Updated 29 October 2026 · Public preview; purchases are closed
Privacy notice
We use information to operate your account and the wall. Optional device storage is your choice; the preview does not accept payments. Private artwork submission is restricted to confirmed purchasers.
Who is responsible
The designated seller is Bouras African Investment Group Ltd. For privacy requests, email anas.bouras@the100experiment.com; see seller information. New registration and commerce remain closed while those details and the rights-handling process are completed.
Information used by the preview
Where an account exists, records can include its email identifier, salted password hash, hashed session and recovery tokens, account ID, drafts, exact selections, order status and security/audit events. Public pages may be requested without signing in. Hosting and security systems may receive request metadata such as IP addresses, timestamps and browser information; their exact log retention is being verified.
Passwords are hashed with scrypt. Session and recovery tokens are stored as hashes. Sessions expire after seven days. Email verification and email-based password recovery use single-use links when the email service is enabled. New accounts require verified email ownership before sign-in. Registration remains closed during operational setup. Existing preview accounts may use their private recovery key when the email service is unavailable; an email identifier alone is not proof of verified ownership. Verification and reset tokens are stored as hashes. Pending email jobs use encrypted content, and that content is removed after successful mail handoff, expiry or final delivery failure. Password reset links expire after 30 minutes and verification links after 24 hours.
For owner accounts, authenticator setup secrets are stored encrypted and single-use recovery codes are stored as hashes. Recent owner verification is linked to a signed-in session and expires after 15 minutes. An email password reset does not remove the owner’s second factor. Owner invitations expire after one hour and can be used once.
If you email support, we use your contact details and message to respond and handle your request. Please avoid passwords, recovery keys and unnecessary sensitive information.
Contact enquiries
The contact form collects your name, email address, selected topic, subject and message so we can respond to press, support, collaboration, general or privacy enquiries. Messages are sent only to the project’s contact inbox. Queued message content is encrypted and removed from the delivery queue after mail handoff, expiry or final failure. A submission reference and limited audit information support retries and duplicate prevention. Temporary hashed email counters limit abuse. Submitting an enquiry does not subscribe you to marketing. Inbox copies fall within the support retention process described below.
Purpose and legal basis
Account and draft processing supports the service you request or steps towards a contract. Security, fraud prevention and operational auditing are assessed under legitimate interests or applicable obligations. Optional browser persistence uses your storage choice. Any applicable legal record-keeping obligation is handled separately from optional marketing consent.
Public information and artwork
Only published artwork, a display name, public text, destination link and any optional public profile fields should be displayed. An account email is not public wall content by default. Public material may be viewed, copied or indexed by other people. Local previews are processed in your browser; choosing a local image in the preview does not upload it to us.
When a confirmed purchaser submits artwork, the original is held in private server storage with its type, byte size, digest and revision/job records. It is not publicly downloadable or approved merely because it was uploaded. Submitted artwork must pass automatic technical processing before publication when public delivery is enabled. Human content-policy checks follow publication. A replacement request is recorded in your account and queued for email delivery when necessary. Publication remains closed during launch acceptance. Uploaded originals can contain embedded metadata, so remove location and other private metadata before submission. Initial file checks do not remove it. Keep your own source copy.
Storage on your device
Essential sign-in uses a secure, HTTP-only session cookie. A preference cookie remembers whether optional draft storage is allowed. Selection and poster persistence are off until allowed. See the storage inventory. Cookie settings are available at the bottom of every page.
Service providers and international access
The public site is hosted through Nindohost. The deployment uses a private server-side SQLite database. For artwork processing, the server sends the submitted raster image to Cloudinary using authenticated temporary assets. This includes any metadata still embedded in the submitted original; remove private metadata before upload. The server retrieves processed posters and, for GIFs, animation, verifies them and stores the derivatives privately on Nindohost for controlled public delivery after technical checks. It requests deletion of the temporary Cloudinary assets afterward. Unconfirmed cleanup is recorded for retry and blocks further processing; deletion requests do not establish erasure of provider logs or backups. Cloudinary also receives service-request metadata. Do not submit confidential or sensitive material. Provider agreements, processing locations, international-transfer safeguards and provider log/backup retention remain launch-verification items. No payment provider is currently enabled. Provider roles, hosting/backup locations, processor agreements and any applicable international-transfer safeguards must be verified before expanding processing. Bank-provider addresses do not establish where website information is stored.
Retention and deletion
The preference cookie lasts up to 180 days. Optional selection and retry data remain until you clear them, reject optional storage or your preference expires and you return. Local posters are not restored after 24 hours; expired posters are removed when next accessed. You can remove the saved poster or reject optional storage to request deletion of this application’s saved browser data.
Optional audience measurement records approved page paths, referring domains, viewport device categories and a daily salted hash of a random tab identifier only after opt-in. It does not collect account IDs, full referrer URLs, query strings, IP addresses or precise location in the application analytics table. Events are retained for 30 days and removed by scheduled housekeeping. Do Not Track and Global Privacy Control suppress this collection. The broader server-side account, draft, finance, support, security and backup retention schedule is not yet finalised. Preview records currently remain until an authorised cleanup or deletion process is carried out. We do not promise automatic account deletion or complete backup erasure that has not been implemented.
Your rights and choices
Depending on applicable law, you may have rights to access, correct, delete, restrict, object to or obtain a portable copy of your information, withdraw consent, and complain to a competent authority. These rights are subject to applicable conditions and lawful retention obligations. Signed-in users can download their account and service records, end other sessions and track privacy requests from My account. Deletion requests are reviewed rather than immediately deleting records; legal retention and backup handling may apply. You may also send requests to anas.bouras@the100experiment.com. See what to include.
Marketing and changes
Optional first-party audience measurement is off until selected in Privacy settings. No advertising trackers are installed. No marketing subscription is created by signing in, saving a draft, accepting purchase terms or choosing device storage. We will update this notice before introducing materially different processing.