred using random coordinate offset logic before being saved. Meter-precise location is never stored or displayed. Location submission is entirely optional.

We save your notification preferences (which community activities trigger alerts). If you enable browser Web Push notifications, we store the required cryptographic push endpoints (endpoint URL, p256dh, and auth keys). Push notifications can be revoked at any time through your browser or site settings.

If you report a post or comment, we store the report ID and selected reason. This data is non-public and accessible only to staff for moderation purposes.

Your saved wishlist and owned Fumo plush models are stored to render your personal FumoDex collection page.

Account authentication, publishing and browsing posts, community feed, global sightings map, comments, likes, user profiles, wishlist, and notifications.
Legal basis: performance of a contract (providing the service requested by the user).

Protecting the platform against unauthorized access, spam, and fraudulent activity. Includes IP rate-limiting, upload anti-abuse tokens, Cloudflare Turnstile (CAPTCHA), SHA-256 image hashing to detect duplicate blocked uploads, and automated/manual content moderation.
Legal basis: legitimate interest of the data controller.

Aggregated web traffic measurement using self-hosted Plausible Analytics and Cloudflare Web Analytics, both completely cookie-free and GDPR-compliant.
Legal basis: legitimate interest of the data controller.

Verification of Fumo plush presence and detection of inappropriate (NSFW) content using machine learning models (see Section 5).
Legal basis: legitimate interest of the data controller (maintaining platform safety and content standards).

When client-side detection is enabled, image analysis runs directly inside your web browser on your own device using TensorFlow.js (with WebGL/Wasm acceleration):

1. COCO-SSD (SSDLite MobileNet V2) — Real-time object detection model trained on the COCO dataset (330,000+ images). Detects plush toys and physical objects in the image locally.

2. NSFWJS — Sensitive content classification model developed by Infinite Red based on MobileNet V2. Categorizes image content into Neutral, Drawing, Hentai, Porn, or Sexy.

During browser-based execution, the image does not leave your device. Model weights are served directly from our own static web servers.

When server-side detection is active, images submitted for moderation are analyzed by a local Machine Learning microservice:

OpenAI CLIP (ViT-B/32) — Multimodal AI model trained on public image-text datasets. It performs zero-shot semantic matching between the image and customizable verification prompts (e.g. verifying Fumo presence or identifying explicit content).

The CLIP model runs in an isolated, self-hosted Docker container on our own server (fumoshare_ml). The image is transmitted exclusively over an internal Docker network bridge and is NEVER sent to OpenAI, cloud APIs, or external processors.

None of our machine learning features (COCO-SSD, NSFWJS, or CLIP) send user photos to third-party cloud services. Inference takes place 100% locally — either in your web browser or within our self-hosted server container. Model weights are static, pre-trained open weights hosted on our infrastructure.

Analysis scores determine whether a post is automatically published, queued for manual staff review in the admin panel, or blocked. Decision thresholds are tuned by staff to ensure fair moderation. In borderline cases, posts are flagged for human review.

A cryptographically signed session cookie maintains your logged-in state after Discord or Google authentication. Managed by Better Auth, it is set as httpOnly (inaccessible to client scripts) and strictly enforced over HTTPS. Maximum duration: 7 days. Invalidated instantly upon logout.

The PARAGLIDE_LOCALE cookie remembers your selected language (English, Italian, Japanese, French, Spanish, German). Duration: 400 days. Used solely to serve localized content.

Non-personal user UI preferences are saved locally in your browser: FumoSnap settings, FumoDex version grouping, active theme, and temporary navigation state. This data remains confined to your device and is never uploaded.

Self-hosted Plausible instance running on our infrastructure. Captures anonymous aggregated metrics (page views, browser, OS, general country) using a daily rotating hash of IP + User-Agent. No persistent user tracking or cross-site profiling.
Plausible Data Policy.

Privacy-focused web traffic statistics at the DNS/CDN level without cookies or browser fingerprinting.
Cloudflare Privacy Policy.

Application servers and PostgreSQL database run on an IONOS VPS in European Union data centers. All relational user data resides in Europe.
IONOS Privacy Policy.

Uploaded post images and Fumo catalog assets are stored on Cloudflare R2 (S3-compatible storage) with explicit European Union (EU) data jurisdiction.
Cloudflare Privacy Policy.

Non-intrusive, cookie-free CAPTCHA system used for anti-bot verification when upload tokens expire.
Cloudflare Privacy Policy.

Self-hosted Docker container performing real-time image resizing and WebP conversion. Image URLs are cryptographically signed with HMAC-SHA256 keys to prevent unauthorized image manipulation.

Typography files loaded from Google Fonts (fonts.googleapis.com, fonts.gstatic.com).
Google Privacy Policy.

Sightings map tiles loaded from OpenStreetMap (tile.openstreetmap.org).
OpenStreetMap Privacy Policy.

Content Delivery Network for fast serving of open-source static frontend libraries.

Session cookies and technical session logs (IP, User-Agent) are kept for the session duration or up to a maximum of 7 days.

Published posts, photos, comments, likes, follows, and wishlist items are retained while the user account remains active or until account deletion.

Rate-limit windows reset automatically. Image SHA-256 hashes for blocked content are retained to prevent re-uploading policy-violating images.

Plausible Analytics retains anonymized aggregate data (IP salt rotated every 24 hours).

IONOS SE (VPS & Database, EU) and Cloudflare Inc. (R2 Storage & Turnstile).

Discord Inc. and Google LLC (OAuth2 identity providers).

Plausible Insights OÜ (self-hosted), Google Fonts, OpenStreetMap Foundation, and jsDelivr.

You can permanently delete your account at any time via the button on the Privacy page. Account deletion is instant and irreversible: it permanently deletes your profile, posts, uploaded images from Cloudflare R2, comments, likes, follows, and wishlist records.

For privacy requests or technical support, you can reach out directly to the staff on the official Fumoshare Discord server.